{ "statistics": { "processing": [ { "name": "CAPE", "time": 41.127 }, { "name": "AnalysisInfo", "time": 0.027 }, { "name": "BehaviorAnalysis", "time": 0.233 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 0.0 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antiemu_wine_func", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "antisandbox_mouse_hook", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_suspend", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "debugs_self", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "infostealer_keylog", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_document_file", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.0 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.0 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.0 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.002 }, { "name": "antianalysis_detectreg", "time": 0.023 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.003 }, { "name": "antiav_detectreg", "time": 0.112 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.002 }, { "name": "antivm_generic_bios", "time": 0.001 }, { "name": "antivm_generic_diskreg", "time": 0.005 }, { "name": "antivm_hyperv_keys", "time": 0.002 }, { "name": "antivm_parallels_keys", "time": 0.006 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.001 }, { "name": "antivm_vbox_keys", "time": 0.013 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.0 }, { "name": "antivm_vmware_keys", "time": 0.008 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.004 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.006 }, { "name": "ketrican_regkeys", "time": 0.001 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.002 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.0 }, { "name": "disables_browser_warn", "time": 0.001 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.0 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.0 }, { "name": "removes_windows_defender_contextmenu", "time": 0.0 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.002 }, { "name": "infostealer_ftp", "time": 0.038 }, { "name": "infostealer_im", "time": 0.022 }, { "name": "infostealer_mail", "time": 0.007 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.004 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.0 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.0 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.003 }, { "name": "ransomware_files", "time": 0.005 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.001 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.037 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.001 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.001 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "MediaCreationTool_22H2.exe", "path": "/opt/CAPEv2/storage/binaries/690c8a63769d444fad47b7ddecee7f24c9333aa735d0bd46587d0df5cf15cde5", "guest_paths": "", "size": 19463448, "crc32": "A0FB5841", "md5": "aa2ad37bb74c05a49417e3d2f1bd89ce", "sha1": "1bf5f814ffe801b4e6f118e829c0d2821d78a60a", "sha256": "690c8a63769d444fad47b7ddecee7f24c9333aa735d0bd46587d0df5cf15cde5", "sha512": "fab34ccbefbcdcec8f823840c16ae564812d0e063319c4eb4cc1112cf775b8764fea59d0bbafd4774d84b56e08c24056fa96f27425c4060e12eb547c2ae086cc", "rh_hash": null, "ssdeep": "196608:MmtHa+5hH1km/Sf7byFXKEBmih9S5rQ5FNFl001p4Ki:Y+5RB/SDbyFBH9eQD/l00/4", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1DA17DF0176E99214F1B36B34A9B59291096BBC119935C43EEE7C760DCB3F9B08A7C732", "sha3_384": "92641da0240d5fed25e1c3be44f123674c5cda19e370139f457192e6ee2cb8b3f0b783af24f8e36dfa1cc5e0b6ba56d2", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x000729b0", "ep_bytes": "e8a0070000e979fdffffff250cd74700", "peid_signatures": null, "reported_checksum": "0x01290880", "actual_checksum": "0x01290880", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "SetupPrep.pdb", "imports": { "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x47d000", "name": "GetTokenInformation" }, { "address": "0x47d004", "name": "SetSecurityDescriptorGroup" }, { "address": "0x47d008", "name": "RegQueryValueExW" }, { "address": "0x47d00c", "name": "OpenThreadToken" }, { "address": "0x47d010", "name": "AddAccessAllowedAce" }, { "address": "0x47d014", "name": "DuplicateTokenEx" }, { "address": "0x47d018", "name": "SetSecurityDescriptorControl" }, { "address": "0x47d01c", "name": "GetLengthSid" }, { "address": "0x47d020", "name": "RegDeleteValueW" }, { "address": "0x47d024", "name": "CreateProcessAsUserW" }, { "address": "0x47d028", "name": "RegOpenKeyExW" }, { "address": "0x47d02c", "name": "InitializeAcl" }, { "address": "0x47d030", "name": "InitializeSecurityDescriptor" }, { "address": "0x47d034", "name": "CheckTokenMembership" }, { "address": "0x47d038", "name": "FreeSid" }, { "address": "0x47d03c", "name": "OpenProcessToken" }, { "address": "0x47d040", "name": "RegSetValueExW" }, { "address": "0x47d044", "name": "RegSetKeySecurity" }, { "address": "0x47d048", "name": "CopySid" }, { "address": "0x47d04c", "name": "RegCreateKeyExW" }, { "address": "0x47d050", "name": "RegFlushKey" }, { "address": "0x47d054", "name": "AllocateAndInitializeSid" }, { "address": "0x47d058", "name": "RegDeleteKeyW" }, { "address": "0x47d05c", "name": "SetTokenInformation" }, { "address": "0x47d060", "name": "GetAce" }, { "address": "0x47d064", "name": "SetSecurityDescriptorOwner" }, { "address": "0x47d068", "name": "RegQueryInfoKeyW" }, { "address": "0x47d06c", "name": "RegEnumKeyW" }, { "address": "0x47d070", "name": "RegCloseKey" }, { "address": "0x47d074", "name": "RegNotifyChangeKeyValue" }, { "address": "0x47d078", "name": "SetSecurityDescriptorDacl" }, { "address": "0x47d07c", "name": "GetTraceEnableLevel" }, { "address": "0x47d080", "name": "AdjustTokenPrivileges" }, { "address": "0x47d084", "name": "RegEnumValueW" }, { "address": "0x47d088", "name": "InitiateSystemShutdownExW" }, { "address": "0x47d08c", "name": "SetSecurityInfo" }, { "address": "0x47d090", "name": "RegUnLoadKeyW" }, { "address": "0x47d094", "name": "QueryAllTracesW" }, { "address": "0x47d098", "name": "GetTraceLoggerHandle" }, { "address": "0x47d09c", "name": "StopTraceW" }, { "address": "0x47d0a0", "name": "UnregisterTraceGuids" }, { "address": "0x47d0a4", "name": "RegisterTraceGuidsW" }, { "address": "0x47d0a8", "name": "GetTraceEnableFlags" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x47d114", "name": "DeleteFileW" }, { "address": "0x47d118", "name": "CloseHandle" }, { "address": "0x47d11c", "name": "GetNativeSystemInfo" }, { "address": "0x47d120", "name": "LoadLibraryW" }, { "address": "0x47d124", "name": "FindResourceExW" }, { "address": "0x47d128", "name": "ResetEvent" }, { "address": "0x47d12c", "name": "LoadResource" }, { "address": "0x47d130", "name": "GetOverlappedResult" }, { "address": "0x47d134", "name": "SetFilePointerEx" }, { "address": "0x47d138", "name": "LocalFree" }, { "address": "0x47d13c", "name": "MoveFileExW" }, { "address": "0x47d140", "name": "ReplaceFileW" }, { "address": "0x47d144", "name": "LockFileEx" }, { "address": "0x47d148", "name": "DeleteCriticalSection" }, { "address": "0x47d14c", "name": "GetCurrentProcessId" }, { "address": "0x47d150", "name": "CreateProcessW" }, { "address": "0x47d154", "name": "GetModuleHandleW" }, { "address": "0x47d158", "name": "FreeLibrary" }, { "address": "0x47d15c", "name": "CopyFileW" }, { "address": "0x47d160", "name": "WideCharToMultiByte" }, { "address": "0x47d164", "name": "SystemTimeToTzSpecificLocalTime" }, { "address": "0x47d168", "name": "GetSystemTime" }, { "address": "0x47d16c", "name": "DosDateTimeToFileTime" }, { "address": "0x47d170", "name": "GetSystemWindowsDirectoryW" }, { "address": "0x47d174", "name": "MoveFileW" }, { "address": "0x47d178", "name": "IsWow64Process" }, { "address": "0x47d17c", "name": "GetDriveTypeW" }, { "address": "0x47d180", "name": "LoadLibraryExW" }, { "address": "0x47d184", "name": "FlushFileBuffers" }, { "address": "0x47d188", "name": "LockResource" }, { "address": "0x47d18c", "name": "GetCurrentThread" }, { "address": "0x47d190", "name": "SetEvent" }, { "address": "0x47d194", "name": "CreateFileA" }, { "address": "0x47d198", "name": "VerifyVersionInfoW" }, { "address": "0x47d19c", "name": "IsValidLocale" }, { "address": "0x47d1a0", "name": "VerSetConditionMask" }, { "address": "0x47d1a4", "name": "IsValidCodePage" }, { "address": "0x47d1a8", "name": "MapViewOfFile" }, { "address": "0x47d1ac", "name": "CreateFileMappingW" }, { "address": "0x47d1b0", "name": "CreatePipe" }, { "address": "0x47d1b4", "name": "GetUserDefaultUILanguage" }, { "address": "0x47d1b8", "name": "GetSystemDefaultUILanguage" }, { "address": "0x47d1bc", "name": "SearchPathW" }, { "address": "0x47d1c0", "name": "OutputDebugStringA" }, { "address": "0x47d1c4", "name": "SleepConditionVariableSRW" }, { "address": "0x47d1c8", "name": "WakeAllConditionVariable" }, { "address": "0x47d1cc", "name": "AcquireSRWLockExclusive" }, { "address": "0x47d1d0", "name": "ReleaseSRWLockExclusive" }, { "address": "0x47d1d4", "name": "GetLastError" }, { "address": "0x47d1d8", "name": "LeaveCriticalSection" }, { "address": "0x47d1dc", "name": "InitializeCriticalSectionAndSpinCount" }, { "address": "0x47d1e0", "name": "GetTickCount64" }, { "address": "0x47d1e4", "name": "LocalFileTimeToFileTime" }, { "address": "0x47d1e8", "name": "GetTimeZoneInformation" }, { "address": "0x47d1ec", "name": "Sleep" }, { "address": "0x47d1f0", "name": "GetExitCodeProcess" }, { "address": "0x47d1f4", "name": "MultiByteToWideChar" }, { "address": "0x47d1f8", "name": "CreateEventW" }, { "address": "0x47d1fc", "name": "GetLogicalDriveStringsW" }, { "address": "0x47d200", "name": "SetFileAttributesW" }, { "address": "0x47d204", "name": "GetSystemDirectoryW" }, { "address": "0x47d208", "name": "OpenEventW" }, { "address": "0x47d20c", "name": "GetFileAttributesW" }, { "address": "0x47d210", "name": "CreateFileW" }, { "address": "0x47d214", "name": "WaitForSingleObject" }, { "address": "0x47d218", "name": "SetFilePointer" }, { "address": "0x47d21c", "name": "FindClose" }, { "address": "0x47d220", "name": "CreateHardLinkW" }, { "address": "0x47d224", "name": "CreateMutexW" }, { "address": "0x47d228", "name": "UnlockFileEx" }, { "address": "0x47d22c", "name": "SetEndOfFile" }, { "address": "0x47d230", "name": "GetVersionExW" }, { "address": "0x47d234", "name": "SetThreadPreferredUILanguages" }, { "address": "0x47d238", "name": "GetLocaleInfoW" }, { "address": "0x47d23c", "name": "GetPrivateProfileIntW" }, { "address": "0x47d240", "name": "InitializeCriticalSection" }, { "address": "0x47d244", "name": "GlobalUnlock" }, { "address": "0x47d248", "name": "GlobalLock" }, { "address": "0x47d24c", "name": "MulDiv" }, { "address": "0x47d250", "name": "FindResourceW" }, { "address": "0x47d254", "name": "SizeofResource" }, { "address": "0x47d258", "name": "QueryDosDeviceW" }, { "address": "0x47d25c", "name": "RaiseException" }, { "address": "0x47d260", "name": "DuplicateHandle" }, { "address": "0x47d264", "name": "GetShortPathNameW" }, { "address": "0x47d268", "name": "HeapSize" }, { "address": "0x47d26c", "name": "HeapReAlloc" }, { "address": "0x47d270", "name": "IsDebuggerPresent" }, { "address": "0x47d274", "name": "VirtualQuery" }, { "address": "0x47d278", "name": "GetPriorityClass" }, { "address": "0x47d27c", "name": "GetThreadPriority" }, { "address": "0x47d280", "name": "OutputDebugStringW" }, { "address": "0x47d284", "name": "GetExitCodeThread" }, { "address": "0x47d288", "name": "SetThreadPriority" }, { "address": "0x47d28c", "name": "SetPriorityClass" }, { "address": "0x47d290", "name": "CreateThread" }, { "address": "0x47d294", "name": "FormatMessageW" }, { "address": "0x47d298", "name": "GetPrivateProfileSectionW" }, { "address": "0x47d29c", "name": "GetFileTime" }, { "address": "0x47d2a0", "name": "FileTimeToSystemTime" }, { "address": "0x47d2a4", "name": "CompareFileTime" }, { "address": "0x47d2a8", "name": "CopyFileExW" }, { "address": "0x47d2ac", "name": "SetFileInformationByHandle" }, { "address": "0x47d2b0", "name": "GetFileInformationByHandle" }, { "address": "0x47d2b4", "name": "DeviceIoControl" }, { "address": "0x47d2b8", "name": "GetFileInformationByHandleEx" }, { "address": "0x47d2bc", "name": "SetCurrentDirectoryW" }, { "address": "0x47d2c0", "name": "GetCurrentDirectoryW" }, { "address": "0x47d2c4", "name": "GetFinalPathNameByHandleW" }, { "address": "0x47d2c8", "name": "GetLongPathNameW" }, { "address": "0x47d2cc", "name": "SetLastError" }, { "address": "0x47d2d0", "name": "GetTickCount" }, { "address": "0x47d2d4", "name": "GetSystemTimeAsFileTime" }, { "address": "0x47d2d8", "name": "GetCurrentThreadId" }, { "address": "0x47d2dc", "name": "QueryPerformanceCounter" }, { "address": "0x47d2e0", "name": "SetUnhandledExceptionFilter" }, { "address": "0x47d2e4", "name": "UnhandledExceptionFilter" }, { "address": "0x47d2e8", "name": "GetStartupInfoW" }, { "address": "0x47d2ec", "name": "SetEnvironmentVariableW" }, { "address": "0x47d2f0", "name": "WaitForMultipleObjects" }, { "address": "0x47d2f4", "name": "GetModuleFileNameW" }, { "address": "0x47d2f8", "name": "SetFileTime" }, { "address": "0x47d2fc", "name": "TerminateProcess" }, { "address": "0x47d300", "name": "ExpandEnvironmentStringsW" }, { "address": "0x47d304", "name": "WriteFile" }, { "address": "0x47d308", "name": "GetCurrentProcess" }, { "address": "0x47d30c", "name": "FindNextFileW" }, { "address": "0x47d310", "name": "GetFullPathNameW" }, { "address": "0x47d314", "name": "GetCommandLineW" }, { "address": "0x47d318", "name": "EnterCriticalSection" }, { "address": "0x47d31c", "name": "CompareStringW" }, { "address": "0x47d320", "name": "GetFileSizeEx" }, { "address": "0x47d324", "name": "FindFirstFileW" }, { "address": "0x47d328", "name": "ReadFile" }, { "address": "0x47d32c", "name": "CreateDirectoryW" }, { "address": "0x47d330", "name": "GetProcessHeap" }, { "address": "0x47d334", "name": "GetProcAddress" }, { "address": "0x47d338", "name": "HeapAlloc" }, { "address": "0x47d33c", "name": "GetModuleHandleExW" }, { "address": "0x47d340", "name": "HeapFree" }, { "address": "0x47d344", "name": "GetVersionExA" }, { "address": "0x47d348", "name": "UnmapViewOfFile" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x47d5f4", "name": "GetKeyState" }, { "address": "0x47d5f8", "name": "GetFocus" }, { "address": "0x47d5fc", "name": "IsChild" }, { "address": "0x47d600", "name": "GetNextDlgTabItem" }, { "address": "0x47d604", "name": "GetWindowLongW" }, { "address": "0x47d608", "name": "RedrawWindow" }, { "address": "0x47d60c", "name": "CopyRect" }, { "address": "0x47d610", "name": "DrawFocusRect" }, { "address": "0x47d614", "name": "SetWindowLongW" }, { "address": "0x47d618", "name": "SystemParametersInfoW" }, { "address": "0x47d61c", "name": "GetDC" }, { "address": "0x47d620", "name": "GetSysColor" }, { "address": "0x47d624", "name": "GetClientRect" }, { "address": "0x47d628", "name": "GetParent" }, { "address": "0x47d62c", "name": "InvalidateRect" }, { "address": "0x47d630", "name": "LoadStringW" }, { "address": "0x47d634", "name": "PostMessageW" }, { "address": "0x47d638", "name": "GetSystemMenu" }, { "address": "0x47d63c", "name": "GetSysColorBrush" }, { "address": "0x47d640", "name": "ClientToScreen" }, { "address": "0x47d644", "name": "GetSystemMetrics" }, { "address": "0x47d648", "name": "IsWindowVisible" }, { "address": "0x47d64c", "name": "FillRect" }, { "address": "0x47d650", "name": "AdjustWindowRectEx" }, { "address": "0x47d654", "name": "SetCursor" }, { "address": "0x47d658", "name": "LoadCursorW" }, { "address": "0x47d65c", "name": "TrackMouseEvent" }, { "address": "0x47d660", "name": "EnableWindow" }, { "address": "0x47d664", "name": "EnableMenuItem" }, { "address": "0x47d668", "name": "DrawTextW" }, { "address": "0x47d66c", "name": "CharUpperW" }, { "address": "0x47d670", "name": "GetWindowRect" }, { "address": "0x47d674", "name": "MessageBoxW" }, { "address": "0x47d678", "name": "ScreenToClient" }, { "address": "0x47d67c", "name": "SendMessageW" }, { "address": "0x47d680", "name": "SetTimer" }, { "address": "0x47d684", "name": "PostThreadMessageW" }, { "address": "0x47d688", "name": "KillTimer" }, { "address": "0x47d68c", "name": "LoadImageW" } ] }, "MFC42u": { "dll": "MFC42u.dll", "imports": [] }, "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x47d704", "name": "iswspace" }, { "address": "0x47d708", "name": "bsearch" }, { "address": "0x47d70c", "name": "__CxxFrameHandler3" }, { "address": "0x47d710", "name": "__setusermatherr" }, { "address": "0x47d714", "name": "__p__fmode" }, { "address": "0x47d718", "name": "_cexit" }, { "address": "0x47d71c", "name": "_exit" }, { "address": "0x47d720", "name": "realloc" }, { "address": "0x47d724", "name": "_errno" }, { "address": "0x47d728", "name": "_wtoi" }, { "address": "0x47d72c", "name": "free" }, { "address": "0x47d730", "name": "towlower" }, { "address": "0x47d734", "name": "_wcstoui64" }, { "address": "0x47d738", "name": "wcstoul" }, { "address": "0x47d73c", "name": "towupper" }, { "address": "0x47d740", "name": "_vscwprintf" }, { "address": "0x47d744", "name": "_vsnprintf" }, { "address": "0x47d748", "name": "_wcsicmp" }, { "address": "0x47d74c", "name": "wcsrchr" }, { "address": "0x47d750", "name": "exit" }, { "address": "0x47d754", "name": "wcsncmp" }, { "address": "0x47d758", "name": "__set_app_type" }, { "address": "0x47d75c", "name": "__wgetmainargs" }, { "address": "0x47d760", "name": "_amsg_exit" }, { "address": "0x47d764", "name": "__p__commode" }, { "address": "0x47d768", "name": "_XcptFilter" }, { "address": "0x47d76c", "name": "_wcsnicmp" }, { "address": "0x47d770", "name": "wcsstr" }, { "address": "0x47d774", "name": "wcschr" }, { "address": "0x47d778", "name": "_purecall" }, { "address": "0x47d77c", "name": "_vsnwprintf" }, { "address": "0x47d780", "name": "memcpy_s" }, { "address": "0x47d784", "name": "_CxxThrowException" }, { "address": "0x47d788", "name": "__RTDynamicCast" }, { "address": "0x47d78c", "name": "_ftol2" }, { "address": "0x47d790", "name": "memcmp" }, { "address": "0x47d794", "name": "memcpy" }, { "address": "0x47d798", "name": "_initterm" }, { "address": "0x47d79c", "name": "_wcmdln" }, { "address": "0x47d7a0", "name": "memmove" }, { "address": "0x47d7a4", "name": "_except_handler4_common" }, { "address": "0x47d7a8", "name": "_controlfp" }, { "address": "0x47d7ac", "name": "??1type_info@@UAE@XZ" }, { "address": "0x47d7b0", "name": "?terminate@@YAXXZ" }, { "address": "0x47d7b4", "name": "_onexit" }, { "address": "0x47d7b8", "name": "__dllonexit" }, { "address": "0x47d7bc", "name": "_unlock" }, { "address": "0x47d7c0", "name": "_lock" }, { "address": "0x47d7c4", "name": "memset" } ] }, "COMCTL32": { "dll": "COMCTL32.dll", "imports": [ { "address": "0x47d0b0", "name": "InitCommonControlsEx" } ] }, "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x47d828", "name": "CoUninitialize" }, { "address": "0x47d82c", "name": "CoCreateInstance" }, { "address": "0x47d830", "name": "CoInitializeEx" } ] }, "SHELL32": { "dll": "SHELL32.dll", "imports": [ { "address": "0x47d5ec", "name": "CommandLineToArgvW" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x47d7cc", "name": "NtSetInformationThread" }, { "address": "0x47d7d0", "name": "NtShutdownSystem" }, { "address": "0x47d7d4", "name": "RtlAllocateHeap" }, { "address": "0x47d7d8", "name": "RtlNtStatusToDosError" }, { "address": "0x47d7dc", "name": "NtSetInformationFile" }, { "address": "0x47d7e0", "name": "RtlDosPathNameToNtPathName_U_WithStatus" }, { "address": "0x47d7e4", "name": "RtlFreeHeap" }, { "address": "0x47d7e8", "name": "NtWriteFile" }, { "address": "0x47d7ec", "name": "RtlInitUnicodeString" }, { "address": "0x47d7f0", "name": "NtReadFile" }, { "address": "0x47d7f4", "name": "RtlReAllocateHeap" }, { "address": "0x47d7f8", "name": "NtClose" }, { "address": "0x47d7fc", "name": "RtlExpandEnvironmentStrings" }, { "address": "0x47d800", "name": "NtQueryInformationFile" }, { "address": "0x47d804", "name": "NtWaitForSingleObject" }, { "address": "0x47d808", "name": "NtOpenFile" }, { "address": "0x47d80c", "name": "NtDuplicateToken" }, { "address": "0x47d810", "name": "RtlGetVersion" }, { "address": "0x47d814", "name": "RtlRaiseStatus" }, { "address": "0x47d818", "name": "NtYieldExecution" }, { "address": "0x47d81c", "name": "RtlAdjustPrivilege" }, { "address": "0x47d820", "name": "NtSetInformationProcess" } ] }, "USERENV": { "dll": "USERENV.dll", "imports": [ { "address": "0x47d694", "name": "DestroyEnvironmentBlock" }, { "address": "0x47d698", "name": "CreateEnvironmentBlock" } ] }, "WTSAPI32": { "dll": "WTSAPI32.dll", "imports": [ { "address": "0x47d6e0", "name": "WTSQueryUserToken" } ] }, "WDSCORE": { "dll": "WDSCORE.dll", "imports": [ { "address": "0x47d6b8", "name": "WdsSetupLogMessageW" }, { "address": "0x47d6bc", "name": "ConstructPartialMsgVW" }, { "address": "0x47d6c0", "name": "WdsGenericSetupLogInit" }, { "address": "0x47d6c4", "name": "CurrentIP" }, { "address": "0x47d6c8", "name": "WdsSetupLogDestroy" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x47d5d8", "name": "I_RpcMapWin32Status" }, { "address": "0x47d5dc", "name": "UuidToStringW" }, { "address": "0x47d5e0", "name": "RpcStringFreeW" }, { "address": "0x47d5e4", "name": "UuidFromStringW" } ] }, "GDI32": { "dll": "GDI32.dll", "imports": [ { "address": "0x47d0c8", "name": "CreateICW" }, { "address": "0x47d0cc", "name": "CreateSolidBrush" }, { "address": "0x47d0d0", "name": "DeleteObject" }, { "address": "0x47d0d4", "name": "DeleteDC" }, { "address": "0x47d0d8", "name": "StretchBlt" }, { "address": "0x47d0dc", "name": "CreateCompatibleDC" }, { "address": "0x47d0e0", "name": "BitBlt" }, { "address": "0x47d0e4", "name": "SetBrushOrgEx" }, { "address": "0x47d0e8", "name": "SetBkMode" }, { "address": "0x47d0ec", "name": "GetStockObject" }, { "address": "0x47d0f0", "name": "GetObjectW" }, { "address": "0x47d0f4", "name": "GetDeviceCaps" }, { "address": "0x47d0f8", "name": "CreateFontIndirectW" }, { "address": "0x47d0fc", "name": "CreateDIBSection" }, { "address": "0x47d100", "name": "TranslateCharsetInfo" }, { "address": "0x47d104", "name": "CreateDCW" }, { "address": "0x47d108", "name": "EnumFontFamiliesExW" }, { "address": "0x47d10c", "name": "SetTextColor" } ] }, "Cabinet": { "dll": "Cabinet.dll", "imports": [] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x47d5c4", "name": "VariantInit" }, { "address": "0x47d5c8", "name": "VariantClear" }, { "address": "0x47d5cc", "name": "SysFreeString" }, { "address": "0x47d5d0", "name": "SysAllocString" } ] }, "VERSION": { "dll": "VERSION.dll", "imports": [ { "address": "0x47d6a8", "name": "GetFileVersionInfoExW" }, { "address": "0x47d6ac", "name": "GetFileVersionInfoSizeExW" }, { "address": "0x47d6b0", "name": "VerQueryValueW" } ] }, "WIMGAPI": { "dll": "WIMGAPI.DLL", "imports": [ { "address": "0x47d6d0", "name": "WIMUnmountImage" }, { "address": "0x47d6d4", "name": "WIMInitFileIOCallbacks" }, { "address": "0x47d6d8", "name": "WIMSetFileIOCallbackTemporaryPath" } ] }, "bcrypt": { "dll": "bcrypt.dll", "imports": [ { "address": "0x47d6e8", "name": "BCryptDestroyHash" }, { "address": "0x47d6ec", "name": "BCryptCloseAlgorithmProvider" }, { "address": "0x47d6f0", "name": "BCryptFinishHash" }, { "address": "0x47d6f4", "name": "BCryptOpenAlgorithmProvider" }, { "address": "0x47d6f8", "name": "BCryptHashData" }, { "address": "0x47d6fc", "name": "BCryptCreateHash" } ] }, "UxTheme": { "dll": "UxTheme.dll", "imports": [ { "address": "0x47d6a0", "name": "IsAppThemed" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0007d83c", "size": "0x000001a4" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00081000", "size": "0x00a8150c" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0128db58", "size": "0x000021c0" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00b03000", "size": "0x000066d4" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00015bf0", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00004de4", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00004d38", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x0007d000", "size": "0x00000838" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00077b30", "size_of_data": "0x00077c00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.36" }, { "name": ".data", "raw_address": "0x00078000", "virtual_address": "0x00079000", "virtual_size": "0x00003170", "size_of_data": "0x00000c00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "4.65" }, { "name": ".idata", "raw_address": "0x00078c00", "virtual_address": "0x0007d000", "virtual_size": "0x00002bd4", "size_of_data": "0x00002c00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.84" }, { "name": ".boxload", "raw_address": "0x0007b800", "virtual_address": "0x00080000", "virtual_size": "0x00000040", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "0.73" }, { "name": ".rsrc", "raw_address": "0x0007ba00", "virtual_address": "0x00081000", "virtual_size": "0x00a82000", "size_of_data": "0x00a81600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.76" }, { "name": ".reloc", "raw_address": "0x00afd000", "virtual_address": "0x00b03000", "virtual_size": "0x000066d4", "size_of_data": "0x00006800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.74" } ], "overlay": { "offset": "0x00b03800", "size": "0x0078c518" }, "resources": [ { "name": "IMAGE", "offset": "0x00084714", "size": "0x000007e5", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.33" }, { "name": "IMAGE", "offset": "0x00084efc", "size": "0x0000078b", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.29" }, { "name": "IMAGE", "offset": "0x00085688", "size": "0x000007bd", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.29" }, { "name": "RT_BITMAP", "offset": "0x00085e48", "size": "0x000211d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.84" }, { "name": "RT_BITMAP", "offset": "0x000a7020", "size": "0x000211d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.37" }, { "name": "RT_BITMAP", "offset": "0x000c81f8", "size": "0x000211d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.64" }, { "name": "RT_BITMAP", "offset": "0x000e93d0", "size": "0x000211d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.31" }, { "name": "RT_BITMAP", "offset": "0x0010a5a8", "size": "0x000211d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.60" }, { "name": "RT_BITMAP", "offset": "0x0012b780", "size": "0x000211d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.29" }, { "name": "RT_BITMAP", "offset": "0x0014c958", "size": "0x00097428", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.69" }, { "name": "RT_BITMAP", "offset": "0x001e3d80", "size": "0x00097428", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.20" }, { "name": "RT_BITMAP", "offset": "0x0027b1a8", "size": "0x000da8b4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.63" }, { "name": "RT_BITMAP", "offset": "0x00355a5c", "size": "0x000da8b4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.17" }, { "name": "RT_BITMAP", "offset": "0x00430310", "size": "0x00097428", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.77" }, { "name": "RT_BITMAP", "offset": "0x004c7738", "size": "0x00097428", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.17" }, { "name": "RT_BITMAP", "offset": "0x0055eb60", "size": "0x000da8b4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.65" }, { "name": "RT_BITMAP", "offset": "0x00639414", "size": "0x000da8b4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.15" }, { "name": "RT_BITMAP", "offset": "0x00713cc8", "size": "0x00097428", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.51" }, { "name": "RT_BITMAP", "offset": "0x007ab0f0", "size": "0x00097428", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.15" }, { "name": "RT_BITMAP", "offset": "0x00842518", "size": "0x000da8b4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.44" }, { "name": "RT_BITMAP", "offset": "0x0091cdcc", "size": "0x000da8b4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.13" }, { "name": "RT_ICON", "offset": "0x009f7680", "size": "0x00000668", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.80" }, { "name": "RT_ICON", "offset": "0x009f7ce8", "size": "0x000002e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.88" }, { "name": "RT_ICON", "offset": "0x009f7fd0", "size": "0x000001e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.61" }, { "name": "RT_ICON", "offset": "0x009f81b8", "size": "0x00000128", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.60" }, { "name": "RT_ICON", "offset": "0x009f82e0", "size": "0x00000ea8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.35" }, { "name": "RT_ICON", "offset": "0x009f9188", "size": "0x000008a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.11" }, { "name": "RT_ICON", "offset": "0x009f9a30", "size": "0x000006c8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.49" }, { "name": "RT_ICON", "offset": "0x009fa0f8", "size": "0x00000568", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.49" }, { "name": "RT_ICON", "offset": "0x009fa660", "size": "0x0000424f", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.91" }, { "name": "RT_ICON", "offset": "0x009fe8b0", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.43" }, { "name": "RT_ICON", "offset": "0x00a00e58", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.60" }, { "name": "RT_ICON", "offset": "0x00a01f00", "size": "0x000009e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.62" }, { "name": "RT_ICON", "offset": "0x00a028e8", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.98" }, { "name": "RT_ICON", "offset": "0x00a02d50", "size": "0x00000668", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.80" }, { "name": "RT_ICON", "offset": "0x00a033b8", "size": "0x000002e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.88" }, { "name": "RT_ICON", "offset": "0x00a036a0", "size": "0x000001e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.61" }, { "name": "RT_ICON", "offset": "0x00a03888", "size": "0x00000128", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.60" }, { "name": "RT_ICON", "offset": "0x00a039b0", "size": "0x00000ea8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.35" }, { "name": "RT_ICON", "offset": "0x00a04858", "size": "0x000008a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.11" }, { "name": "RT_ICON", "offset": "0x00a05100", "size": "0x000006c8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.49" }, { "name": "RT_ICON", "offset": "0x00a057c8", "size": "0x00000568", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.49" }, { "name": "RT_ICON", "offset": "0x00a05d30", "size": "0x0000424f", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.91" }, { "name": "RT_ICON", "offset": "0x00a09f80", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.43" }, { "name": "RT_ICON", "offset": "0x00a0c528", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.60" }, { "name": "RT_ICON", "offset": "0x00a0d5d0", "size": "0x000009e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.62" }, { "name": "RT_ICON", "offset": "0x00a0dfb8", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.98" }, { "name": "RT_DIALOG", "offset": "0x00a0e420", "size": "0x000000fc", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.60" }, { "name": "RT_DIALOG", "offset": "0x00a0e51c", "size": "0x000000f8", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.63" }, { "name": "RT_DIALOG", "offset": "0x00a0e614", "size": "0x000000d0", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.50" }, { "name": "RT_DIALOG", "offset": "0x00a0e6e4", "size": "0x00000138", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.22" }, { "name": "RT_DIALOG", "offset": "0x00a0e81c", "size": "0x000000fc", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a0e918", "size": "0x0000010c", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a0ea24", "size": "0x00000110", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.70" }, { "name": "RT_DIALOG", "offset": "0x00a0eb34", "size": "0x0000010a", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a0ec40", "size": "0x000000de", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.91" }, { "name": "RT_DIALOG", "offset": "0x00a0ed20", "size": "0x00000106", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a0ee28", "size": "0x000000d6", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.47" }, { "name": "RT_DIALOG", "offset": "0x00a0ef00", "size": "0x00000104", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a0f004", "size": "0x000000f0", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "2.97" }, { "name": "RT_DIALOG", "offset": "0x00a0f0f4", "size": "0x000000c8", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_DIALOG", "offset": "0x00a0f1bc", "size": "0x000000d0", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.84" }, { "name": "RT_DIALOG", "offset": "0x00a0f28c", "size": "0x00000120", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.01" }, { "name": "RT_DIALOG", "offset": "0x00a0f3ac", "size": "0x0000010a", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.04" }, { "name": "RT_DIALOG", "offset": "0x00a0f4b8", "size": "0x00000110", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.17" }, { "name": "RT_DIALOG", "offset": "0x00a0f5c8", "size": "0x000000f8", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "2.99" }, { "name": "RT_DIALOG", "offset": "0x00a0f6c0", "size": "0x000000f8", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a0f7b8", "size": "0x000000ec", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.55" }, { "name": "RT_DIALOG", "offset": "0x00a0f8a4", "size": "0x000000e6", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.98" }, { "name": "RT_DIALOG", "offset": "0x00a0f98c", "size": "0x000000fa", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a0fa88", "size": "0x000000ec", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a0fb74", "size": "0x000000fe", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.64" }, { "name": "RT_DIALOG", "offset": "0x00a0fc74", "size": "0x000000e0", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a0fd54", "size": "0x000000f4", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.60" }, { "name": "RT_DIALOG", "offset": "0x00a0fe48", "size": "0x000000ec", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.02" }, { "name": "RT_DIALOG", "offset": "0x00a0ff34", "size": "0x000000f2", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.01" }, { "name": "RT_DIALOG", "offset": "0x00a10028", "size": "0x00000110", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a10138", "size": "0x00000104", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a1023c", "size": "0x000000c4", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.39" }, { "name": "RT_DIALOG", "offset": "0x00a10300", "size": "0x0000010c", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_UK", "entropy": "3.02" }, { "name": "RT_DIALOG", "offset": "0x00a1040c", "size": "0x00000104", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.01" }, { "name": "RT_DIALOG", "offset": "0x00a10510", "size": "0x00000106", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.01" }, { "name": "RT_DIALOG", "offset": "0x00a10618", "size": "0x00000106", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a10720", "size": "0x00000106", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a10828", "size": "0x000000f0", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "2.97" }, { "name": "RT_DIALOG", "offset": "0x00a10918", "size": "0x000000dc", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.46" }, { "name": "RT_DIALOG", "offset": "0x00a109f4", "size": "0x000000f4", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_DIALOG", "offset": "0x00a10ae8", "size": "0x000000d6", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.55" }, { "name": "RT_DIALOG", "offset": "0x00a10bc0", "size": "0x000000ec", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.01" }, { "name": "RT_DIALOG", "offset": "0x00a10cac", "size": "0x000000f4", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.95" }, { "name": "RT_DIALOG", "offset": "0x00a10da0", "size": "0x000000da", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "2.91" }, { "name": "RT_DIALOG", "offset": "0x00a10e7c", "size": "0x00000100", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.59" }, { "name": "RT_DIALOG", "offset": "0x00a10f7c", "size": "0x000000f4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.99" }, { "name": "RT_DIALOG", "offset": "0x00a11070", "size": "0x000000f8", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.86" }, { "name": "RT_DIALOG", "offset": "0x00a11168", "size": "0x00000110", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.02" }, { "name": "RT_DIALOG", "offset": "0x00a11278", "size": "0x000000dc", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.48" }, { "name": "RT_DIALOG", "offset": "0x00a11354", "size": "0x000000e2", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.96" }, { "name": "RT_DIALOG", "offset": "0x00a11438", "size": "0x00000114", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "2.98" }, { "name": "RT_DIALOG", "offset": "0x00a1154c", "size": "0x000000dc", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.70" }, { "name": "RT_DIALOG", "offset": "0x00a11628", "size": "0x000000cc", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.55" }, { "name": "RT_DIALOG", "offset": "0x00a116f4", "size": "0x000000fe", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "2.94" }, { "name": "RT_DIALOG", "offset": "0x00a117f4", "size": "0x000000f4", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a118e8", "size": "0x0000010a", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.12" }, { "name": "RT_DIALOG", "offset": "0x00a119f4", "size": "0x00000108", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a11afc", "size": "0x000000f6", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a11bf4", "size": "0x000000f0", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.55" }, { "name": "RT_DIALOG", "offset": "0x00a11ce4", "size": "0x000000ea", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.92" }, { "name": "RT_DIALOG", "offset": "0x00a11dd0", "size": "0x00000102", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a11ed4", "size": "0x000000ea", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "2.95" }, { "name": "RT_DIALOG", "offset": "0x00a11fc0", "size": "0x00000118", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.63" }, { "name": "RT_DIALOG", "offset": "0x00a120d8", "size": "0x00000102", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.08" }, { "name": "RT_DIALOG", "offset": "0x00a121dc", "size": "0x000000fe", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.62" }, { "name": "RT_DIALOG", "offset": "0x00a122dc", "size": "0x000000fa", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.93" }, { "name": "RT_DIALOG", "offset": "0x00a123d8", "size": "0x00000108", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.91" }, { "name": "RT_DIALOG", "offset": "0x00a124e0", "size": "0x00000104", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a125e4", "size": "0x000000e2", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "2.94" }, { "name": "RT_DIALOG", "offset": "0x00a126c8", "size": "0x000000d2", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.70" }, { "name": "RT_DIALOG", "offset": "0x00a1279c", "size": "0x00000120", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.02" }, { "name": "RT_DIALOG", "offset": "0x00a128bc", "size": "0x00000114", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "2.98" }, { "name": "RT_DIALOG", "offset": "0x00a129d0", "size": "0x00000130", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.04" }, { "name": "RT_DIALOG", "offset": "0x00a12b00", "size": "0x00000110", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.02" }, { "name": "RT_DIALOG", "offset": "0x00a12c10", "size": "0x000000f2", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "2.95" }, { "name": "RT_DIALOG", "offset": "0x00a12d04", "size": "0x000000b8", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "2.96" }, { "name": "RT_DIALOG", "offset": "0x00a12dbc", "size": "0x000000d0", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.26" }, { "name": "RT_DIALOG", "offset": "0x00a12e8c", "size": "0x000000ce", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.20" }, { "name": "RT_DIALOG", "offset": "0x00a12f5c", "size": "0x000000d4", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.90" }, { "name": "RT_DIALOG", "offset": "0x00a13030", "size": "0x000000cc", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.79" }, { "name": "RT_DIALOG", "offset": "0x00a130fc", "size": "0x000000ca", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "2.80" }, { "name": "RT_DIALOG", "offset": "0x00a131c8", "size": "0x000000d0", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.28" }, { "name": "RT_DIALOG", "offset": "0x00a13298", "size": "0x000000bc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.72" }, { "name": "RT_DIALOG", "offset": "0x00a13354", "size": "0x000000cc", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.73" }, { "name": "RT_DIALOG", "offset": "0x00a13420", "size": "0x000000d8", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "2.85" }, { "name": "RT_DIALOG", "offset": "0x00a134f8", "size": "0x000000b8", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.01" }, { "name": "RT_DIALOG", "offset": "0x00a135b0", "size": "0x000000ce", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.83" }, { "name": "RT_DIALOG", "offset": "0x00a13680", "size": "0x000000dc", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "2.84" }, { "name": "RT_DIALOG", "offset": "0x00a1375c", "size": "0x000000c0", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.15" }, { "name": "RT_DIALOG", "offset": "0x00a1381c", "size": "0x000000ac", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "2.93" }, { "name": "RT_DIALOG", "offset": "0x00a138c8", "size": "0x000000c2", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "2.77" }, { "name": "RT_DIALOG", "offset": "0x00a1398c", "size": "0x000000cc", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "2.80" }, { "name": "RT_DIALOG", "offset": "0x00a13a58", "size": "0x000000d2", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.85" }, { "name": "RT_DIALOG", "offset": "0x00a13b2c", "size": "0x000000c8", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "2.76" }, { "name": "RT_DIALOG", "offset": "0x00a13bf4", "size": "0x000000ce", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "2.85" }, { "name": "RT_DIALOG", "offset": "0x00a13cc4", "size": "0x000000da", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.34" }, { "name": "RT_DIALOG", "offset": "0x00a13da0", "size": "0x000000c6", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.76" }, { "name": "RT_DIALOG", "offset": "0x00a13e68", "size": "0x000000ce", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.83" }, { "name": "RT_DIALOG", "offset": "0x00a13f38", "size": "0x000000ce", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "2.82" }, { "name": "RT_DIALOG", "offset": "0x00a14008", "size": "0x000000d8", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.18" }, { "name": "RT_DIALOG", "offset": "0x00a140e0", "size": "0x000000c6", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.80" }, { "name": "RT_DIALOG", "offset": "0x00a141a8", "size": "0x000000ce", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.23" }, { "name": "RT_DIALOG", "offset": "0x00a14278", "size": "0x000000ce", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.80" }, { "name": "RT_DIALOG", "offset": "0x00a14348", "size": "0x000000d4", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.80" }, { "name": "RT_DIALOG", "offset": "0x00a1441c", "size": "0x000000dc", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.95" }, { "name": "RT_DIALOG", "offset": "0x00a144f8", "size": "0x000000be", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "2.74" }, { "name": "RT_DIALOG", "offset": "0x00a145b8", "size": "0x000000c6", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.19" }, { "name": "RT_DIALOG", "offset": "0x00a14680", "size": "0x000000e8", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "2.88" }, { "name": "RT_DIALOG", "offset": "0x00a14768", "size": "0x000000d0", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "2.79" }, { "name": "RT_DIALOG", "offset": "0x00a14838", "size": "0x000000e8", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "2.88" }, { "name": "RT_DIALOG", "offset": "0x00a14920", "size": "0x000000d8", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "2.85" }, { "name": "RT_DIALOG", "offset": "0x00a149f8", "size": "0x000000c6", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "2.76" }, { "name": "RT_DIALOG", "offset": "0x00a14ac0", "size": "0x00000170", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.44" }, { "name": "RT_DIALOG", "offset": "0x00a14c30", "size": "0x0000018c", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_DIALOG", "offset": "0x00a14dbc", "size": "0x00000178", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.37" }, { "name": "RT_DIALOG", "offset": "0x00a14f34", "size": "0x00000182", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.13" }, { "name": "RT_DIALOG", "offset": "0x00a150b8", "size": "0x00000176", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.12" }, { "name": "RT_DIALOG", "offset": "0x00a15230", "size": "0x00000198", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.15" }, { "name": "RT_DIALOG", "offset": "0x00a153c8", "size": "0x00000194", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.71" }, { "name": "RT_DIALOG", "offset": "0x00a1555c", "size": "0x0000016a", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a156c8", "size": "0x00000174", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a1583c", "size": "0x0000017c", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a159b8", "size": "0x00000160", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.39" }, { "name": "RT_DIALOG", "offset": "0x00a15b18", "size": "0x00000190", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.19" }, { "name": "RT_DIALOG", "offset": "0x00a15ca8", "size": "0x00000174", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.05" }, { "name": "RT_DIALOG", "offset": "0x00a15e1c", "size": "0x0000016a", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.53" }, { "name": "RT_DIALOG", "offset": "0x00a15f88", "size": "0x00000168", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.46" }, { "name": "RT_DIALOG", "offset": "0x00a160f0", "size": "0x00000194", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.09" }, { "name": "RT_DIALOG", "offset": "0x00a16284", "size": "0x0000016e", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.11" }, { "name": "RT_DIALOG", "offset": "0x00a163f4", "size": "0x00000196", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.19" }, { "name": "RT_DIALOG", "offset": "0x00a1658c", "size": "0x0000017a", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a16708", "size": "0x00000184", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.14" }, { "name": "RT_DIALOG", "offset": "0x00a1688c", "size": "0x0000018e", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.63" }, { "name": "RT_DIALOG", "offset": "0x00a16a1c", "size": "0x00000186", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.07" }, { "name": "RT_DIALOG", "offset": "0x00a16ba4", "size": "0x0000018a", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.13" }, { "name": "RT_DIALOG", "offset": "0x00a16d30", "size": "0x00000192", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.20" }, { "name": "RT_DIALOG", "offset": "0x00a16ec4", "size": "0x000001a2", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.52" }, { "name": "RT_DIALOG", "offset": "0x00a17068", "size": "0x0000015c", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a171c4", "size": "0x00000190", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.59" }, { "name": "RT_DIALOG", "offset": "0x00a17354", "size": "0x00000192", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.12" }, { "name": "RT_DIALOG", "offset": "0x00a174e8", "size": "0x0000016c", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.99" }, { "name": "RT_DIALOG", "offset": "0x00a17654", "size": "0x0000018e", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.19" }, { "name": "RT_DIALOG", "offset": "0x00a177e4", "size": "0x00000192", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "3.12" }, { "name": "RT_DIALOG", "offset": "0x00a17978", "size": "0x00000170", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.35" }, { "name": "RT_DIALOG", "offset": "0x00a17ae8", "size": "0x0000016a", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_UK", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a17c54", "size": "0x0000019a", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.18" }, { "name": "RT_DIALOG", "offset": "0x00a17df0", "size": "0x00000182", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.04" }, { "name": "RT_DIALOG", "offset": "0x00a17f74", "size": "0x0000017a", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.11" }, { "name": "RT_DIALOG", "offset": "0x00a180f0", "size": "0x0000017c", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a1826c", "size": "0x0000017e", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "3.06" }, { "name": "RT_DIALOG", "offset": "0x00a183ec", "size": "0x00000078", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.17" }, { "name": "RT_DIALOG", "offset": "0x00a18464", "size": "0x00000074", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.00" }, { "name": "RT_DIALOG", "offset": "0x00a184d8", "size": "0x0000006c", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "2.98" }, { "name": "RT_DIALOG", "offset": "0x00a18544", "size": "0x00000078", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.90" }, { "name": "RT_DIALOG", "offset": "0x00a185bc", "size": "0x00000074", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.86" }, { "name": "RT_DIALOG", "offset": "0x00a18630", "size": "0x00000074", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "2.80" }, { "name": "RT_DIALOG", "offset": "0x00a186a4", "size": "0x00000078", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.16" }, { "name": "RT_DIALOG", "offset": "0x00a1871c", "size": "0x00000070", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.83" }, { "name": "RT_DIALOG", "offset": "0x00a1878c", "size": "0x00000070", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.85" }, { "name": "RT_DIALOG", "offset": "0x00a187fc", "size": "0x00000070", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "2.79" }, { "name": "RT_DIALOG", "offset": "0x00a1886c", "size": "0x00000070", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.08" }, { "name": "RT_DIALOG", "offset": "0x00a188dc", "size": "0x00000070", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.83" }, { "name": "RT_DIALOG", "offset": "0x00a1894c", "size": "0x00000074", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "2.76" }, { "name": "RT_DIALOG", "offset": "0x00a189c0", "size": "0x00000070", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.95" }, { "name": "RT_DIALOG", "offset": "0x00a18a30", "size": "0x00000070", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a18aa0", "size": "0x00000074", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "2.86" }, { "name": "RT_DIALOG", "offset": "0x00a18b14", "size": "0x00000074", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.73" }, { "name": "RT_DIALOG", "offset": "0x00a18b88", "size": "0x00000074", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "2.78" }, { "name": "RT_DIALOG", "offset": "0x00a18bfc", "size": "0x00000074", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "2.86" }, { "name": "RT_DIALOG", "offset": "0x00a18c70", "size": "0x00000078", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.03" }, { "name": "RT_DIALOG", "offset": "0x00a18ce8", "size": "0x00000074", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.78" }, { "name": "RT_DIALOG", "offset": "0x00a18d5c", "size": "0x00000078", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.86" }, { "name": "RT_DIALOG", "offset": "0x00a18dd4", "size": "0x00000074", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "2.82" }, { "name": "RT_DIALOG", "offset": "0x00a18e48", "size": "0x00000078", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.18" }, { "name": "RT_DIALOG", "offset": "0x00a18ec0", "size": "0x00000074", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.86" }, { "name": "RT_DIALOG", "offset": "0x00a18f34", "size": "0x00000078", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.09" }, { "name": "RT_DIALOG", "offset": "0x00a18fac", "size": "0x00000074", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.78" }, { "name": "RT_DIALOG", "offset": "0x00a19020", "size": "0x00000078", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.84" }, { "name": "RT_DIALOG", "offset": "0x00a19098", "size": "0x0000007c", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.90" }, { "name": "RT_DIALOG", "offset": "0x00a19114", "size": "0x00000078", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "2.85" }, { "name": "RT_DIALOG", "offset": "0x00a1918c", "size": "0x0000006c", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "2.96" }, { "name": "RT_DIALOG", "offset": "0x00a191f8", "size": "0x00000074", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "2.78" }, { "name": "RT_DIALOG", "offset": "0x00a1926c", "size": "0x00000074", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "2.78" }, { "name": "RT_DIALOG", "offset": "0x00a192e0", "size": "0x00000074", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "2.78" }, { "name": "RT_DIALOG", "offset": "0x00a19354", "size": "0x00000070", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "2.79" }, { "name": "RT_DIALOG", "offset": "0x00a193c4", "size": "0x00000074", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "2.78" }, { "name": "RT_STRING", "offset": "0x00a19438", "size": "0x000004c2", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.95" }, { "name": "RT_STRING", "offset": "0x00a198fc", "size": "0x000005fe", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.80" }, { "name": "RT_STRING", "offset": "0x00a19efc", "size": "0x00000252", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "5.62" }, { "name": "RT_STRING", "offset": "0x00a1a150", "size": "0x000005e6", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.55" }, { "name": "RT_STRING", "offset": "0x00a1a738", "size": "0x00000562", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.28" }, { "name": "RT_STRING", "offset": "0x00a1ac9c", "size": "0x00000614", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00a1b2b0", "size": "0x0000066a", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.94" }, { "name": "RT_STRING", "offset": "0x00a1b91c", "size": "0x000004ae", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x00a1bdcc", "size": "0x00000532", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.23" }, { "name": "RT_STRING", "offset": "0x00a1c300", "size": "0x000006ea", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00a1c9ec", "size": "0x000004bc", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.95" }, { "name": "RT_STRING", "offset": "0x00a1cea8", "size": "0x000005a0", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.51" }, { "name": "RT_STRING", "offset": "0x00a1d448", "size": "0x0000065e", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x00a1daa8", "size": "0x00000368", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.86" }, { "name": "RT_STRING", "offset": "0x00a1de10", "size": "0x00000316", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "5.20" }, { "name": "RT_STRING", "offset": "0x00a1e128", "size": "0x00000538", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.26" }, { "name": "RT_STRING", "offset": "0x00a1e660", "size": "0x000005da", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.30" }, { "name": "RT_STRING", "offset": "0x00a1ec3c", "size": "0x0000065a", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.48" }, { "name": "RT_STRING", "offset": "0x00a1f298", "size": "0x0000057c", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x00a1f814", "size": "0x00000532", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.39" }, { "name": "RT_STRING", "offset": "0x00a1fd48", "size": "0x00000642", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.85" }, { "name": "RT_STRING", "offset": "0x00a2038c", "size": "0x0000064a", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x00a209d8", "size": "0x000005c0", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.50" }, { "name": "RT_STRING", "offset": "0x00a20f98", "size": "0x000005b0", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.26" }, { "name": "RT_STRING", "offset": "0x00a21548", "size": "0x00000522", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.10" }, { "name": "RT_STRING", "offset": "0x00a21a6c", "size": "0x00000508", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_STRING", "offset": "0x00a21f74", "size": "0x0000061e", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.92" }, { "name": "RT_STRING", "offset": "0x00a22594", "size": "0x00000608", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.30" }, { "name": "RT_STRING", "offset": "0x00a22b9c", "size": "0x00000568", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.28" }, { "name": "RT_STRING", "offset": "0x00a23104", "size": "0x000005f4", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.47" }, { "name": "RT_STRING", "offset": "0x00a236f8", "size": "0x0000051e", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "3.51" }, { "name": "RT_STRING", "offset": "0x00a23c18", "size": "0x0000023a", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "5.52" }, { "name": "RT_STRING", "offset": "0x00a23e54", "size": "0x00000668", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.20" }, { "name": "RT_STRING", "offset": "0x00a244bc", "size": "0x00000620", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x00a24adc", "size": "0x0000067e", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.20" }, { "name": "RT_STRING", "offset": "0x00a2515c", "size": "0x00000734", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00a25890", "size": "0x00000654", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x00a25ee4", "size": "0x000003fc", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.94" }, { "name": "RT_STRING", "offset": "0x00a262e0", "size": "0x000005e0", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.76" }, { "name": "RT_STRING", "offset": "0x00a268c0", "size": "0x000001d6", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "5.86" }, { "name": "RT_STRING", "offset": "0x00a26a98", "size": "0x00000594", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.60" }, { "name": "RT_STRING", "offset": "0x00a2702c", "size": "0x00000584", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x00a275b0", "size": "0x00000626", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.36" }, { "name": "RT_STRING", "offset": "0x00a27bd8", "size": "0x0000068a", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.85" }, { "name": "RT_STRING", "offset": "0x00a28264", "size": "0x000004c4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00a28728", "size": "0x000004ce", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.27" }, { "name": "RT_STRING", "offset": "0x00a28bf8", "size": "0x0000068a", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00a29284", "size": "0x0000043c", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.84" }, { "name": "RT_STRING", "offset": "0x00a296c0", "size": "0x00000544", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.53" }, { "name": "RT_STRING", "offset": "0x00a29c04", "size": "0x000005f4", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x00a2a1f8", "size": "0x000002f4", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "5.04" }, { "name": "RT_STRING", "offset": "0x00a2a4ec", "size": "0x00000290", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "5.47" }, { "name": "RT_STRING", "offset": "0x00a2a77c", "size": "0x000005d2", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x00a2ad50", "size": "0x00000560", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x00a2b2b0", "size": "0x000005c4", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.58" }, { "name": "RT_STRING", "offset": "0x00a2b874", "size": "0x00000584", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.27" }, { "name": "RT_STRING", "offset": "0x00a2bdf8", "size": "0x000005a6", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.42" }, { "name": "RT_STRING", "offset": "0x00a2c3a0", "size": "0x00000596", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.82" }, { "name": "RT_STRING", "offset": "0x00a2c938", "size": "0x000005ae", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.37" }, { "name": "RT_STRING", "offset": "0x00a2cee8", "size": "0x00000572", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.54" }, { "name": "RT_STRING", "offset": "0x00a2d45c", "size": "0x000004ca", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x00a2d928", "size": "0x000004de", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.01" }, { "name": "RT_STRING", "offset": "0x00a2de08", "size": "0x0000052a", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.61" }, { "name": "RT_STRING", "offset": "0x00a2e334", "size": "0x0000054c", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.91" }, { "name": "RT_STRING", "offset": "0x00a2e880", "size": "0x000005de", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.36" }, { "name": "RT_STRING", "offset": "0x00a2ee60", "size": "0x000004ce", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x00a2f330", "size": "0x0000059a", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.52" }, { "name": "RT_STRING", "offset": "0x00a2f8cc", "size": "0x000004de", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "3.48" }, { "name": "RT_STRING", "offset": "0x00a2fdac", "size": "0x000001d4", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "5.83" }, { "name": "RT_STRING", "offset": "0x00a2ff80", "size": "0x000004da", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_UK", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x00a3045c", "size": "0x00000636", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x00a30a94", "size": "0x000005de", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.27" }, { "name": "RT_STRING", "offset": "0x00a31074", "size": "0x0000064c", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x00a316c0", "size": "0x0000068a", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00a31d4c", "size": "0x0000055c", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00a322a8", "size": "0x0000379c", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.53" }, { "name": "RT_STRING", "offset": "0x00a35a44", "size": "0x00004068", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.61" }, { "name": "RT_STRING", "offset": "0x00a39aac", "size": "0x00002848", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.75" }, { "name": "RT_STRING", "offset": "0x00a3c2f4", "size": "0x0000317c", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.47" }, { "name": "RT_STRING", "offset": "0x00a3f470", "size": "0x00003eb4", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.93" }, { "name": "RT_STRING", "offset": "0x00a43324", "size": "0x000041b6", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.01" }, { "name": "RT_STRING", "offset": "0x00a474dc", "size": "0x0000459e", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.73" }, { "name": "RT_STRING", "offset": "0x00a4ba7c", "size": "0x00003a2e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.87" }, { "name": "RT_STRING", "offset": "0x00a4f4ac", "size": "0x00003fca", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.94" }, { "name": "RT_STRING", "offset": "0x00a53478", "size": "0x00004346", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "2.96" }, { "name": "RT_STRING", "offset": "0x00a577c0", "size": "0x00003508", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.46" }, { "name": "RT_STRING", "offset": "0x00a5acc8", "size": "0x00003d1e", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.03" }, { "name": "RT_STRING", "offset": "0x00a5e9e8", "size": "0x000043e6", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "2.91" }, { "name": "RT_STRING", "offset": "0x00a62dd0", "size": "0x00002d4c", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.83" }, { "name": "RT_STRING", "offset": "0x00a65b1c", "size": "0x00002cd0", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.75" }, { "name": "RT_STRING", "offset": "0x00a687ec", "size": "0x00003ebc", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "2.94" }, { "name": "RT_STRING", "offset": "0x00a6c6a8", "size": "0x00003dd4", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "2.92" }, { "name": "RT_STRING", "offset": "0x00a7047c", "size": "0x00003e68", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.09" }, { "name": "RT_STRING", "offset": "0x00a742e4", "size": "0x00003e50", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "2.96" }, { "name": "RT_STRING", "offset": "0x00a78134", "size": "0x00003dfc", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "2.98" }, { "name": "RT_STRING", "offset": "0x00a7bf30", "size": "0x00004212", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.66" }, { "name": "RT_STRING", "offset": "0x00a80144", "size": "0x00003e8c", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.96" }, { "name": "RT_STRING", "offset": "0x00a83fd0", "size": "0x00003f70", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.07" }, { "name": "RT_STRING", "offset": "0x00a87f40", "size": "0x00003c2a", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "2.94" }, { "name": "RT_STRING", "offset": "0x00a8bb6c", "size": "0x00003ad6", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.83" }, { "name": "RT_STRING", "offset": "0x00a8f644", "size": "0x00003c70", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.06" }, { "name": "RT_STRING", "offset": "0x00a932b4", "size": "0x00004080", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.68" }, { "name": "RT_STRING", "offset": "0x00a97334", "size": "0x00003eb4", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.96" }, { "name": "RT_STRING", "offset": "0x00a9b1e8", "size": "0x00003bee", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.94" }, { "name": "RT_STRING", "offset": "0x00a9edd8", "size": "0x00003dae", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.08" }, { "name": "RT_STRING", "offset": "0x00aa2b88", "size": "0x00003aba", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "2.97" }, { "name": "RT_STRING", "offset": "0x00aa6644", "size": "0x000027b0", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.66" }, { "name": "RT_STRING", "offset": "0x00aa8df4", "size": "0x000039ec", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_UK", "entropy": "2.88" }, { "name": "RT_STRING", "offset": "0x00aac7e0", "size": "0x000041d4", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "2.91" }, { "name": "RT_STRING", "offset": "0x00ab09b4", "size": "0x000040c2", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "2.93" }, { "name": "RT_STRING", "offset": "0x00ab4a78", "size": "0x000035be", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.14" }, { "name": "RT_STRING", "offset": "0x00ab8038", "size": "0x0000430c", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "2.96" }, { "name": "RT_STRING", "offset": "0x00abc344", "size": "0x00003ecc", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "2.98" }, { "name": "RT_STRING", "offset": "0x00ac0210", "size": "0x00000fcc", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.87" }, { "name": "RT_STRING", "offset": "0x00ac11dc", "size": "0x0000139a", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.77" }, { "name": "RT_STRING", "offset": "0x00ac2578", "size": "0x000007e8", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "5.34" }, { "name": "RT_STRING", "offset": "0x00ac2d60", "size": "0x00001004", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.57" }, { "name": "RT_STRING", "offset": "0x00ac3d64", "size": "0x0000116a", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.18" }, { "name": "RT_STRING", "offset": "0x00ac4ed0", "size": "0x0000136e", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.23" }, { "name": "RT_STRING", "offset": "0x00ac6240", "size": "0x000014d8", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.89" }, { "name": "RT_STRING", "offset": "0x00ac7718", "size": "0x00001026", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.15" }, { "name": "RT_STRING", "offset": "0x00ac8740", "size": "0x00001170", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.16" }, { "name": "RT_STRING", "offset": "0x00ac98b0", "size": "0x0000141e", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.22" }, { "name": "RT_STRING", "offset": "0x00acacd0", "size": "0x00000de0", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.85" }, { "name": "RT_STRING", "offset": "0x00acbab0", "size": "0x0000117a", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x00accc2c", "size": "0x000012fe", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.12" }, { "name": "RT_STRING", "offset": "0x00acdf2c", "size": "0x00000abe", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.85" }, { "name": "RT_STRING", "offset": "0x00ace9ec", "size": "0x00000a48", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "4.92" }, { "name": "RT_STRING", "offset": "0x00acf434", "size": "0x00001264", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.16" }, { "name": "RT_STRING", "offset": "0x00ad0698", "size": "0x00001190", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.20" }, { "name": "RT_STRING", "offset": "0x00ad1828", "size": "0x00001298", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.39" }, { "name": "RT_STRING", "offset": "0x00ad2ac0", "size": "0x000012e2", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.16" }, { "name": "RT_STRING", "offset": "0x00ad3da4", "size": "0x00001292", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x00ad5038", "size": "0x000012f0", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.86" }, { "name": "RT_STRING", "offset": "0x00ad6328", "size": "0x0000119a", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.24" }, { "name": "RT_STRING", "offset": "0x00ad74c4", "size": "0x0000116a", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.42" }, { "name": "RT_STRING", "offset": "0x00ad8630", "size": "0x0000116c", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.15" }, { "name": "RT_STRING", "offset": "0x00ad979c", "size": "0x00000fcc", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.13" }, { "name": "RT_STRING", "offset": "0x00ada768", "size": "0x000010a2", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.42" }, { "name": "RT_STRING", "offset": "0x00adb80c", "size": "0x0000123e", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.92" }, { "name": "RT_STRING", "offset": "0x00adca4c", "size": "0x00001158", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x00addba4", "size": "0x0000114c", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.18" }, { "name": "RT_STRING", "offset": "0x00adecf0", "size": "0x00001092", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.37" }, { "name": "RT_STRING", "offset": "0x00adfd84", "size": "0x00001014", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "3.36" }, { "name": "RT_STRING", "offset": "0x00ae0d98", "size": "0x000007be", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "5.30" }, { "name": "RT_STRING", "offset": "0x00ae1558", "size": "0x00001044", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_UK", "entropy": "3.15" }, { "name": "RT_STRING", "offset": "0x00ae259c", "size": "0x000013f6", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.13" }, { "name": "RT_STRING", "offset": "0x00ae3994", "size": "0x0000130c", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.16" }, { "name": "RT_STRING", "offset": "0x00ae4ca0", "size": "0x0000132a", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.14" }, { "name": "RT_STRING", "offset": "0x00ae5fcc", "size": "0x000013b2", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.23" }, { "name": "RT_STRING", "offset": "0x00ae7380", "size": "0x0000124e", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "3.24" }, { "name": "RT_STRING", "offset": "0x00ae85d0", "size": "0x0000002c", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "1.52" }, { "name": "RT_STRING", "offset": "0x00ae85fc", "size": "0x00000042", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.47" }, { "name": "RT_STRING", "offset": "0x00ae8640", "size": "0x00000024", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "0.90" }, { "name": "RT_STRING", "offset": "0x00ae8664", "size": "0x0000002c", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.33" }, { "name": "RT_STRING", "offset": "0x00ae8690", "size": "0x0000002c", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "0.99" }, { "name": "RT_STRING", "offset": "0x00ae86bc", "size": "0x0000002c", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "1.03" }, { "name": "RT_STRING", "offset": "0x00ae86e8", "size": "0x0000002e", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.71" }, { "name": "RT_STRING", "offset": "0x00ae8718", "size": "0x00000030", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.21" }, { "name": "RT_STRING", "offset": "0x00ae8748", "size": "0x0000002e", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.14" }, { "name": "RT_STRING", "offset": "0x00ae8778", "size": "0x00000036", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "1.45" }, { "name": "RT_STRING", "offset": "0x00ae87b0", "size": "0x0000002e", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.71" }, { "name": "RT_STRING", "offset": "0x00ae87e0", "size": "0x0000002e", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.14" }, { "name": "RT_STRING", "offset": "0x00ae8810", "size": "0x0000002a", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "0.91" }, { "name": "RT_STRING", "offset": "0x00ae883c", "size": "0x00000028", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.48" }, { "name": "RT_STRING", "offset": "0x00ae8864", "size": "0x00000026", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "1.21" }, { "name": "RT_STRING", "offset": "0x00ae888c", "size": "0x00000032", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "1.31" }, { "name": "RT_STRING", "offset": "0x00ae88c0", "size": "0x00000032", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "1.31" }, { "name": "RT_STRING", "offset": "0x00ae88f4", "size": "0x0000002c", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.18" }, { "name": "RT_STRING", "offset": "0x00ae8920", "size": "0x00000032", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "1.31" }, { "name": "RT_STRING", "offset": "0x00ae8954", "size": "0x0000002e", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "1.14" }, { "name": "RT_STRING", "offset": "0x00ae8984", "size": "0x0000003c", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "2.37" }, { "name": "RT_STRING", "offset": "0x00ae89c0", "size": "0x0000002a", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "0.96" }, { "name": "RT_STRING", "offset": "0x00ae89ec", "size": "0x0000002e", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.14" }, { "name": "RT_STRING", "offset": "0x00ae8a1c", "size": "0x0000002e", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "1.14" }, { "name": "RT_STRING", "offset": "0x00ae8a4c", "size": "0x00000036", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.13" }, { "name": "RT_STRING", "offset": "0x00ae8a84", "size": "0x0000003e", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.61" }, { "name": "RT_STRING", "offset": "0x00ae8ac4", "size": "0x00000042", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.55" }, { "name": "RT_STRING", "offset": "0x00ae8b08", "size": "0x0000002a", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "0.96" }, { "name": "RT_STRING", "offset": "0x00ae8b34", "size": "0x00000032", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.19" }, { "name": "RT_STRING", "offset": "0x00ae8b68", "size": "0x00000034", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "1.53" }, { "name": "RT_STRING", "offset": "0x00ae8b9c", "size": "0x00000028", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "0.83" }, { "name": "RT_STRING", "offset": "0x00ae8bc4", "size": "0x00000024", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "0.90" }, { "name": "RT_STRING", "offset": "0x00ae8be8", "size": "0x00000030", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "1.21" }, { "name": "RT_STRING", "offset": "0x00ae8c18", "size": "0x00000032", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "1.27" }, { "name": "RT_STRING", "offset": "0x00ae8c4c", "size": "0x00000030", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "1.21" }, { "name": "RT_STRING", "offset": "0x00ae8c7c", "size": "0x00000036", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "1.45" }, { "name": "RT_STRING", "offset": "0x00ae8cb4", "size": "0x00000026", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "0.70" }, { "name": "RT_STRING", "offset": "0x00ae8cdc", "size": "0x0000005c", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "2.94" }, { "name": "RT_STRING", "offset": "0x00ae8d38", "size": "0x0000004e", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.67" }, { "name": "RT_STRING", "offset": "0x00ae8d88", "size": "0x00000044", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "2.34" }, { "name": "RT_STRING", "offset": "0x00ae8dcc", "size": "0x0000005e", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.56" }, { "name": "RT_STRING", "offset": "0x00ae8e2c", "size": "0x00000048", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.14" }, { "name": "RT_STRING", "offset": "0x00ae8e74", "size": "0x0000007e", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "2.57" }, { "name": "RT_STRING", "offset": "0x00ae8ef4", "size": "0x00000056", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.95" }, { "name": "RT_STRING", "offset": "0x00ae8f4c", "size": "0x00000056", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.29" }, { "name": "RT_STRING", "offset": "0x00ae8fa4", "size": "0x0000005c", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.36" }, { "name": "RT_STRING", "offset": "0x00ae9000", "size": "0x0000004e", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "2.19" }, { "name": "RT_STRING", "offset": "0x00ae9050", "size": "0x00000052", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.76" }, { "name": "RT_STRING", "offset": "0x00ae90a4", "size": "0x0000007a", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.69" }, { "name": "RT_STRING", "offset": "0x00ae9120", "size": "0x0000004a", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "2.11" }, { "name": "RT_STRING", "offset": "0x00ae916c", "size": "0x0000004e", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.14" }, { "name": "RT_STRING", "offset": "0x00ae91bc", "size": "0x00000050", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.00" }, { "name": "RT_STRING", "offset": "0x00ae920c", "size": "0x0000004c", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "2.18" }, { "name": "RT_STRING", "offset": "0x00ae9258", "size": "0x0000004a", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "2.15" }, { "name": "RT_STRING", "offset": "0x00ae92a4", "size": "0x0000004c", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.30" }, { "name": "RT_STRING", "offset": "0x00ae92f0", "size": "0x00000052", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "2.16" }, { "name": "RT_STRING", "offset": "0x00ae9344", "size": "0x0000004e", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "2.28" }, { "name": "RT_STRING", "offset": "0x00ae9394", "size": "0x0000004e", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "2.71" }, { "name": "RT_STRING", "offset": "0x00ae93e4", "size": "0x00000050", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.21" }, { "name": "RT_STRING", "offset": "0x00ae9434", "size": "0x00000054", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.31" }, { "name": "RT_STRING", "offset": "0x00ae9488", "size": "0x00000048", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "2.11" }, { "name": "RT_STRING", "offset": "0x00ae94d0", "size": "0x00000050", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.80" }, { "name": "RT_STRING", "offset": "0x00ae9520", "size": "0x00000078", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.67" }, { "name": "RT_STRING", "offset": "0x00ae9598", "size": "0x00000052", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.84" }, { "name": "RT_STRING", "offset": "0x00ae95ec", "size": "0x0000004e", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.37" }, { "name": "RT_STRING", "offset": "0x00ae963c", "size": "0x00000050", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.29" }, { "name": "RT_STRING", "offset": "0x00ae968c", "size": "0x00000062", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "2.68" }, { "name": "RT_STRING", "offset": "0x00ae96f0", "size": "0x00000058", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "2.34" }, { "name": "RT_STRING", "offset": "0x00ae9748", "size": "0x00000044", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "2.36" }, { "name": "RT_STRING", "offset": "0x00ae978c", "size": "0x0000004a", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "2.11" }, { "name": "RT_STRING", "offset": "0x00ae97d8", "size": "0x0000004a", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "2.08" }, { "name": "RT_STRING", "offset": "0x00ae9824", "size": "0x0000004e", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "2.27" }, { "name": "RT_STRING", "offset": "0x00ae9874", "size": "0x0000004e", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "2.19" }, { "name": "RT_STRING", "offset": "0x00ae98c4", "size": "0x0000004e", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "2.16" }, { "name": "RT_STRING", "offset": "0x00ae9914", "size": "0x00000092", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.50" }, { "name": "RT_STRING", "offset": "0x00ae99a8", "size": "0x0000007e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.06" }, { "name": "RT_STRING", "offset": "0x00ae9a28", "size": "0x0000008e", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.07" }, { "name": "RT_STRING", "offset": "0x00ae9ab8", "size": "0x00000076", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.22" }, { "name": "RT_STRING", "offset": "0x00ae9b30", "size": "0x00000092", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.08" }, { "name": "RT_STRING", "offset": "0x00ae9bc4", "size": "0x0000007e", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.28" }, { "name": "RT_STRING", "offset": "0x00ae9c44", "size": "0x00000110", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.52" }, { "name": "RT_STRING", "offset": "0x00ae9d54", "size": "0x000000cc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.16" }, { "name": "RT_STRING", "offset": "0x00ae9e20", "size": "0x000000c0", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.28" }, { "name": "RT_STRING", "offset": "0x00ae9ee0", "size": "0x000000e4", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.41" }, { "name": "RT_STRING", "offset": "0x00ae9fc4", "size": "0x000000d8", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.18" }, { "name": "RT_STRING", "offset": "0x00aea09c", "size": "0x000000f4", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.41" }, { "name": "RT_RCDATA", "offset": "0x00aea190", "size": "0x0000ded0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.13" }, { "name": "RT_GROUP_ICON", "offset": "0x00af8060", "size": "0x000000bc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.08" }, { "name": "RT_GROUP_ICON", "offset": "0x00af811c", "size": "0x000000bc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.13" }, { "name": "RT_VERSION", "offset": "0x00af81d8", "size": "0x000003ac", "filetype": null, "language": "LANG_ARABIC", "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA", "entropy": "3.60" }, { "name": "RT_VERSION", "offset": "0x00af8584", "size": "0x000003d4", "filetype": null, "language": "LANG_BULGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.87" }, { "name": "RT_VERSION", "offset": "0x00af8958", "size": "0x000003a4", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.60" }, { "name": "RT_VERSION", "offset": "0x00af8cfc", "size": "0x000003b4", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.57" }, { "name": "RT_VERSION", "offset": "0x00af90b0", "size": "0x000003c4", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x00af9474", "size": "0x000003ac", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.54" }, { "name": "RT_VERSION", "offset": "0x00af9820", "size": "0x000003e4", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.04" }, { "name": "RT_VERSION", "offset": "0x00af9c04", "size": "0x000003b0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x00af9fb4", "size": "0x000003c4", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_VERSION", "offset": "0x00afa378", "size": "0x000003cc", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00afa744", "size": "0x000003c4", "filetype": null, "language": "LANG_HEBREW", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.72" }, { "name": "RT_VERSION", "offset": "0x00afab08", "size": "0x000003b4", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00afaebc", "size": "0x000003c8", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x00afb284", "size": "0x000003a8", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.60" }, { "name": "RT_VERSION", "offset": "0x00afb62c", "size": "0x000003ac", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "3.63" }, { "name": "RT_VERSION", "offset": "0x00afb9d8", "size": "0x000003b4", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00afbd8c", "size": "0x000003bc", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x00afc148", "size": "0x000003d0", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00afc518", "size": "0x000003d0", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x00afc8e8", "size": "0x000003c0", "filetype": null, "language": "LANG_ROMANIAN", "sublanguage": "SUBLANG_ROMANIAN", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x00afcca8", "size": "0x000003cc", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.96" }, { "name": "RT_VERSION", "offset": "0x00afd074", "size": "0x000003dc", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_VERSION", "offset": "0x00afd450", "size": "0x000003c8", "filetype": null, "language": "LANG_SLOVAK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.57" }, { "name": "RT_VERSION", "offset": "0x00afd818", "size": "0x000003c0", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x00afdbd8", "size": "0x00000398", "filetype": null, "language": "LANG_THAI", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.80" }, { "name": "RT_VERSION", "offset": "0x00afdf70", "size": "0x000003ac", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.58" }, { "name": "RT_VERSION", "offset": "0x00afe31c", "size": "0x000003c8", "filetype": null, "language": "LANG_UKRAINIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.94" }, { "name": "RT_VERSION", "offset": "0x00afe6e4", "size": "0x000003d4", "filetype": null, "language": "LANG_SLOVENIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x00afeab8", "size": "0x000003c4", "filetype": null, "language": "LANG_ESTONIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00afee7c", "size": "0x000003bc", "filetype": null, "language": "LANG_LATVIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.60" }, { "name": "RT_VERSION", "offset": "0x00aff238", "size": "0x000003bc", "filetype": null, "language": "LANG_LITHUANIAN", "sublanguage": "SUBLANG_LITHUANIAN", "entropy": "3.60" }, { "name": "RT_VERSION", "offset": "0x00aff5f4", "size": "0x000003a4", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.61" }, { "name": "RT_VERSION", "offset": "0x00aff998", "size": "0x000003e4", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MEXICAN", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x00affd7c", "size": "0x000003d0", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x00b0014c", "size": "0x000003e4", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x00b00530", "size": "0x000003e4", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH_CANADIAN", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00b00914", "size": "0x000003c4", "filetype": null, "language": "LANG_SERBIAN", "sublanguage": "SUBLANG_ARABIC_YEMEN", "entropy": "3.55" }, { "name": "RT_MANIFEST", "offset": "0x00b00cd8", "size": "0x00001831", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.65" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "‎‎إعداد Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0401 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Инсталираща програма на Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Всички права запазени." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Операционна система Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0402 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 安裝程式" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0404 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Instalace Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Všechna práva vyhrazena." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operační systém Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0405 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 Installation" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Alle rettigheder forbeholdes." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operativsystem" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0406 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 Setup" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Alle Rechte vorbehalten." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Betriebssystem Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0407 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Εγκατάσταση των Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Με επιφύλαξη κάθε νόμιμου δικαιώματος." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Λειτουργικό σύστημα Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0408 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 Setup" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10:n asennus" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Kaikki oikeudet pidätetään." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® -käyttöjärjestelmä" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040b 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Installation de Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tous droits réservés." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Système d’exploitation Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040c 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "‏‏‎‎תוכנית ההתקנה של Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040d 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 telepítő" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Minden jog fenntartva." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® operációs rendszer" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040e 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Installazione di Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tutti i diritti riservati." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Sistema operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0410 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 セットアップ" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0411 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 설치 프로그램" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0412 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 Setup" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Alle rechten voorbehouden." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows®-besturingssysteem" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0413 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Installasjonsprogram for Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Med enerett." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operativsystemet Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0414 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Instalator systemu Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Wszelkie prawa zastrzeżone." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "System operacyjny Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0415 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Instalação do Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos os direitos reservados." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Sistema Operacional Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0416 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Instalare Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Toate drepturile rezervate." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Sistem de operare Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0418 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Программа установки Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Корпорация Майкрософт. Все права защищены." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Операционная система Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0419 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Program za instalaciju sustava Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Sva prava pridržana." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operacijski sustav Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041a 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Inštalátor systému Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Všetky práva vyhradené." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041b 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Installationsprogram för Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Med ensamrätt." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operativsystemet Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041d 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "ตั้งค่า Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation สงวนลิขสิทธิ์" }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "ระบบปฏิบัติการ Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041e 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 Kurulumu" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tüm hakları saklıdır." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® İşletim Sistemi" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041f 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Програма інсталяції Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Корпорація Майкрософт. Усі права захищені." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Операційна система Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0422 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Namestitveni program za Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Vse pravice pridržane." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operacijski sistem Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0424 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 installiprogramm" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Kõik õigused kaitstud." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operatsioonisüsteem Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0425 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 uzstādīšana" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Visas tiesības paturētas." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operētājsistēma Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0426 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "„Windows 10“ sąranka" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© „Microsoft Corporation“. Visos teisės ginamos." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operacinė sistema „Microsoft® Windows®“" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0427 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 10 安装程序" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0804 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Programa de instalación de Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos los derechos reservados." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Sistema operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x080a 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Configuração do Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos os direitos reservados." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Sistema Operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0816 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Programa de instalación de Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos los derechos reservados." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Sistema operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0c0a 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Programme d'installation de Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tous droits réservés." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Système d’exploitation Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0c0c 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Instalacija izdanja Windows 10" }, { "name": "FileVersion", "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)" }, { "name": "InternalName", "value": "SetupPrep.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Sva prava zadržana." }, { "name": "OriginalFilename", "value": "SetupPrep.exe" }, { "name": "ProductName", "value": "Operativni sistem Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x241a 0x04b0" } ], "imphash": "d715fe1c9f60fa2c4d89588b638bb8e6", "timestamp": "1974-05-29 19:08:33", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAHWUlEQVR4nO2YWWwdVxnHf+fMzF1tX+9xYqfOWieOs7goTVpKKTRKA6qgEAgg9QGE1IJ4QEjwgEBVQJHgDd7KS5/Y1JKoKUFUKk1YwhZKA01j4pSgJk0c3zhNvNxt7sxZeLj32jderh3HYZH8l0ajq/HM+f3Pd77vfMewrGXdkcR/cjClVGU8UXXZqgvXde3tfFMuJeBcUkoJpZQEHCACRMtX5KkffTG19Vv9KxbLctcjUAaXgAt4vzr3avzrL35z85XRK525Yr6jsalttVvvxZ0xdfDCocFrtxsB965QM7lcRHkM79iZX6S+cfSZnZfGh3Z3PrTlPTv6PrK2Y013R/qdi5dO/eDosace+GyGqSW1YN2VCJThK7Me3f3dh3a+MXT2ka599z+y64Pv22liNtrlrlSv/vAnR66cPv+znhU9fz35tV8PAfp2I7DkBqbBx3sPbvvARCzc1/e5xz6ZaK1rinoea1gd/PK5517I/evG4QuHBk8ARUAB9n9hCVWWTWzLwe17/DY+9uDnP3MgiBdcZRT9Yqt+4dnv/1ikiy9dODT4WyAE9GLgYYmrUHn2HSCy7dv3vd9fIZ547xeePODH867RPuvcbv5w6pXfi3Tx5TPPnP4d4JcNmMXAwxIaqFo63p7v7ds2osce3fX0J/ZPREZdUKz0ulFhfmjg8Imf/vxLL55cCnhY2ggIwAMSg+nzO/q//NH9oadixoRoAe10cPzZ51/etfb+gTUt3VmWAL4y6Jx6/cyZMaVNSmk9y9PSuLY8vBAgpeTc9UFOqFOEH+7gph3GxSMiEnQHLaSOZNm7fi/KaLQxWAvWWrBgqfqNQEqBHwSkb9wYevpTB7rmYqyZxEWlUtb1ePPsmwR+sUQrxCS1rdyxuI6LF4nwm6vH8b7aQ54MHlEytsBK0c7bJwbovdHJXyZOEyqFVgZjbfkbt8LH43GaWppJNqS4OjSUqsVY04DSmn8MDHD0rY2zPhcChJA4nqQuHsGLTnAh1cp9TophO4JAcN2Oso5NXB7uIFj1JFecNnxlMAassVhrMMZijMEajTEGozV63PBg+EeK+XwtxPlzQCs18yUBUoLnusRiLnXxCA3JKHnzNo27GxhnHM96jOssaXWDKBGcCUOqrpmIA54UeNIihQEsTIfXpXtjfR3SrV3paz4VgBSzeBQl+GjUJR5xSCYipOqiXB15l7beFBmuEaiAa2qUTJijGA2I4pCKRXAxSCyBAmEFRmusnQlvtCIWjSIdZ/EGJl1U/xQgpQNOnpHCWUYnBvE8F8+RuK5kk7eDN8LLZMIco8VRtAoICfCV5shr38FYizYWYywdqe20JPsRtg47DV4rjRBiMs8Wb2C6HyFxXMl4eB65d4Q9ux+gmQQxPASSi1yEQDHmj5MvZsAPeD32N9Z8pYvAL1Io+gS+TxAEvPXaTdanJe3J3TPgjdZY7NIaEFIiHYmUDu112xk/KRisv0Rsi+JdP02DiSM0hIFPpjCGKgRQDDn/zz9z3tdQVBCGOM1rWXdlMz3XHqY52YdSM+FVqKqOOXOrZhJbqup8Bd5xkI5DJJKiI9WPc7wNddGjIdZMNshhghC/WCCfz2JzBcgWIRtAzod8AKl7WD98L73DD9Oe3IqwSbTW6GnwKgzLY9d2UNtAeQYq8I7j4Lgu0nWx0iHitbKisZ9rz9/EvBPFTSTJ5ifw8xmKmSzkgpKBfAi+hlQn3SMbaBpop62uD0EjKtRoNRNehyEWOzWDizFQ8m9vgXe8kgEhHTQOkUgnO1Z/mvHDOcxQBD/mkcmOYbJ+adb9AAoB1HfSNbaBjsFOtqzaD6YVP1CEYYiaBV6FIVg7H/98BkpJVA1fuQvXBemgrCAW66av8+P4L4G+HmPCjaNyBcirUhQaVrIidw+dg91saX8CR3RQCBRhMDe8DlXV7rxIA5UPTIev3HEcrJCEBhLxjfR2PE7klQSpfAu6vrU0+w0raSp0s+bcRja3PY4jOyn4Jdha8KUN1M57vqxZhay1WOys8KVkliAkGkFRGerjvWxq1+g/HSOzbYJ0XZ561cWGwR42tX6IiNNNvlBaNmFYG14rhUXOa2GeMlrqFOeCl1KCFBgLaCgaTUO8l41NRcLTmsKqkPWXe7i35TGi7noKvl4wvNGahZzx54lA6fVa8BWf2loMBqMtqdg2+lrraBn5O+2tfcScLgq+JgiCBcMbYya/vfgIlF+eD97aqa5SWwNW48ouVjeuQmlDwQ9RSt02/HwVaF4DlQqwEHhb1RJbY27pbbRW8ybsjJmvSNT+x0ntCAiIJ5JIvXD42brK2TaphcA7Ut7ZRiaFoLm1+b8CXxnfmDtIYj8MiSeSPNpwivpEgojnTRmoOgaWkr3Ud1QmrFKCbbmhstXPytUN62BxYNq7Ukq01lzPZCnkcos3MJwezqXT6WQhl8f1PISQ5TVZDV85lNvyGRewZsoAUz3V5N+Xd/ipuZ3ZMmil8AsFlNbFmg6WtaxlLWtZy1rWspb1/6t/Ay5Oahn19l3HAAAAAElFTkSuQmCC", "icon_hash": "60608a07d112ace9d7a180ee9deaa3d4", "icon_fuzzy": "bc85df9c7cdf2d8ba0f53a0f681e6f31", "icon_dhash": "6060f0d8ecfc4000", "imported_dll_count": 20 }, "data": null, "strings": [ ",LgCA", "te pred prv", "Potpuno", "o&,v$K", "wZc#w", "~ze t(~", "G8U#j2", "Dq6.@", "ati uporabni", "s. Tas darbojas ar sist", " Microsoft Corporation. Med ensamr", "rm]ko", "X9oUF", "DYyqp", " ocorrendo em um local da rede e pode ter atingido uma interrup", "su1U,", "hB^=-", "a de instalare a mo", ".Nj5M", "@Instalacijski program ne mo", "u, jGd", "ar-MA", "Guida", "Prebacivanje: / installdrivers ", " wyst", "http://www.w3.org/XML/1998/namespace", "uXj S", "PHAMD", "e^.k?", ",E|zO", "ml-IN", ")\\P!r", "^y{B", ":Q;Zy^U", ":K$Kb", "Ej6@%", "\\*]D&B@", "N)Pee", "Ayuda", "}H`wi", "_hq>l", "d+w}ogdd", "4a^tu@P", "u@ZY!", "O9jgf", "=8T[Hj", "naamilise v", "!wj{O", "l{@qk", "_nmKQ!", "ZB1lC", "Aktion: F", "e:;F_{2", "i/R3+!8g!", "1&^ArW", "4tf#T", "UsV'<", "wB1jg", "gezhet", "4#5s5_h", "D[jhP", "X\\*/iR7", "installation d", "&D6IT", "z\\lll", "#&\\}W", "&\"/%HbP", "k6|5'", "{:k9\\Z", "e.ELe programme d", "V}<{8", "]O5)m", "-u76jq", "jsn9s", "m_viT", "\"cZTL", "FileCount", "& pBT", "FN#YF", "n se est", ": / Postoobe \\setupcomplete.cmd ", "CGN]x", "'92KL", "'bU!#", "9<9l9", "As:nb", "bZGwS'", ";C;l;v;", "kErwq", "%Q!n[?", ": / PBRUpdate", "IZKa)f", ":IvY4", "ho umiestnenia. Setuprolback.cmd je prisp", "@=EAS", ";M+5YF", "$C95H", "nario d", "2!/[s", "^QTdQr", "vEYtU", "e=8^:", "Pyu#1A$", "\\#.]|Mr", "SetSecurityDescriptorDacl", "4 5;5f5", "e\\gd'", "w(IO4", "DQ ", "jQ>hj", "gzry", "EQ\"`s", "SetupCleanupTask", "3U{ewt&%", "P,/PnYi", "?f]WwQg", "d|W`04", "|ba=XF?", "U#AGf", "]k3DWp1", "| yM8", "W9a32", "cfv^)", "$bTyp", "^|#|,", "y>][dg", "7`E\\J", "&`w6O", "6C6k6", "7S2IS", "292H2b2p2", "Por ejemplo: setup.exe / auto upgrade / Telemetry enable", "anje poteka z omre", "cb#d3M", "-50XX", " permisiunile utilizatorului", "L]\"n8", "f8LU}", "QHkx',", "tNMIq5\"^", ") G}.", ";XGy#", "WVhp)A", "2n*gn", "yCzKe", "'YOH<", "/PE'!", "2M2W2", "Ld~FO", " a telemetria gerada pela instala", "bY8/|", "{I^?Q5", "2.t )", "JC]lHC]lMC]", ".}x&y", "2^F;2", "L%9fR", "ee5:g", "S`ubM`", "JOp.7", " napr", "eara3i", "[%Z#DW", "wa$yB", "gt. Dabei werden alle Unterordner des angegebenen Speicherorts von Setup rekursiv durchsucht. ", "Example: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", ">[f<=|", "444C4P4f4s4", ".;+dg", "kVxgJj", "aAkhA", ";\"j ", "@v[l}q7", "CDlpRegistrar::RegisterResponseFactory", "H<&04", "[ ", "galement collecter des journaux et autres informations de diagnostic ", ":;F^{", "~We]L", "Alternatively, a deployment engineer may want to collect logs and other diagnostic information from test PCs in the event of a failure. The following command line instructs set-up invoke the setuprollback.cmd script after an installation failure : ", "79n\\+A", "tyZ4g", "fz\\pB", "jlok miatt nem tud elindulni. Ha kor", " le programme d", "l24Uob", "<#sS:Y", "MZS[q", "n6otT", "klenmeye haz", "sX1.[-", ".5{,~Go", "ff-Latn-SN", "nQ']J", "fD#6*", "[-`ZQ", "')U#a", " komputery w dziale z systemu Windows 7 Enterprise. Chce to zrobi", ">!>&>2>=>Q>n>u>{>", "0W0f0K0", "$;T:b", "2<2*o", "ynSqoM|C", "5$6>6K6{6", "lg8zd+", "&!u_U{.", "-|9|%|5", "]cu9k", "@QY/)*", "r%J}i0", ",K$3Qd", "UwRYF", "FS_iB#w", "Ej9ch[", "d$Jsv", "HXd c", "DGl/BP,j", "2]fon", "\\ka5v", "wlX\\BT", "UnlockFileEx", "8'979=9c9s9y9", "9+9c9", "o9\\Rm|*", "RlCcNQv", "]-%^!'", "g#KUF&", "f>|[[", "n>:zp", "_aAdv", "@Kr$w=", "%'\\&eZ", "Ro0K9", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "Pc=\":", ":8@2H", "o corretamente. Reinicie o computador e tente executar a Instala", "9,t[Po", "+y9)A", " kapat", "}YL", "Anahtar: / pkey <", "ite in", "k4git", "G}s\"y", "Exemplo : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "k-r-3", ">zHksuO", "A14 &", "Px#sZ", "xdk5;", "041B04B0", "bL|r.m2M", "GWzC` ", "|b6Epk", "s.FL|K[U", "PT(/T", "`.data", "9'9C9~9", "EDUNpT", "*G.9_", "VWh,t@", "Estamos preparando algunas cosas", "V./,\\v", "N0_07", "n. La UI de instalaci", "t.[/P", "rz\\Dc%", "MTNlA", "Por ejemplo: setup.exe / auto upgrade / quiet", "jvs^KMy", "j`K^y", "1 <~d", "ad: setup.exe / auto upgrade / PBRupdate disable", "%nr>pL", ",#.jCd", "Mi*1~R", "Sp_^P", "d{%tt", "edzJU", "cfffffffff", "V JC$W", "MA7re", "N.,M}", "\\Ue;QKIwI", "IaT\\", " loadFrom=\"%systemroot%\\system32\\gdi32full.dll\"", "bCr9yN+", "gning efter, download og installation af opdateringer). ", "W?ygd", "m'h+]", "O1j|t", "CSetupDialogSplash", "G+t7z", "(_`?v", "q\"WssNG", "Parametri: niso na voljo ", "W2>2 ", "IJWg4", "7'8f8", "KrgcP", "8Jnn1", "r g3<", "0f $5", ")r#`C", "eV1?Z", "yfemc", "F{Q`v", "\\vG0p", "_\\p}n", "#w#6[", "o: injeta o arquivo", "dik a telep", "'R|V~", "ao%|,", " wpx.dll", "%LX@ ", "Switch: / Postoobe \\setupcomplete.cmd ", "6#696F6L6S6e6w6", ">bk]X.Yq", "Checking cleanup registry value...", "[ av8", "~yrCg", "Parameter: / auto ", "=|20Fd", "l\"4{q", "'Tn6.5r", " po zako", "XsnSw", "| Xt'h!u", "affiche, mais souhaite que les utilisateurs finals parcourent manuellement l", "3B#D1", "t$)IMC", "8pS6J", "0954&m", "s argumentai gali b", "ts parametrs Enable, uzst", "Vx$,0$", "YSh_n", "x", "ls&Y96Vq4Q", "VE}'U", "jVD\\]", "40F6z", "dzis: / quiet ", "*2P;+", "@Mt+4E", " Microsoft Corporation. Tutti i diritti riservati.", "Schalter: / Telemetry ", "hcH^>", "a=7Hs", "Perjungimas: / DynamicUpdate ", " nadgraditi sistem Windows 7 Enterprise. Ne ", " je naopak pro p", "38xEv", "8\"8*818}8", "0j@#B", "Kontrolli ", "zenlemek i", "_4", "v1]<+", "].d)uH&s8", " MediaSetupUIMgr.dll", "@\"RwF u^", "baEk+%m", "@{ nfWS", "dvGvgv*", "9De geselecteerde architectuur komt niet overeen met uw pc", "/ZT~p`", "AAg>H", " disk ozna", "dzu, apmekl", "yPLY,2", "Example : setup.exe / auto upgrade", "4ewXz|", "RKUS. Seda l", "Xz|+-P", "foJan", ")&9C)", ".4~q]d", "a|Kaq", "Bk@%&", "8!8?8G8S8p8", "6g7|c29}", "cOS<'", "lEr20", "Example: setup.exe / auto upgrade / PBRupdate disable", "TpkVk(`\"", "aX>eg", "pida (tambi", "d~&?;:7H", ":5iY", "g($t'", "Indstillinger: Lokal filsti eller netv", "5{:pkvf{", " cesta UNC k soubor", "igused kaitstud.", ".w{pR<", "393S3`3", "(ovp|", ",Nf>s", "74Y~`Z", "G{,?3", "p_V+w", "mfgfg", "ymrJh", "`! NB", "Cu2eV", "v4AtW", "fOe^YCiJ*7tRK", ",~vYl", ")e<-W", "nxZ+NzN", "_^.Vr", "]gRdws", "L'architettura selezionata non corrisponde al tuo PC. Ad esempio, se il tuo PC esegue la versione a 64 bit di Windows, devi usare la versione a 64 bit dello strumento. Riprova a eseguire lo strumento e assicurati di selezionare l'architettura corretta.>Si ", "Q{%_5", "eWQ:\"", "}[{Q,", " Full ", ")Bz& {", "AeS9T.", "|MeV5[", "E+OGs", "v1S", " komputera", "I)S%;>", "Acquista", "^vL,l", "wWinMain", "Lgg?E", "'{#P>", "[A2+H^", "Nh|Gc", "vIZ,`f", "yo-NG", "6'7C7{7", "Vqw9[Ce", "ar-KW", "kenleri kullan", "t+H+`,", "Available UI Languages", "pStopSetupPlatformETWSession: Failure while stopping trace at [%s]. Error: 0x%08X", "86?EK", ">nUyL", "`EEK+", "tdVB}W", "x3zAqZC", "`TlLs", "Configurazione", "61n$K", "JIPkF", "is69Yv", ".+-YRv", "anas programma instal", "9!2yq", "o';XE8P", "Exemplo: setup.exe / auto upgrade / showoobe full", "$dF71", ")^Q-m", "yEz;p", "zB['>", "?Y$mw", "M4Cw8T", "3JU]b", " OOBE(", "Bjh|7", "+=R@T", "7:7T7a7", "8QA[9", ";:&0&", "(u7bLub", "UCS-2", "~6tG.", ":gqMJw", "8Installiprogramm ei saa kasutajaliidese keelt m", "X%e]%", "@?pC4", "c\\.zS", "s: %d%%", ",rn(0", ",F|*1;0g", " viet", "nMcSa", ")O#yq", "/BsR/", "1xtQ`I", ")@#Z2", "0SX&l", "hn\\&5d", "kleri ve di", "Verwenden Sie den anderen Installationsdatentr", "rL*6m", "RegQueryValueExW", "(/,\"?", "ky-KG", "e4X! ", "EDQQL", "e9F_:(", "i instala", "ritykset: k", ";Vs8B", "\\`+1|", ">+>i>", "p!nj:", "U ", "~{/%O$", "8m'\\vi", "^4g:^YSd", "]fE*$5?", "5F?W ", "W^f>!", "ide: setup.exe / auto upgrade / migratealldrivers none", "kx", "EJGPu", "9NSAq", "5T#Qn I", "Windows 10 Kurulumu", ";Ftu;", "GaUgv", "?oRRx", "&;ojzmV", "gl_.'F", "l galite netur", "=IZuC", "n^b1U^", ":`", "Ool]O_", "1Die Installation von Windows 10 wird vorbereitet.", "?-?5?B?X?", "iQSOK_V", ":wz's4", "b@{?z", " specific.wim ", "S.{|D", "gj\\W.h", "d8:P)('", "yG4d[", "Whz/6", "[Z+oA", "~&VbHK", "RegValueEnumAction::Enumerate: Failed to query key info: %s\\%s (error %d)", "p>sH+YM :", "velet: Megadja a telep", "7kT~c", "8\\<,^", "t9]AW", "H[Jv%<", " selecionou n", "h}o,}", "&JkJ2", "X:sA6;", "$:K`l0B", "'D~\"R", "HvS4j", "6S=`g", "&Ty,>", "A=G%;v", "bsearch", "$uTrt", "omtPM", "F66D#", "dh\\#j=", "a+k{@", "*h~OyP", "%^c7oY5", "M{#t>", "kM]mpw", "BsLhn", "})16h", "PWPVP", "Tg6 R", "htifh", "X>nG=", "L:vfJ", "ierul setuprollback.cmd din loca", "CgpF`", "]9:[_", "w)]313j", "R}Y!]K", "TsIRM", "?nJ^h", "}sQ>@", "r%j*5", "w~mty", ";~X[y", "Parametere: Lokal bane eller UNC-nettverksbane til en mappe som inneholder.inf-filer ", " ++PD", "ne+L?o=", "$0|,e", "} nMx{)", "fmT@W", " pliku Install.exe", "qFuZ)", "6Wz*c", ",CF\"t", "=wsQBo", "|nTkI#e", "9k:D", "t1,E6", "0xhru", "/E@)h", "]&+N4z", "@K9vO", "?>?b?z?", "/p7A];R-`", "7@HX(*r", "E82ma", "Lv)!e\"[", "d[vU;", "LLc>+9", "=8V=?=sy", "&xEb_", "Si ", "ka bir ", "{vNbn", "JN5 w", "wT~|T", "Parameters : Enable; Disable ", "GEdF\\", "@@@@@@@@@@@@@@@@@@@@@@@@", "ierele de instalare ", "6OGxT", "Descargar", ")BN_Q", "gx.6<", "0L0zv", " nurodyt", "1[*iC", "Y<=\\{~", "B]+A#O", "ytkownika. Jest on uruchamiany z uprawnieniami systemowymi. ", "Applying SetupDU from a directory: [%s]", "|IJ#o", "W{j=3=m", "N8iY?", "8z[H2", "%Qj/v", "s visus uzst", "uS0?Y", " Microsoft Corporation. Visas ties", "uW,n!nM|", "Exemplo: setup.exe / auto upgrade / noreboot", "03jd{", "cuter interactivement OOBE. Aussi lorsque / showoobe est d", "0?O$A0", "; ;$;(;,;0;4;8;<;@;D;H;L;P;`;p;x;", "$CCwI(", "uft6Das Legacy-Setup-Programm kann nicht gestartet werden.4Die Datei ", "M1#g~", "nT2#u", ",t;y%b", "yytd'", "Jatka siit", "^:_)n", "wH3h>", "v7;", "d*Q,!s", "GetSystemMetrics", "6Preparazione dell'installazione di Windows 10 in corso", ",Det g", "!YJ1'v", "_ZW8olwp", "bYt]W", "CN +wy", "C_^wSW}}", "t\\\\3E", "eY&m2", "5*;~i\"", ":WIIc", "EventRegister", "~Z8Ay{", "Rd[w}", "n. Si has iniciado previamente el programa de instalaci", "1pTM>", "utakse kasutaja sisendit ainult ", "X`ik7", "sIi}M{", "WINDLP", "te se, ", "fiTXtXML:com.adobe.xmp", "+\\.'bR2", "metros: ruta de acceso al archivo local o ruta de red UNC a un archivo con el nombre setupcomplete.cmd ", "})`}q", "y-Yy;i", "mu. Tas darbojas ar t", "q0p91", "~yERq", "Q{_s2", "\"ohJ1", "gGp)Z#", "7Ar\\3", "Q.;*dG", ">4)}_}", "_fYai", "@vtt4", "re oppgaver etter at installasjonen mislykkes og PC-en stilles tilbake til det forrige operativsystemet. Det kj", "i enged", "aduje aspo", "C?ow9", "8&'81", ")}AWC", "ctWls(", "$3Y9J", "M4X0-$", "_;nAn", ";&;5nu", ")>+T>'", "E@&03", "g eller UNC-n", "fk,tH", "y{q\\L", "o e acesso", "E6K%V", "KL=/t", "!V0Xt", "S^^^AAQUQII", "re installasjonsprogrammet for Windows 10 p", " PBR.", "~'I?*:", "]-j%x", ".VX|)", "_Bn<-~", "0$0)0/0I0Y0i0n0t0", " PC-ul dvs. ruleaz", "*58[*", "}t:`&", "0V-7C", "q|`&/", "ei utilizator", "#Vx\"&6", "skor keletkezett telemetriai adatokat. ", "berom sp", "5 _ZxB", "29M])", "3R4c4i4", ")zyZ}", "~e#.1", "he|g7", "a4?r=O0W", "qy+8^g", "kw%-H+", "4lQAu", "#W67vJ", " architektura neodpov", "6!7E7^7t7", "|h,1\"", "~Qshm", "Mb4eSn", "]_/6w", "no pou", "Y|OZ8;", "7Plxz", "?'Ax++", "GrdhX", "re opgaver, efter at installationen er mislykket, og pc", "MKA: Tento prep", "ttelep", "!9FbC#", "2P{;q", "IcAoly", "dM}C|", "X*w)iJ", "N=, ", "n y el equipo ha vuelto al SO anterior. Se ejecuta con los mismos privilegios del usuario o los procesos que iniciaron la instalaci", ",F8BA", "av!T6<2", ":!|Jb", ".<:')9#173", "Fvk__", "=bu^;", " ", "<=Clm", "tor neaktualizuje ani nevytvor", "gf[Ks", ">}`QT", "q~Jf~", "@@Tu8", "Tu@e%", "fRPWDj", "vrstom disku", "m.Q]{", "N.0:n", ":U&S;", "urirati ni stvarati PBR particiju ", "cia pokra", "\\1*U-", "L6(mG4L", "Microsoft Code Signing PCA 20100", "oP%aGB", " Kj]g", "nak rendelkeznie kell enged", "jcCu6", "Yvv#g", "|}}?i", "\\Oa_(", "aCec2H", "Jx#b{", " cesta ke konkr", "rqi4*", "8*G#o\\@'", "+F>W%", ".?AVCUpdateScenarioCtrl@@", "_{WvLO", "+4N_b", "=<9#.", "lem veya kullan", "nieur de d", "ja letiltja a telep", "GetPriorityClass", "Z/P;?", "*OMkD^", "NOZN/[", ">(0$y?", "PWNdHE(", "et]'1", "wOF:5", "VV04[", "\"%HER", "SRVRRG9", "jZ8mQa#", "b2&9*", "3U_fuhS", "'J'>k", "cILXz", "h@eZ\"", "CDlpRegistrar::GetTransport", " loadFrom=\"%systemroot%\\system32\\cryptbase.dll\"", "~K7f6 G", "z\"az>K", "-t:>h6", "{S=q^", "r5yzH", "st-ZA", "smapp", ")%sXlK", "PH{gT+p", "~o;p0", "c:yW0~0Y0", "Ou/{rfY", "YIUu*", "wyQgE'", "'/U/h>", "\"=\"cH", "/RollbackSys %s", "8\"O\\@", "tVM&&", "y/m+T", " pokrenuta. Funkcionalna ispravka je mo", "fC]KU]", "(t;x@", "\"k3GL", "kai ie", "j7k&T", "RU<`g", "^{XwFW", "o.4pu", "0j9oa", "E4`TJ", "/nQvg_", " name=\"riched20.dll\"", "Pv|T ", "}a?Y4%", "424m4", "?IV^eO", "Qo\\:]", "K05I99", ">f(Y(O", "CreateDIBSection", "u;F[Si", "ab-#Ji", "SI,Jv", "/H?%~", "o?w0:", "Parametrai: vietinio failo kelias arba UNC tinklo kelias iki failo setupcomplete.cmd ", ">s/b$t", "Iz)O0", "Mp<)k", "I+sRWF", "rqlnn", "862m/", "g@#?9", " ", "[\"}1_", "a%\"VA3", "9gpok", "6u^\\b", "d4ge(", "Rksm&", "0zzM0", "kyguB", "lr?u{", "'+%PX", "t az illeszt", "4xc?[", "ba-RU", "UuI&G", "1Kui65ON", "M &v+", "@j8>O", "o2Xw.", "O_;9nG", "DFMBydT/", "?!e^I", "S&|", "B$g#Q", "qOZsBi", "Found tracing session: name=[%s], logfilename=[%s]", "g4D2QA", "I[AmO", "O\\0vVz", "*VSl)", "@@{X,wi", "%s bitai", "xS6IY", "rio na atualiza", "om:/t", "0PLhg", "ide: setup.exe / auto upgrade DynamicUpdate disable", "cuter des t", "3DRvx:", "k,e6/j", "85i%Z", "$Microsoft Ireland Operations Limited1", "fASF~}", "\\/g%Q", "o pode determinar o idioma da interface do usu", "CDlpFile::GetError", "cc`)9!", "n^nRc]", "^6#61", "\\)|d=", "]=]v$", "RW0~0[0", "D>$x{", ";\\:nG4i", "{;vY%", "]{SI7", "sd-Deva-IN", ",cn[O", "%05JTO", "Nxa5|", "H4_n{l", "ti naudojami pakeisti ", "ho riadka. V pr", "appeler le script setuprollback.cmd apr", "wH\\Fw", "n9i;/", "&Dc:L", "0@;?u", "7(?Xe", "bcdB%", "Zx(X+", "}n.b`", "Toiminto: m", "\\=%ei", "Yf}Jf", "Underst", "TV&8)", "FKZBe", "x6--;H", "~ x&jY", " \"Enable\", ", "i: %1!s!", "_LKIB|", "swy?wo;", "GH9_ t_", "{p1b7", "_-H{|!", "<)~&_U", "rtuseks on seatud Disable, ei v", "k'}XQG=|,w", "_7(3W", "Sklopka: / auto ", "LAf)M", "&c'\\K", "fna~%", "Na6Z~", "^o7.\"!", "9G-0v", "klad: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "fsnHAP", "%bX0R", "M}8-Q", "+A2Q|r", "4cj+g3", "rankos egzempliorius. Gali b", "`a1uV", "ql-24", "/\\4c.", "(d:=HH:", "|'{:d'-", "s{eoQ", "Eylem : Belirtilen konumdan setupcomplete.cmd dosyas", "V{y!oV", "du+&u", "}6{,zP+", "Z3uQW", "deI_Z", "Dv*?A/^Qn*w", "\\9Fvk", "Cw{ra", "u medija koji u mapi izvora sadr", ":0;I;];h;", "Z18#9E", "Na przyk", " o caricher", ">Db+L", "97u\"3", "XmkK<", "zg,hG", "#=./#LS", "<]W74", "U4wT(", "tirilmesi veya olu", "Exemplo: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "L+u`p", "-lQG4", "[[\\BL", "/SessionId", "~$6j(k", "~uv8w", ")|1;\"x!5", "hrend des Installationsprozesses werden alle am angegebenen Speicherort gefundenen Dateien ", "~qr3;", "} #|~+", "vOM6l#", "'%%MOO", "/[/$(", "[+&))A", "&2]fn", " de la mise ", "Valitsemasi arkkitehtuuri ei vastaa tietokonettasi. Esimerkiksi jos tietokoneessasi on k", "3eAMo", "Vz9X'(", "/-TM9o", "t?W%{", "'n4", "YKiGd", "programokat a telep", "On=b|", "^E]&]", "EnableMenuItem", "\":jQD", "rCdZ@", "kO,km", "Dajz3", "u.rDd", ":F@p>", "],-CH", "=L\"*8", "X[9GV", "PgUw>", " pid.txt-tiedoston sources-kansiossa. ", "Zg#nP#", "{OEEq", "8O9x9", "SSP~Q", "0!0U0", "CfL5w", "re yerel dosya yolu veya UNC a", "7t}B/s", "+yJsH/", "SafeOS", "F:Fm$", "k|I{P", "dia sous licence en volume ou un m", "YW9/)", "7jXffja", "OPOMBA: to stikalo uporabljajte le v okoljih za presku", "s;!;W", "nr8OA", "BMW8Z{", "l=QW ", "rV= |", " uE?Y", "8|VA{", "kkel> ", "i.h{-", "pM{=X", "(>G4R", "37vZz=", "E)O\"/", "wt(Mf", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "tte / Telemetry v", "Xb8b,", "eg 2Mmru,h`", ".$Moep", "d_mI\\C", "Haszn", "98n|%", "lf}7)", "qxjEhM", "f7KKYK", "wUtzWE^", "n de cargas, omisi", "\\JW:F<", " wymaganej wersji pliku XML>B", "zyfj+", "MJ3LL", "aImDgY", "(H4D4^d", "CDlpManager::Reset", "zv.Dy", "/SetupDUPath", "Cabinet.dll", "G7g^*", "K`0<\\", "Gjsws", "g\"&eV", " varsay", "QQ/n/", "-d[6n", "kim vmesnikom namestitvenega programa in napredkom so privzeto prikazani, vendar so avtomatizirani. To stikalo predpostavlja tudi te privzete konfiguracije: pogodba EULA se sprejme, dinami", "E37LU)", "tkata?", "n>2_C", "S+?vZ<", "7D~m,", "Parametrit: Full; None ", "q5Oz%", "metros : Enable; Disable ", "TJ:,E+%=", "O8~+G", "FNv", "@2n!q_", "Yehj.", "Installasjonsprogrammet for Windows 10 tar ikke kommandolinjeargumenter. I ledeteksten kj", "j P7ds", "6Jy(.eZ", "N:T7Yo", "vZK#f:", "b(6=:<", "=E>R>", "\"K^ UA", "QfH8p7", " vain testaamiseen ja testiymp", "]//5+{", "eyjOp", "tk\\wdL", "enite ra", "qp", "VX=;6[a", "~uDc1z", "^6q$@", "eE^scQ", "Ll eR", "d5fXI", "a=L@GL", "r Windows n", "\"'80Xh", "c+!~", "):Aq#(>", "1JSKOO'1", "Ls.#7", "0GgTQ", "+dQbI", "tre autoris", ".a_ 4O-z", "OB^54U", "%E0&Jv6%", "hX:49", "?V?]?c?h?s?", "rfMzC", "Nnd4r", "P[u\\K9", "eren Windows XP", "nu tekrar ", "\"\\", "D$pSVW", "'FC=P", "R^hqm", "v>/vQ", "cijas avota datu nes", "aftIA", "0!0&020B0V0`0g0m0r0~0", "Parametrar: Ej till", "U2+oS", "h\\;u6K", "(yyNrx=", "xMXa\"z", "D.F8s", "C!p29", "{>4x`-h", "?{Dk{", "3?CIB", "*bT,.^", "OsUninstallWarning: Execute file found [%s].", "ram, ja j", "1*1:1@1X1n1t1", "21272[2", "JfV0W", "W9M.[", "&h+Vd", "Cleanup value missing... assuming no cleanup.", "=7\\Gz", "jX:BQ", "Radnja: Ubacuje datoteku setuprollback.cmd sa odre", "Ettevalmistamine", "ca-ES", "7,o-C", " driver.infs ", "3yI#I", "SPOr~", "b0]_B", "rc;:G", "w instalacyjnych. Je", "A Windows 10 telep", "{H13'", "/Install %s", "Forbered", "/ZhP[", "lQ,Z,", "CDlpTask::GetActionFriendlyName", "(@LDf", "e namestite to razli", "H\\O6n1", "mogat", "z#Z45", "o7\">kt", "lineasennuksen k", "o+>Y}@m", "41?|Z", ")o`J.2", "lreiz palaist Windows 10 uzst", "()]7 ,", "3d;;|)", "6#7b7", "_8OIA6", "TL90B", "b=^sY", "^k>YjO", "7] I|\\", "\"|?{ ", "BG@2]@", "yMJ)yl=", "@C1-/", ". Kai / migratealldrivers nustatytas kaip N", "l/g 1", "On1^o", "Su`.)", "3h?)i", "0f0D0", "-BsU9", "hlasu s licen", "]HX(-", "(m=U!", "=/&\\Z", "PDb0R1$", "6V;kc", "x'23", "8Xo;Hk", "$,/K0", "'F&1ob", "en-NZ", "glicherweise nicht aus, um einen Kopiervorgang an Speicherorten auszuf", "e se sa istim privilegijama kao korisnik ili proces koji je pokrenuo instalaciju. ", "m;N$d>", "=!|jR", "memcmp", "mbolo del sistema, ejecuta \"setup.exe /?\" en el directorio ra", "WgtIq", "rMHXPx", "x{Q]Pe", "695I[", ",oBRcd", "kb6*[", "cute avec les m", "P]qXu7hEE", "_?\\?1", "wLHj6", "Y9{B&V", "V_(vC", "C_L?W9", "X4G\"5", "w2`T1)4", "f^1Y%", "R{=xe", "VWj 3", "<\"\\=&", ")T?@+", ":)FMQ", "_=3c>5", "uj@1m", "/,E92", ".?AV?$CAutoWdsLibFree@PBG@RAII@@", "^WoL9m", ",P>*2D/v.", "kVSek{1", "auju kop", "TNP.2", "2XZp,,\\h", "04-%X", "j+u:2d", "])>9vC^{", "7>q5*", "Fj,GF", "q`_ 3", "n=@u#", "BoxResult", "P)W`i", " Egf]C", "mqGY7Z", "9h[~_", "i8S~6", "k@Jx`", "z7;{^", "q2U[U", "F-LN,Ob", "FnG> }8x4", "7KC{.WO", "s*0jE'", "*A\"H.", "0Pa8q", "y]&>y", "w7qWh", "1pbFvP", ">Xz^oS", "1&1I1Y1", "h)jCw", "{Qyg>}", "A-7''", "702G@", " gerekti", "+H{jW", "na pot UNC do datoteke z imenom setuprollback.cmd ", "@tZ{4", "Er is geconstateerd dat de installatie wordt uitgevoerd vanaf een netwerklocatie en dat er mogelijk een netwerkonderbreking heeft plaatsgevonden. Voer de installatie opnieuw uit", "(FRu6", "VE&dP", "c6ec|:O ", "*5rs0", "w}{:{", "Lk1K|", "r Windows 10 accepterar inte kommandoradsargument. K", "xBx<2", "C>/or", "CDlpTask::Resume", "s!,q'", "'7V$7", "|//-d&:", "}10;L3", "`0jxbG", "9Zy#2", "0;5(:X", " \"/ migratealldrivers\" ", "o a invocar o script setuprollback.cmd ap", "ra nem illik az ", "\\gB$p", "JVAAs", "Cleaning parent folder: [%s]...", "ajq8X", "ZMH$B", ": All; None ", ")EDTzKKt+", "5Pfi`C", ",^f\\}", "nea de comandos indica al programa de instalaci", "Scenario ", "7xUYs", "j1su4n83", "_,g_j", "Te.,L", "tTw~r", "d,\"0;", "OLEAUT32.dll", ";Please try running Setup again from a Command Prompt window", "u54\\-", "47fsN", "E\\\"*l", "#E+zG", "jE\\Er", "S^|:+\"eE", "7m!5j", "sB>v$", "<;k<,\\", "CSVVVVhT/A", "~xG.2", "-z{\"I", "^Xnt'", "MgE/Zn", "$8o>3$(", "9{7?<", "zVjHq", "v[3bv=>", "Qr_9F", "FP#_7Z=/", "oi)6c", "Asenna", " o defec", ")!),>*", "v_H>U", "dK4!i", "&JgtQ", "n Kommandotolken", ":+=9Q", "ZegO1%S", "m;:7\" ", "$>@%:H", "6 6,686D6P6\\6h6t6", "0K0i0F0K0", "duotis. Kai kompiuteris bus kit", "\\$windows.~bt\\", ">#>W>k>v>", "u{q5{+", "2-71J", "~{Kq*", "6b1Z#", "xu,#I", "i';H;9", "vCXVX", "Ea5OO&S", "C fy1", "u|cYY", "kla darb", "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp", "TX+M]", "0P1_1x1", " 3Na~k", "@\"8a\"", "{ rwe2", "~~~~~yyyyxxxxxx", "6 Dg*", "u.e8)", "+UN9,", "aDM_K", "X5Uzl", "Installimiseks valmistumine ", " JaO0", "_dW|>", "uzvq-", "6s7z7", "yRWTT", "5\"525B5R5b5r5", "O>)>&", "wZw@l", "onnistunut ja tietokoneeseen on palautettu sen aiempi k", "~9~msH", " deneyin.", "~?Mb&", "Hw+u#Rt+~", "Vh0K@", "[qUm$V", "xP/$,", ".rsrc$02", "oCr[9", "?7Rh0", "sszes almapp", "bDeeh", "Un technicien de d", "\"Tgf'L(", "74z*4vO3", "OO,y>", "s%a7pQ", "Is.K1", "xCMOM", ".;5v->", "U-;>F*", "6u6i;", "RMZ)d", "={Cu`~_", "YF/up", ")*/'6", "`03*:", "PRaV;", "W;n~/", "De)g5", "#JEg~", "<$|s&", "CDlpManager::CreateAction", "N?XhKb8", "3yZ}U", "bersprungen, und die Komponenten werden auf ihre Standardeinstellungen festgelegt. ", ")+uU*", "K}NN~", "D%KT+PCM", "Mcul:", "lh',g", "VIVQN", "3)BO&Au", "(&N)USetup.exe ", " tuotantok", "(Mxn5", "Valmistelemme paria asiaa", ")^#)Mw", "FrqYi", "&m0vO", "Rk1sb", "vQm9/oG", "Pokretanje instalacije nije dobro pro", "[9@gV", "1&kBh", "%zE>x", "/%9p%", "ndaren m", "~N;ps", "A+IQ@", "ljs eventuellt installationsgr", "41$eb", "W=neG", "MZ|Vo", "*Are\\", "{1uWa", ",@B", "*O8wB", "8S}*&e", "D~b}AMd", "TAhn[", ">CuC\\setupcomplete.cmd ", "VofE?", ":h)O`", "2d%jt", "installation ne migrera pas les pilotes dans le cadre de l", "jY`^#", "$nG'Q", "~mK, ", "#R*EWA", "+AM5>", "ltL~u1Z", "_KIPV", "I6?0*Cl", "040204B0", "lteni az ", "testes. Ela n", "SYSTEM\\Setup\\MoSetup\\Volatile", "Tahoma", "D&jct1^", "@W#]Mt", "2>K&@r>2", "Pn\\(7", "Commutateur : / showoobe ", "NJ(.=", "nA%ev", "x9'IIx4", ",9Mm3", ">wdHPQ", "5 v*3\\", "040704B0", ":\"vH[", "F<$kS", "p5t>i", ",QF1/", "rL%98", "t_(;{", "ef9YeV", "XCe6V", "6Ck;V=a", "/:hvs", "R8=imE", ",~A26", "cgajq_", "J ,OEK", "s$36u+r{M&", "Valitsin: / DynamicUpdate ", "igesti k", "F/'Hw", "9_]y;-", "zh-SG", "-e{9\\", "DcSPv", "?Pv~u", "nzT%G", "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x", "Schalter: / DynamicUpdate ", "03X]$I", "n completa a Windows vNext, que requiere la entrada de usuario solo una vez cuando el PC llegue a OOBE : ", "n Windows 7 Enterprise under natten. Hon vill inte att installationsgr", "tBs\\(O", "EbU.Q6", "o\"$Doi", ": setup.exe / auto upgrade", " toista asennuslevy", "Esempio: setup.exe / auto upgrade DynamicUpdate disable", "xJA;l", ":~yzz", "=HDLN", "D\":_x", "b)5VPi ", "Gdu$;", "y)}^N", "&xO(oz'", "5C#d~", "DataOnly", "rtuseks on seatud All, proovib installiprogramm installimise k", "'h;MW", "7Ji])", "mkv)dMC", "NhZ>i", "CDlpTask::GetActionInterfaces", "ppp@@@@@@@@@```", "&Edellinen", "Stikalo: / quiet ", "&v&6&", "/ Telemetry", "=tj8EE7", "s.,&w", "a%G@$'2", "&E0QLe", "Create", "+nXD+l", ",mbz)", ";X;at", "I):", "*?1Ww", "J'F99", "L$(+L$ +D$", "cZ[D3-++", "QQSV3", "=(=4=@=L=X=d=p=|=", ",0YtS", "{h_R2", "r\"'sY\\6", "C]Twd", "B(*%n", "zey i", "e ako s", "C.UrD", "xeln antar f", "*Ta'P", "7+Ie3x9", "HA3rf.", " name=\"coremessaging.dll\"", ":+v6;", "n no puede iniciar Install.exe", "Primer: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "a(ZZ!", "sa, kurulum PBR b", " el a teljes friss", "uFhi>", ".?AV?$CAutoCleanupBase@PAG@RAII@@", "h88Yc", "6N\"=E-6W", "o a invocar o script setuprollback.cmd depois de uma falha de instala", "n: inserta el archivo setuprollback.cmd de la ubicaci", "{5TD^", "g=\\sK", "0?\\$@0", "l\\zUX", "ti k predch", ">)?A?G?P?W?", "Pk{]w", "products.cab", "d ^vXK", " 2EY+", "&X223!R", "M^cKg _", " : setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "\".!R+", "^'s1Ro", "gI+i~", "ttelse", "T&yTU-", "I#[i`!", "G#Ke\\yUw", "wZTK^", "ka efter, ladda ned och installera uppdateringar). ", "irD't", "tLy2[", "mA;Pz@", "t atra", "9)>N)", "G$45p", ",rL:X", "_y[z[hBf", "m2FMp", "&Oca=", "Bx$Y8", "Visitez", "S6(*0", "o : Injeta o ficheiro setuprollback.cmd file a partir da localiza", "[`mi!)", ": / pkey ~Bq_", "7\\lN/", "$~e}f'}", "Example : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "BPGPb;,", "towupper", "stas naudojimas ", "UnregisterTraceGuids", "n o creaci", "Nainstalovat", "@<\\Kic", ".=A*", "@;pH=", "GsSvmu", "9aCyv", "e.,2xJPlN", "\"w`\\I", "Wr{Kfr}y", "PPHk{", "^5zh>", "t;>kC", "\\iXQ<", "H;Dz@", "[_AUr", "JLNqo+", "AK.^%<", "hI92rr`mm", "-R5C2", "m0#yix", "ches apr", ")Tn,GC;", "js}S6", "s(hmvk", ".?AVIScenarioCtrl@@", "a\\UA.", "x+Q`V", "}FPW@", "SetupHost.Exe", "oNL71", " arabiriminin g", "UGo%=", "aT5-aw#", "adne sterowniki nie b", "Exemple : setup.exe / auto upgrade / quiet", "`'^:sE", "R-9H/", "B&A:(", "-:^5W", "p3cqI", "_Gl r;_", "k0aSz", "OMLvjWcElu", "D8 s&/", "rnek : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "4iNC#S", "4%Z|V`", "[hR6q", "+\\tNL", "s`U@U", "z1d }Wj8", "U{7LH\\4", "{*.LI", ".Zy5}", "LbEeU", ":'Mpv;y", ":':`:v:", "o poder", ",psQy", "\\,m9w", "?GP$)B", "$/n:&", "\\hetA", "qsJZ}", "d9abb", "S;]ts", "zI]HK", "}pdXo", "tX`HI", "Fj@w)", "273>3", "{4~{&li", "Du kan ikke bruge kommandolinjeargumenter i Windows 10 Installation. K", "ciu z okna pr", "#N^,Z", ",@}!Y", "~io-;", "J,@V@", "X2.Fi", "qwIy {", "G-L*s", "VWh`$A", "m, vynechanie softv", "k2\\L2\\|v", "B50Wu&", "ema\"N", "#%0D3P", "?\"tv1K", "a a interface de utilizador da instala", "unalnikov pridobiti dnevnike in druge diagnosti", ":c/E[~", "CK]}c", "wT@rw", "[]N+Mu", "ria: Windows XP com Service Pack 3.", "qPWS^", "[z6fy4", "J]@R[", "=4=N=[=", "Instalace Windows 10-Instala", "V:,Z~b", "th=wu", ":'R9~D", "*rk6W:", "==v576", "ciju no testa datoriem, ja rodas atteice. ", ": / Postrollback ", "MwX'R", "7aF_tI", ";yP=x'", "hrt wird, reichen die zugeh", "%51X~", "Parametry: lokalne lub sieciowe (UNC) ", "r2(+\\I", "U}6T<", "W)R^hB", "vUyQU", "8qzI ", "fh$p,Y=", "nv(fn", "b\"dLD", "iC[0m", "unalnik in/ali uporabnik dovoljenja ter omre", "w6r/&?", "!BKH.0", "bkXuI%", "Hq7qv", ">@[HK", "aucun pilote. ", "iz|b+\\", " la telemetr", "ZR:w^ll", "en-MY", "J?Sv.", "*Zi'y", "`X!4E", "`y..b", "0r&RF", "i dup", "_4<{]", "+VEtF", "eZf\\8", "?g7UP", "GetFileVersionInfoExW", "Defer", "7J.)['hR$", "installation va collecter et t", "e?7vx", "*I/;U", " ,>U", "Esempio: setup.exe / auto upgrade / noreboot", "tor skop", "s|`_c", "Exempel: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "}y_\\u", "3zKykZ", "Q|%^k", "j6Q>", "cqwP]", " hingegen auf ", "u.|?w", "m9Vw3", " operazioni di Aggiornamento dinamico (ricerca, download e installazione di aggiornamenti). ", "F!1r7", "tre suppose ", "&;ReO`<", "\"h\\[0", "]K?I3", ">fCnu", ">7>h>o>", "Zho J", "4]JSw", "pO\\Q}%w", "iFu'7", "WGVYfe|:", "CQY[.", "#JEN)", "}NLS/", "Azione: il programma di installazione non riavvier", "f212G_E", "NKX%*", "3Z3r3}3", "Na primer: setup.exe / auto nadogradnja", "4I;: ", "n uudelleen seuraavan kerran, asennusta jatketaan. ", "o{}G~'", " cesta UNC ke slo", "0JY=`", "YtwZa<", "]a~(Ip", ";.b\"w%", "Q}Jf+}(G7", "kgZ<1+", "om re", "6/3&iG", "45$MC ", "Windows 10 Setup%Windows 10 Setup wordt al uitgevoerd.kDeze versie van Windows wordt niet ondersteund. De vereiste minimumversie is Windows XP met Service Pack 3.", "?1?B?G?M?", "id-ID", "cE#k<", "0T?e:", "#[bM&", "tp04V", "8Y%=dWS0S", "Lq,'x", " 'QZ@", " niveau Windows. Les arguments de ligne de commande suivants permettent de modifier le comportement de l", ">)G~*", "Ejemplo: setup.exe / auto upgrade / PBRupdate disable", "_TM\\_", "8!8(8/8O8V8]8d8", "_`#]+", "~?uWo", "`;'`K pl", "JxQR^s", "I@nAt", "v4z1+", "ScenarioCtrlHelpers::SetStateInRegistry", "$*(HII", "v.KMF", "]L3B9", "jHiDZ\"4", "{I0ng", "t3C;]", "UW^JfL+", "PaIsj", "='>v>", "\\8|4n", "_jV\"o8", "ete n", "9E9_9l9", "~e~\\-", "/[.l7", "wo-SN", "J;M-p", "j<#<=", "Va\"qO)q", "@ZpG+", "lne prejs", "q~_!Q=", "@Rmbe$", ":;}3<", " %s: %s", ";q&slK", "N`tAn", "~Q|0%", "}G:DH<", "-?S;Z-", "d:^Etw", ">NK9I%u@", "PPP@@@@@@@@@ppp", ">ug~I", "%6WU@", "2{g1Zf", "&5e@}k", "Aq/R>", "2_$\";", "Handling: Ved fejl kopierer eller overf", "W5{D:X", "9bK\\lJvAc", "bZav]{", "#cP6'", "rmG9M", "(-'W3", "Prebacivanje: / pkey <", "ete mo", "s4?R'", "Z9h:m=g=", "e et les composants sont d", "*)x}!", "?Q2!c-Z", "4gU$$", "F ", "/`f6C3", "*i}9?", "WS}$/Hn", "#YAnX", "Unable to hardlink: [%s] -> [%s] (not same device)", ",]NnY", "jvuj3", "wxbgV8", "WaitForMultipleObjects", "H@\"d ", "AElKI", "ey;$V", "rPw4X", "i1rTH", "HE'|j", "rstegangskj", "+e_ca", "*}R#\\]", "e prikupiti i prenijeti telemetriju koju je generirala instalacija. No kada je / Telemetry postavljena kao onemogu", "<|_+V>@", "4OKl0", "1nija{", "9)A9N6", " chov", "metro : / showoobe jc", " @@@000", "72:I1", "anas programma jau darbojas.q", "sr-Cyrl-RS", "c&g:pg", "j>W@^", "j/f7X", "v#R'.", "M+\"Fd", "nOJa%X", "dzie ponownie, tym razem wybieraj", "?R29dLA", "rQK-9U", "FH `d", ";)nYO", "nlV}7mg", "i+>aT", "QnHJV", "#0t6+%B", "=fB-\"SN", ",IZ '", "/Boot %s", "rksadgang til den angivne filsti. Kommandoen k", "q!k]G", "vnu architekt", "`e$?C?I?e?p?w?", "%!_^R", "6Kz.Iq", "o9X`m", "$5oO\"5", "(dgq(", "6q?q/", "^Intenta", "lPc`-6", "V~R`Z", "$[GX$8", "x&0|U", ".xmK38", "E+)9k", "oq9uV", "Bb!'!", "LhRVM`", "O2R2}2", "his alistab mis tahes installiprogrammi UX-i, sh tagasip", "DUO>k}", "Wm/~?", ">F?xS", "Bv?IP3", "h/n,hiS<", "una da izaberete ta", "<+<1!r\\", "SCef:/}", "9Fj@}", "t\"dv:", "0}RNv", "9Z.'r}", "hren.", "*#LUDm", "-p:s,c", "E5l.a Z", "rbereder installationen av Windows 10#Installationsprogram f", "ki programi", " wszystko b", ",xp(o", "nMZjv?", "0PsRW", "B1_SML", "hxu2T", "kkulcsot. Ez a param", "JHCpXE4x(", "ole32.dll", "WE:2|_o", "es para mais informa", "r du opgraderer med volumenlicenserede medier eller medier, der indholder filen pid.txt i kildemappen. ", " a mo", "kynYg", "c}9M=a", "rma komutu verir : ", "4d2Hb", "j9uVQ", "{m@Eq", "'mGN41", ".[SFN", "N1&4Yv", "=u!+yZ", "X6b.M", "b=Ssg", "\\IH[hUp", "xe\\|,F", "!mi=^G)", "6?6x6", "=r\\H>", "-.H>^", "% TeO", ". Lis", "Voorbereiding", "T~/_Ly~pe", "|&CG,", "(Z.M2=", "i instalaci zobrazovalo u", "%+;B6", "$ zx?", "Iz]~-", "-l*q0", "*\"V-w", "/RollbackUser %s", "Nq-X;", "|0)[p-", "jsist", "#6_ePx", "jcmg", "/b*kB", "<{*\\]{", "$bYHi", "35Ne6||", "Wa2[m)z", "S : Ezt a kapcsol", "kc2zT", "B-vHCsC", "0_04X@bk0", "BoxMovePath: Using target path [%s].", " UI-spr", "8{3;$9", "Tj``hhddllbbjjffnnaaiie%", "CDlpRegistrar::CreateAction", ">d`CM0", "0h0m0", " possibile avviare correttamente il programma di installazione. Riavvia il PC e prova a eseguire di nuovo il programma di installazione di Windows 10.", "7!9Oy", "7(7-72777<7A7F7^7d7~7", "Preparar", "idla. ", "/Pw}q", "ss_8=", "f:UYpU", "!vN8.N", "WxK)t", "azR*%", "/]i~d", "x~V!*d", "NGdiK)ro#X", ";Q!/Y?&z", "u4>Z!GE<", "stup k zadan", "=kxSU", "2`S)%", "[j&kr", "&zqrjq", ")coL5", "e izvaja drug primerek programa Setup. Morda poteka posodobitev funkcij. ", " s,IRP", "CSetupLangIniLoader::Initialize: Language pack file: %s", "<\\t4f", "zF4AEPdQ\\0", "rja be az eszk", "CMediaScenarioCtrl::PopulateWorkingDir", "Uc#qT", "[2AbN", "CDlpRegistrar::RegisterActionFactory", "znw'HK", "[J<#t", "q@..A", "o pode ser iniciada devido ", "llil|^", "/_i/F", "9:9A9t9", "[k^Sh!~", "&:uofw", "R%'uj\"", "G%=El+:", "wm+(tY", "rYT^wk", "# D`L", "fL_CvZ", "gd ]5L", "i>1qq", "m=&l5", "o de m", "ig-NG", "liti: / installfrom ", "181UZlgFzQ", "\\~*n)", "'R1^L", "N[)Y5", "p(pJz", "zlTAf#", "NQj+4", "https://go.microsoft.com/fwlink/?LinkId=530045", "uw'4ZkU", "m(S1X", "~$\\oA8", "Fb;@R,", ";$;,;", "po&&g", "/+;ToN", "[Ex\"E", "Exemple : setup.exe / auto upgrade / noreboot", "Jw|Da", "Dge&t", "-_~HD", "PYa1TP", "^mYaH3i", "cd#PpG", "e+cCK", "rA7He", "yg@`8", "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x", "Ft&[R;", "AO$r^AO", "C1vTh|$", "PB/FH", "):jol", "turulan telemetrileri toplar ve kar", "6=\\oKm", "`fMR2", "LRuYm", " a v testovac", "w,Y'rV", "PO~sA", "e#C|Q", "kYJNr,", ">lWw\"t", "} M+", "sit p", "Y Wne", "{qW19", "shoz olyan helyekre, amelyekhez felhaszn", "Q)3=U", "}L86l", "Ze}D}", "=mwA'", "Sources\\winre.wim", "oNwC6N", "#g#m2", "Uu%2,", "les installimisega seotud telemeetriaandmeid. ", "}Yy7Q", "CAzureScenarioCtrl::DetectResumeMode", "\\\\n+w6=6", "lXkf7", "JJejss", "lti fel a telep", " DRUr<", "gaRrvOZ", "stroj zkuste spustit znova.zKe spu", "x:|x&", "wv;?9", "ukCk7p", "x}N_s", "BA.LkJ", "6F-3%lX", "[Yqv__n", "/@$$?/", "6!7_7l7s7", "6xh@d^", "!MrH(", "KRSO[Z", "xaf_{49/", "dwgu1", "ajte ponovno pokrenuti alat.iDa biste pokrenuli instalaciju, treba nam najmanje 350 MB. Oslobodite malo prostora pa poku", "%2SYY", " pidgenx.dll", "R7j/q", "s de que se produzca un error en la instalaci", ", negal", "]mq6o/", "nite miesto a potom to sk", ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@", "EtXEG4", "w", "O/6 5", "rket med %s-bit. N", "CDlpRegistrar::GetResponseFactory", "T#'rYt", "^6~X", ">W@H;", "l0WAn", "!%&WY", "S\"=@Z", "<|;]h", "{b<|DQ", "V5]G9", "Ae~E+", "[}sp&", " level=\"requireAdministrator\"", "n desde una ventana de s", "Schalter: / Postoobe \\setupcomplete.cmd ", " name=\"fltlib.dll\"", "Qp'i4", ")eoTn", "VSjb3M", "R?b `", "]1`A=", "e da utvrdi jezik korisni", "@#~\\}\"", "z+eYk", "Config", "CDlpManager::GetTaskCount", "b8p9`QwA", "kernel32.dll", "nainte de prima conectare a utilizatorului. Ruleaz", ")jJ;|2", "!;8V11", " x1I\\", "n de Windows mientras se est", "CC|", "9 9-9K9e9r9", "th6e=", "3\"U2\"", "nds som parameter f", "\"Z6WG", "TYMuI4]r", "3op", "si[Y_", "pk=_aE|*", "~~[IK`", ")=\"+#", "9]L+.", "G_w^ti ", "CDlpTask::CheckUserInterruptEx", "t 64bitovou verzi n", "Commutateur : / quiet ", "kler.L", "!PbpIt", "SetupPrep.pdb", "|h\\oD", "$|O'S", "O4WE9", "| fql", "Setup wird vorbereitet ", "d_)~Y", "!$rk", "_'o?]", "om vstup pou", "U,5rp=", "PP@Q2I", ";rMd2I", "Rk&Et8", "5(/|%", "]2Ij+-", "[xU%{", ":r!0l", "woOo}L", "}($_P!y", "+I}UK-", "1u2De", "IDR_SETUP_FONT", ",Nqm0A", "*>e~:7", "}~hqIRM", "Na primer: setup.exe / auto upgrade / Telemetry enable", "CSetupLangIniLoader::Initialize: Cannot set current directory to '%s'. (hr = 0x%x)", "iYjYfi", "xZ<'v", "RuwO;", "hltAO", "yMN\\C", "e u kontekstu sistema, pa mo", "l|pov", ",&H^K5", "ZnQfO", "vLN\"Q", "Udu3._", "za&>M", "y|ppy", "Rb21$", ",&IW)W", "unarom", "E-ds2", "YZ!E~", "8OWM<", "tfen bir Komut ", ".?AVCSetupDialogSplash@@", "zJa.g", "d/", "F`R%2", "j.Yfr", "6D6K6u6", ")~WS4", "2}8A!", "oVqh4n@", "ak maj", "eQw}5", "jIeh(", "@q1UWL~", ":CwWK*lS", "TV.@3", "jra az eszk", "e!0`sa", "~pc{)", " diegia sistem", "8Pa!p", "Naozaj chcete skon", "o(xBTx", "*_Ot[", "TF83kt", "\\ ('aE", "efke&", "Remapping DBG_TERMINATE_PROCESS to MOSETUP_E_TERMINATE_PROCESS...", "\"+vMr", "_\"6 T", "6( g\"", "+!O [%s]...", " z navedene poti. Datoteka ", "1lV((", "Odj`iof", "#4B_i", "1?3]Z", "w&td9", "xhB5Rp", "ch dat, p", "$p~ro", ">{?S}", "SetupDU files found in CmdLine.", "%erw]", "]8@K:.", "8\"=0oz", "diom alebo m", "%3kYwc", "Ji 6,", "6kk3C", "ka 64 bitu versija. M", ",ev6'", "uwkwP9 ", "ag/D+", "_iLXk", "b{?gW", "njo prvega zagona. S spodnjo ukazno vrstico je mogo", "n keer gebruikersinvoer vereist in de", ")C*g`[", "===i=", "qOF}@", "M^-e}", "d|cSt", "JE,#G", "*UA;H", "pe69;", "ke programe u sklopu instalacije. U suprotnom, ako je / migratealldrivers postavljen na ", "d{W_`", "/J6Bna~", "Oi\"t$", ">:&r[^", "1~psDv", "A:Heh", "F8p.z", "@hR)'", "[/Ol6", ")W<\\w'C", "w@N8N", "bcooy", "rITNM", "WxFg|", "8YZdK", "#r[HH", ":V%V(I[yu]a", "o para Windows vNext, requerendo a interven", "]^au$", "l EPvm", "/g~Oi", ". Setuprolback.cmd est un script personnalis", "~*17%", "]\\oI6<~35", "|}f=e>", " telemetry ", "&Y36Cya", "9jfRw", "$4C =", "_n2hV.", "tS84j", "LB};\"", "ojcn\"", "na#u-", "|r;1|", ")`KdI", "yyyooo@@@", ")o!.U", " \"%s-bit\". ", "3P8BM8A{8@", "Na primer: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "#Y`$s", "lVJ7.", "d0lZDN", "Re\"y5", "r / PBRUpdate ", "]^c[7", "QIz70?", "'$:n;q", "Se verific", "[#ogr", "9 9(90989@9H9P9X9`9h9x9", "Error launching rollback command: hr = [0x%X]", "5%\\SS3+++", "AjhCG", "FBf;E", "{6>ewk", "Y<5s3", "XW*i-l", "^uOxB", "`xMWK&d", "7|OB2", "xKicr", " program sa nepodarilo spr", "?0#1~", "*Q=|)#", "$hmtxO", "'028x`", "u^AvW", "Q!y1`", "2Y\\!G{", "+i=cq", "Vi har registreret, at installationen foreg", "]rC90", ")_D>Doq", "fz0ma0%", "i+$b$s", "lck8^/T", " Enable, ", "GetObjectW", "ci no", "tmenetileg megszakadt a h", "Bz Ws!", "&36X$k", "*ob_kN", "ytkownika). ", "JNyL[", "x;IUk", "gj .a", "Or4P_", ">/R9^-YE", "XkRp4", "aT937*Un", "NtClose", "Segoe UI Bold", "fX[(Wlx", "Toiminto: kun valitsimen / showoobe asetus on Full, k", "OWSO|@", "JK#JwQ", "~Np<%", "JT%C?", "R2/h`", "xc!$Q", "4(B~&", "dmKYna", "O?[`6Bf)y", "spJvE", "<'z\\Y=", "pRYo`Y", "!4=_}", "C,8)A", "S8[/e", "Action : En cas d", "H O\\\"", "~d`(B", ";GC]he", "Parametri : lokalni putovi do datoteka i UNC mre", " mancano alcuni file di installazione. Se in precedenza hai avviato il programma di installazione da una directory locale, copia di nuovo tutti i file di installazione nella directory e riavvia il programma di installazione.", "pq#A`}", "<&o5H", "s Windows Update lapj", "M22KSLh", "37\"8*:q", "3=4J4Q4", "9_\"@^-]4", "MHiYV}", "|276%", ")j\"RB", "6`qC\"", "\"e-Nq", "iihuu", "skor keletkezett telemetriai adatokat. Ha a / Telemetry ", "Install", "SW=zz'", "uXH}8!?", "qHI>/", "787Wmp", "?qX D|j", ".\\bc;", "#:mWI", "kyX+x", "73$eR\")Jv", "@gFVWbL", ">RvPb", "o0V0[", ",Rb$V)J", "n 3+P", "&[FMN_", "mU6Mg", "Vj>AL", "%O7b(`yBu)", "oxS:[@", "WD/hL", "${Y{*", "uW0~0W0_0;", "HqcUj", "g>f:y", "trehoz", "e pokrenuti Install.exe", "DoGL,4^", "fremdrift", "ulx7p", "?CwMw", "bB[)L", "1d;ue?", "@Kj?P", "rX!V5Tbs", "&OdAl", "]{`SU", "7x9*x", "3Gd,R", "}T{Bs", "J_ig/", "[ X!XK", "]qXTU", "|UrUgpv", "=Bg{j$ol", "-3Br_F", "Parametri: 5x5 produkta atsl", "f}NY/e~", "ACQ9,", ",tq;n", "{kN^UV5", "-l<-/", "V21P+", "vdssC", "x}}]|", "installation. Ce param", "v.n4b", "Pb\"q4", "`5q6ts", "^o\"\"s", "SN1uqc", "Tikrinti suderinamum", "??1type_info@@UAE@XZ", "outil. R", "tett napl", "|OyrN", "0oM&v06", "d!w+P~", "dzis: / copylogs y[3=94", "m[HBG`", "E`T0,p", "ZNf3N3", "oqTVY27", "f2AQh1", "m@2x>", "p/=)_", "h1", "u[u\"\"", "X 4%mC", "F,FSK", "D9&mLb", "pIJvX^-s", "JS$=x_>", "iwyZ-\"w", "Program za instalaciju sustava Windows 10 ne prihva", ". %1!s!", "GetFileInformationByHandleEx", "uQ\\GB", "Jq.s#?", " parametr Enable, instala", "ZK,-h", "Rdn", "$31zN", "%SZFw5Xq", ".a~ov", "4zH1N@+", "9PUG^", "H^s@9b", "{5Nt.", "RZ/'wm", "$o0&$o", " M7m%", "*kYe=", "Prenos", "racijas: sutikimas su GVLS, dinaminis naujinimas ", "?r)Wv^O>", "1UwL-\"", "N[ 3vS", "j\\2[Kw", "mi vybran", "P6SR&", "com escolha de migra", "7\\D4p}$", "Preveri zdru", "G,1$l", "r komponenter. ", "q:l0?", "E/u1{", "WC11\"R", "s vai aug", "^Fp[T", "pnh+z", "Lb\\V>", "`1DsVX6", "Continuar de onde eu parei", "|c@>9", "*/{k2g", "-tnqa", "1hgHZ_", ":NgO0", "#@M,q(\"L", "[&D5Op", "#>*>!", "1=cox", "Xlb5E(y", "'gMnu", "%Ij(IRCI", "5'.6lr", "Dqc>cY", "dv-MV", "p+)jb", "Exemple de sc", "We2xb#", "paration en cours (%d%%)", "N\"GIO", "kiR0y", "aYd=L", ";r$wK", "ciu na Windows vNext (", "_bY4K", "X2IJ0", "4DNsU6", "y2|Yv", "?yqnn", "luv;')", "ho um", "THCzHU", "!72c?", "4DNt5", ")HQHA", "Action : Lorsque / Telemetry est d", "iQ(Q}", ":3K|N", "e, mais avant la premi", "Intfgp", "YLP=Y2@", "z/7zWpN", "componenten. ", "+Wrro", "@c8ul", "*o}uUU", "8'hOU", "Parameters : 5x5 product key ", "qnmoD^:", "sDve`D", "\"o!~I", ",~DH]", "installation de Windows", "J[$/[", "tW*N#w", "shuYZ", "gp^_s", "Zg%?o", " naujo paleiskite kompiuter", "|YcQj", "c=+,VD", "SetFilePointerEx", "7eY2A", "juma, bet ir automatiz", "H5^b?", "s a falha, a instala", "CCY+<=g", "40}4\"", " k verzii %1!s!. Chcete pokra", "CUiVkZ", "a]gY{s", "velet: Bet", ",CnS%W", "$A6t6", "jHq#j", "6*?&z", ";l~j;", "HP(b}QQ", "F$%As", ":MdSpt", "^!tA)", "2k-sf", "e=\"xcYO", " naujo nuo prad", "6ig#j", "x2wfw", "(^QQL", ".h9tUo", "ed\"", "vw>\"x", "QD+|u", "k{d9XG", "C/]B4", "JtF#y", "^(-G|", "-JmCbr", ":|]8[Z", "VlxJQ", "LVt*>1>", "@nN^K& ; }", "rHInstallationsprogrammet kan ikke starte tidligere installationsoplevelse3Installationsprogrammet kan ikke starte Install.exe", "NL#x^\"", "Pn<-d]", "`iCzi", "qcf9;3", "logging. Det kj", "EKG$Uw-S)/", "n]#\\A", "", ":*:a:", "6SC%i", "Xs}na-", "'Zau]", "Pq[Uj|", "1Sq{}", ">lX x|n", "Yhteensopivuus", "CF! Id", "GetLanguageMediaNumber: LANG.INI not found. Path = '%s'. (hr = 0x%x)", "KuXs4", "N0C=x", "G?-E3o", ">l", "56'vh", "rer dynamiske opdateringshandlinger (s", " CNl'", "X]pP23", "s de progresso de configura", "ppp@@@ppp", "1 151F1c1", "r+~;I", "lgende kommandolinjeargumenter kan bruges til at ", "(Vl+!", "yp2ME", "hgX-6I", "8+8N8", "Przygotowywanie", "/*R!#j", "b$Wf!", "tson fel lemezter", "6t0\\z", "!KDA6", "0_0)R(uq}", "|foS8aFE", "&:4^uu", "elite li da nastavite?", "Btykd", "Z:lf7", "JWK/z|q", "", "pR|0I", "]my\\s", "File Not Found: [%s]", "=y&cV", " o crear", ")o)aA", " 3%7k", ",'2[}", "3=- 1", "I$L/>C", "2m#^7(", "=7NhE", "lEtJ)k", "jC;TP", "Pmb.q'", "C#qS4n", "9':A:N:y:", "JGS3U", "5S6Z6", "installation. Toutefois, lorsque / Telemetry est d", "e1H$ ", "dHkq%V", "/;De\\l", "3.1Sg5", "\"s6k-", "(;QVe", "I@0+S5c", "}^Th#>1>8>\\>w>", "eS4DSi", "mTOoW!", "o executar", "ndige Upgrade auf Windows vNext orchestriert werden, wobei nur bei der Einblendung der Windows-Willkommensseite auf dem Computer eine einmalige Benutzereingabe erforderlich ist: ", "LpEkI0", "8M#6F", "re Windows 10 Installation igen.", "6SL%G+x", "\"lan?", "}'Vy=", "cijas ", "+m%76", "&[B{PS", ">/`uB", "031o1", ",;Z+]", "\\~yyxX~", "lr& 0$", "fa],`", "LS-fZw", "RegDeleteValueW", "T=Qu5", "PB7/m", "|F]k>3Q", "Q0l9N", "at{m%", "5l+aA", "0d10du", "ii)Z1", "]Ipo]@g+", "ra nezodpoved", "|Bof0", "r{N}-", "\"@AGG", "Cc!wWpXHy", "MVVn}", ",LTK}~", "_cexit", "Kh+Q?", "VHbEW", "GcT/*", "r automatiserade. Den h", "DG\"E8rv", "t5% w", "aoYr^", "R'`i", "tjjTO", ", URI", "b*d+;", "n*lS|", "),KyC", "%9Vdf*", "e ne correspond pas ", "Sleep", "T-SWfl", "ckldM4", "AIVnb", "WW9CC", "RegEnumValueW", "&O)w&", "K(Nl2]", "hU^a", "S?3rMH", "`Yp&SOV", "em PC-ju", " [r8D", "49->!", "%qktN", "ga-IE", "N:~\"pI", "paration", "$?5srP", ">YYYKKKp", "5qw?J", "8P3H<", "7/FbA", "Exemple : setup.exe / auto clean / installfrom d: \\myWim\\customwim.wim", " uiAccess=\"false\"", "Q&RVh", "VMRP{", "EvKWW`x", " le programme d'installation ", "7,f!u", "~qP}&", "y2dnA", "Im9#9s", "^q1jy", "}gk=-", "ndarbeh", ".>a\\|", "s val", "+!8R(", "&Mx@p", "SVM/\\U", "Z&j2[", "^*|`dkth", "Un;o2", "c*f1O", "Windows Setup se zaradi manjkajo", "6b2t)", "zh-CN", "Pc!xU", "Ftd;6", "&y[,\\Mg", "'mD2.", "5W@TY", ",#!\\", "mOHHp=O", "Iy%W ", "W10BP", "YW0_04X", "rL0W)^", "H+7G#m", "ASc=I", "'R@QO", ">%I~i", "cy na wykonywanie zada", "5f*6f2y", "tor sa pok", "Sklopka : / noreboot ", "]%.w$W", "v derefter igen.dHvis du installerer denne version af Windows 10, kan du ikke g", ";qga:", "io_S4", "lt'kL\\", ";&8)C", "F}Y{_{P?", "pp!(|", "^ j.DJk", "+=I24", ";D$4uV", "?AnAm", ".text$di", "b'|olB", "emplacement des fichiers/du m", "elje medija za instalaciju zaslon s tijekom prikazuju se po zadaom, ali su automatizirani. Ovo prebacivanje tao", "!I6K[s=", "l[el6", "5(6R6o6", "4A}Rk", "N'/x4", "BEmK", "CDlpFile::GetName", "r%a^b", "3jUEV", "tw_X~", "Priprema %d%%", "es noc na odd", "ac2+6$", "FzpB]", "D#>653[", "\"XWDVD", "n{t#\\k", "%s /InstallFile \"%s\"", "su atlas", "qw:1r\";", "SetThreadPriority", "zIx]&oiJ", "LioaR", "hW!{&", "zvQE ", "5-5G5T5z5", "4+5X5", "; <: ;3./V", "rIGrR", ".[1>#c", "%.p~ds", ";(;3;b;", "2=4C4I4O4U4g4", "hU1]>", "ih7q0", "6'gwH", "Turpin", " zgodno", "s az ", "buj uruchomi", "yl'>?", "526R6n6", "O@Pj Z", "E!k29", "s kopijuoti vietose, kurioms reikia vartotojo teisi", "PQ}0H", "h.nii", "(WrXO*", " @H!BXo", "T3\\*q8#", "1S,n_9", "zDe)lsn|", "cie. In", "xr8Y`", "n especificada. ", "\\CHUG", "*y!i)m'", "6~KcM", "Toiminto: automatisoi asennus k", "GCFc/", "knak manu", "0@ $A0", "n>$pp", "KAG'\"", "call,sn", "installation", "trie, ignorer OOBE, mettre ", "Ph|K@", "0nef9w", "8\\N6\\", "ru-MD", "$tJoq", "2La arquitectura seleccionada no coincide con tu PC", "+:I>09", "f*rT^", "paration de l", "i4aJj", "tl,J=", "XiEXR", "Yoi'9mF", "4M4ZL", "ioqL{sD{", "2d)$o", "P4Om(xq", " Linie de comand", ".eA!s", "P|4'7u", "494n4", "rl;sv", "#Jv@v(", "4$_HA", "mDnvB", "ZY*Gl", "h|=AB,", "RkFlZ-", "AgJ>]", "res med de samme rettighetene som brukeren eller prosessen som startet installasjonen. ", "z6a>?", "8ldm?", "&sohO", "kZ,dP", "*vNAyf*", ";{\"#w", "i instalaci neaktualizuje ani nevytvo", ", suorittaako asennusohjelma dynaamisen p", "wbO\"y", "T{$,_", "WPTX`t", "heq>`", "?+hIv", "CSetupPageResume", "FD_Ju", "EYyvd", "D`:8E", "jPd'|", "From RegKey: SetupDU files [%s] consumed - bSetupDUFromUA: [%s]", ")Z\\\\;", "qQVk~", "/|&8klfymh", "Moz16", ".idata$2", ",IPo.m%", "{<'Qi", "cific", "Ptd", "hilduvus", "D0~0Y0", "Y} dL", "sy verkossa. T", "iQ\"dJ_'", "O!ly ", "uu[mW", ": / migratealldrivers", "c]D]7", "d|iK%", ",1qkcx", "7M9?X", "mcL;08d@W", "o: / Telemetry t~5", "Konfiguruj", "w\"[q}1O", "k,t:Y", "metros: caminhos do arquivo local e caminhos da rede UNC ", "WJ7f~", "MV5kS", "TrA?5", "8H=IM[gM", "\\CA{@/", "D$DPj", "I!gdk", ";#e-7e", "x>[A]", "Pavyzdys: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "T!UK5", "tJ\\iQ-", "He:`8", "0g0W0_0", "xS,/U", "0oNwQ", "z91}Gt", "11>Me?", "]r=UG", " eseguita la migrazione di alcun driver. ", "rA^t,", "y^W_}Q", "t:C}4M", "jb;N[", "*[/sYdz", "Waiting for Rollback to finish...", "Hv+/8b)", ">R3k9", "rs ingen insamling eller uppladdning av installationsrelaterade telemetridata. ", "Mda]c", "c[xjU", "dDw;O", "21\\I2", "8Bq/+_x", "CheckFileProtected", "rnek : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", " su bendrojo licencijavimo laikmena arba laikmena, kurios ", "`]tgb", "/gEzt%", "*\\Oc6D", "stico de computadores de teste no caso de uma falha. A linha de comando a seguir instrui a instala", "U~}NC", "K)", "G72M(", "\\gNd4", "ho pou", "};4n&", "x\\JT%\\hb<", "vI1/Jw", "DlpTask: Suspending task after transfer...", "ZK/J}", "2BLFP", "fwxJZ`", "O>kj'", "!]`V[", "Sh@x@", "-?@u ^", "\"iHZ\"", "jl, amely a meghi", "O0M0K", "\\StringFileInfo\\%04X%04X\\%s", "Primer : setup.exe / auto upgrade", "lreiz.^Ja instal", "realloc", "vel iniciar a Instala", "hAXP\"", "io-w'_d", "|NsBl#E", "Sr 2x;", "t4O/9", "installation correctement. Red", "3&!\"&4.", "S3]7I", "E~Qf,", "Sm$$W", "xSy.n", "jG=L[_", " aT%u", "H?/@S", "Bryter: / migratealldrivers ", "$$$0d~~>**", "0+<%i", "=.qv{(", "VK1WX", "F2G#K ", "[, x*", "MKh#+", "ActionWeight", "'d]Ug", "mft|G*;", "TransportId", "p~ KP", "Vk)h!", " sami manu", "?(?8???o?}?", "W{]gj", "^8U)z", "P\"IKd", "E|60=1", ")&ir*", "che kann nicht bestimmt werden.", "Akcija : navodi lokaciju za instalaciju izvornog medija / files ", "3(&Rw", "n de los t", "LX-Cp ", "Sn]P6", "Lg{x8", " by the loader from the system directory.", "[BAJQ", "affichent par d", "rpe[5", "eV%WB", "Hzv5~", "lqvqL@", " \"Disable\", ", ">[EtQP", "7gX&d", "Primjer : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "noga mjesta i da je nai", "1QU/E", " peste noapte un upgrade de la Windows 7 Enterprise pentru PC-urile din departamente. Nu vrea s", " v kontextu syst", "site gr", " name=\"bcryptprimitives.dll\"", " DiagTrack.dll", "bjmZe", "Parameters : N / A ", "W|{IM", "SiteLink", "pStopSetupPlatformETWSession", "(p5XL", "~i}K,", "metros: ruta de acceso local o ruta de acceso de red UNC a un archivo llamado setuprollback.cmd ", ".jItJ", "\"\\@,$", "zelle", "HJO>`", "D#}uM", "yAsennuksen k", "sokat is felt", "tU~hF", "&GsVz", "7\"7,71767@7E7J7Q7V7[7b7g7l7", ")4Q_h", "6f_`y", "~yT <", "dfS:[", " suorittaa Windows 10:n asennus uudelleen.", "='=.=4=D=d=m=y=", "=`>g>", "uEk|~", ",>T.5", "~9z[n", "ugiwana. Minimalna wymagana wersja to system Windows XP z dodatkiem Service Pack 3.", "o foi poss", "", ">E]r>GX", "pVR5pP", "^ ~:?", "Iyf)^", "pK$W'P", "metro n", "^IcM|", "/M|{*", "Q?*]Yr", "(m`ex", "y\\z5HQ", "inf\\setup.cfg", "e}T(&", "Z)i2/", "y!_8#", "8te-2-", "tP0PL", "!`>*\"", "@GvXh", "2aID+E", "ShT+A", "vS~mfrVF", "GT3]Z", "n%u2E", " komanda darbojas sist", "\\QLps", ":-:[:a:", "5a0M=", "Z?^j-z?", "Operacijski sustav Microsoft", " V47L", ",A~g/", "1ZP>z", "7(7<7A7M7o7", "CNc e", "j*18/", "246y6", "k]'Td", "&$b)U", "P'2>w", "EdI?CC", "rkAbK", "sG1$>*>/>:>I>]>d>", "XO3>?", " Enable ", "6tJsI#", "^vqB`", "RegUnLoadKeyW", "&^9Cy", "NQ8IL", "Zp:t8", "ll a Windows 10 telep", "n seguir", "Wr9m$", "\\b^ky", "jet igen.yVi har brug for mindst 350 MB plads for at kunne k", "v|>AWF", "ruuv>", "2Voer Setup opnieuw uit in een opdrachtregelvenster", "vI^|v", "\"cwf9", "<-,pD", "212HN", "en-SG", "adi)p", "r versionen av Windows st", "lasztott architekt", "5#AV3$Y", "^k;K*Hg~", "}0}F}.", "f!+TQ", "\"Yebn`+J", "ajte ponovno pokrenuti program za instalaciju iz prozora naredbenog retka", "7hB{X", "TranslateCharsetInfo", "=3{\"L", "en, n", "9%9;9H9", "kazovom riadku spustite v kore", "?}Aptikome, kad ", "t>\"-5 #", "ZL2h2", "G;|Ws", "6Po$5", "7],{H", "~65\\-", ":i;x;", "CDlpTask::SetCallbackRoutine", "IRcSX", "AcquireSRWLockExclusive", "9.", "7Gs[PA", "7Q|JNf", "fa/5Wm", "rm?]o", "}\"xDYv", "o. Por outro lado, quando / migratealldrivers estiver", "97", "D3RA+", "v^UZDT", ")eZLyAYT", "P^8v>", "~Vw.'", ".:'Z0", "vkS#(", "1+2<2B2c2s2y2", "ovRn_7", "65EX}", "jmtnx", "StateMatch: InstallScenario found : 0x%X", "e+E3P", "?!?gT", "Download", "5 &Rh", "W]B2<", ":QQ8M", "[Owv*", "xTgq)n", "V'@@\\) 2", "m[l>1_", "es para obter mais informa", "{hl%|", "m nastaven", "o_V*b", "Setup.exe", "2[{^rX9", "DlpTask: Suspending task during action...", "eX}&G", "tJz,U", "-t}EE@", "Q!7s_)", "Soporte", "&}9ps", "=2FUq`q", "w06>Q", " ", "s$O@kJv", "metros : Upgrade; DataOnly; Clean ", "o!]Bm", "L{?+pV=\\X", "Td>X5", "YYIAR", "0(v/W", "I^bA!H", "=y3Ty", "M=('YI", "sKl#r", "ZVE6%", "fB:=\"", "Q//J6", "*zl_n", "&SRuWG", "labilir", "! !$4", "e|ciLCYLcilCYlci\\CY\\", "SetEvent", "d4%MR", "@@@@@@```", ">%>.>:>h>", "}iZgn6", "[%9\"8", "mVjPmr", "jNQ\\l", "WWWWPRWh", "ruHfHs", "ini alg", "!wT|<", "@ox=O", "H`v?V", "{;*F7", "naIAI", "cV}@9", "Bm\\[_", "emBuUv", "tJ\\e&i3", "Opzione: / migratealldrivers ", "qa#J#i", "7s-m]FiJ", "zT 2toj", "r+O|j", "e prikupiti i prenijeti telemetriju povezanu s instalacijom. ", "&Odustani", "2|'X0", "mx|V;", "o%;7O", "7k2(7", "N|$v46", "}ES@):", "CDlpTask::GetParameters", "1?#Eh{", ",qFPc", "9]>j\"", "Ql`Rk", "u),c}", "Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}", "92ZN,", "QnTmS", ". Prisiminkite, kad kompiuteris ir / arba vartotojas turi tur", "gfQ}~", "('v.b", "sg/{<{Bv", "o8cE-A3", "14p%;", "Esimerkki: setup.exe / auto upgrade / postoobe c : \\komentosarjat\\setupcomplete.cmd", "vs% ,", "zM7U/CK", "Fu;\\x", "Err_;", "x#?z#", "c0DC4", "{Ms68", "+wGMU", "/gg:JLGM", "\\=nR<", "*c`zk", "$*^:U)", "ppp@@@@@@@@@", "g~bn0o", "=ZFFX", "x(p7hU", "3_kab", "((0Tl", "installation ne red", "rankai i", "7V'-l", "Vj -C#", "P4]wp", "+p[.<", "Akce: Ur", ", namestitveni program posodobi ali ustvari particijo za hitro ponastavitev. ", "D]A~@", "gT&p'", "q>d(oo", "]AGoF", "F<1g=", "e se pokrenuti dok je pokrenuta neka druga instanca programa za instalaciju. Mo", "Z~q7:f", "KmXKT", "bO@jc", "BCryptFinishHash", "exOovE", " /*N!", ")t6@o", "@C7BF", "R;s'^", "{P\\eK", "", "424b4", "d*:bA", ",ote+", "CSetupLangIniLoader::Initialize: Failed to get the language media number: index = %d. (hr = 0x%x)", "le.Qa", "SSSSP", "}Jx'_v", "Yb,c6", "'0h:%)h", "Jk+LH", "145][", "5)_=8^P", "V? {NL'&", "$#%U~Z", "bn%X;", "Te<^O@", "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> ", "^TBBi", "0%u;T", "rer i systemkontekst, s", "RNe_d", ":MdLcu", "6u0;\\", "cXf\"8X(t", "9o\"Z>", "-9tY}=", "$Euz+", "M|w0<", "a1`*6&^", "9fI/dK", ",2MLb\\", "KVk1|", "s2m}F.e", "h'5N]", " harddiskencInstallation kan ikke starte korrekt. Genstart pc", "3hldBrU", "EktSh", "(%QJy", "2Z5Aq", "cGV$~", "Oj_e#", "bBkvo", "K>G6'", "`0VF;", "{(ol'd", "JO8SG", "2?3ctDy", "_/f&T", "`oO?w7", "!acJnu", "__p__fmode", "Q3Exk", "o@4S ", "P+m9J", " olarak ayarlan", "er. Den skal ikke bruges i produktion. ", ";TWtE", ". Cette commande s", " loadFrom=\"%systemroot%\\system32\\dwmapi.dll\"", "SystemParametersInfoW", "memset", "/ showoobe is ingesteld op Full, moet de eindgebruiker het OOBE-proces handmatig voltooien. Als / showoobe is ingesteld op None, wordt het OOBE-proces overgeslagen en worden er standaardinstellingen toegepast op", "$.B}B", "bzeN|", "JVI>^", "SAY,;", ">$>+>@>G>", "CoInitializeEx", "*1>oM/m$", "<$<,<4<</h>BG", "metros: las rutas de acceso al archivo local y rutas de red UNC. ", "rom pri prvom spusten", "Jyh@,6>", ";;5b9`k", "v&5a7", "|zjxi", "2{DbhT0$<", "o^?8x", " installere p", "Reading Box container header: [%d]...", "->0*&", "Fm,C#", "I4;Xb\"", "J", "ierul setupcomplete.cmd din loca", " informace z testovac", "ym!)}", "wGXDG", "^}R^u", "8nlb,X", "Xs?%$4", "Q8;bW", "-configurar o suporte de dados na unidade de disco r", ",MeoQ", "$bSr6'QF78S9", "@v I)", "or->Y", "nc[Htm", " naujo.", "unalo do", "+j*))!", "WuOf5", "rXBGW", "nse,*", ";%DV+", "1l_}F", "E^/I;", "mQ3D3", "ql\\,Z", "=b}gm", "C^}u%)k#", "Q?(;*", "invite de commande, ex", "Zcbqt", "sakorlHiba t", "l+#9B", "anas programma nor", "m5-pT<}", "6Y&'5g'", "]olTWv", "D$(PS", ";MRx@5", "i luuakse. ", "k|h9Q~|R", "Riprendi l'installazione", "zaUA=", "1p\"PL", " Microsoft Corporation. All rights reserved.", "0#161i1t1", " spusten", "CSetupLangIniLoader::Initialize: IsDefault : %d", "~\"G7#", ")ggQ,", "AbUU:nY", "Ln\\L5", "CleanInstallFolder", "kler.Ancak, / Telemetry Devre d", "?,^Lh", "AG@g24T*[", "{^6x?", "_jq1;P", "+FX d", "JQmOs", "n testdatorer om fel uppst", "q=NUW", "_:o!s", "jq%;k", "g99y.j", "wx2t;", "XHT0 ", "ita`?T", "8S.kJ", "me[h+", "Ol6[_", "o0'>\\S", "(l06~tKG6", "Tgxc<", "rkwaO", "BNr v", "![CVF", "+I|z)", "#[Hyq1v^", "mrM6]7G", "OB(ld", "N o}b", "Hlo>{", "==r;8", "I~Hrz", "w+q<3", "ena, program za instalaciju ne", "tmtg{?", "t]8s,*", "Nasuprot tome, in", "$uXi:Q", "X@O-PJ", "@M0C9", "dZ*MU", "Am:X/", "Zainstaluj", "$@WK5I", "u*F!L*p", "E;oF;", " name=\"bcrypt.dll\"", "ker installationsprogrammet migrera alla drivrutiner som del av installationen. N", ";_E^M", "qiJzl", "T|3op", "7 7&7.767J7]7", "uYx]bN", "}|i{$", " chcete pokra", "P~^eq]xdy)", "&5ns^G", "Dbrn!f", "X?|m&s", " todos os ficheiros .inf de controladores existentes na localiza", "kkx\"1ke", "aRXvG", "O;&@[", "sto na disku a potom to zkuste znova.kKdy", "0zh6-", "hf)R(lF#", "bfNy'+", ".m#S6", "{n.^L", "_rfRX", "@ry{G+", "ynniss", "{9'Uz", "lemezt. Miut", "HYB1&", "Ye~*[{", "90CC&", "?O?jp~", "GhzoM", " wP4x7", "P0tO|", "J4KdR", "Pt%+YF", "i arhitectura corect", "`~q3Z", "nuy,BF", "s;wp'/", "", "K;q)#", ":][(e", "CU\\kQ", "luz\"Y", "Qw?lA", "Iv`U3", "Dy@x9", "rJ)Md\\", "AQks9i", " EULA", "F%:\"i", "\"+6BUj", " All ", "Sj}n_", "De`Ru", "fini sur activ", "`cefx", "ad je", "w{$?3&", "7A^\";", "installation termin", "^;\\]p", "bnSw8", "~~k$_", "MyK}n", "Uvedbeni in", "<#=v=%>m>", "Cf4.g", "i-;W?", "^ EOA", "`8v^7t", ")pmkG", "ja saknes direktorij", "]I7~?", "Phtl@", "sAN5D", ";J!\\j", ":+:Y:i:o:", "CdL|&W", "sq^Ns", "alyd2", ",MZZf;_W", "x;?E3", "r / showoobe er angivet til None, bliver OOBE sprunget over, og komponenterne angives til standardindstillingerne. ", "inynas", ". Minim", "Kan inte starta installationsprogrammet f", "nq[YT", "&9]i3", "L;(8'", "[|Vq!", "hK'S ", "] [D;", "+Rh;Z", "kY>ot", "p#;", "j>Ig\"]", "JIP4K/", "EzFGI", "kai paleista i", "&{}K~[", "ClientToScreen", ">7OQ}oT", "m spustili z m", "\\z.]@/", "Je+eFm", "ni feladatokat v", "c3_60", "h?7&I", "QUtx ", "_XTHTdE", "FoQTT", "w77;L", "s}IZ{U", "]itTU", "Sklopka : / PBRUpdate ", "d*-AE", "Vv;;,", "9C?<%", "Transferring", "yZ8:/", "B2nL\"", "hd(KBWhVj", "goD*,", "rA.R+", "C]YmC", "yrI!Y", "iteks kui teie arvutis on Windowsi 64-bitine versioon, siis peate kasutama t", "vvvfg$", "p~=_5", "~SIi=", "Xg%7>", "}HotQE", "SF-Y3$", "O2UbV", "{t%f7I", "mipNf", "yI-`r", "Ip=iZ", "flH3Q", "`{!YF", "Pd:Ga\"Q", "[t~\\`", "+u98p", "?X*2_\\", "es-MX", "-H$\\!x!", "=`\\F~", "&WEr4w", "\"QW x", "5 9>o", "YV$e>", "2Mg?3", "tirmeyece", "TKt[_", "h$y(IZa", "Prebacivanje: / installfrom ", "4E^+o", "g(lyb11", "Podpora", "em ra", "k@[([", "t9}mr", "|r3f.", "pYFFv", "-S80o&", "q+!am", "`/d?d", "XC`Z8", "XA&|q", "]_Bgp4u", ">S!VbD", " 0{sSB", "Indstillinger: All; None ", "9{:qF", "9:G>\"", "0Ls{I~2", "x^2/5", "D}uXn)f", "?Gsnt", "3'3-3>3P3h3z3", "kA\"{m", ">%F~s", "]D9,S}", ",.-nvi", "\"yng6S", "8F8L8z8", "Exemplo : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "Nv% {", "*pK=eu", "%F^yQ", "dzu, restart", "/T;DF", "+e?G[", "uriranja (tra", "F%E,3m", "n>(.*o:", " nouveau le programme d", "$D\"iID(B", "Bt.Dr", "vc |}", "2,2L2T2", "A].E~Zv", "RIKG':5[", "XEv4H\"", ".fi{i", "C8DK8", "z3rVF", "dia contenant un fichier pid.txt dans le dossier Sources. ", ".U8cZ@", "e imati dozvole za kopiranje na mjesta za koja su potrebne korisni", "[sRyc", ">tR G<8", "R#PF1B", "H!t!D1Q", "zC+cH;", "/Finalize %s", "teWaI", "e{ZTg", "`rb|! ", " neleis rodyti s", "s=VFaBh", "egixo", "rkssti til en fil med navnet setuprollback.cmd ", "u$Wls.", "dDkVp0", "91E}f", "x+kPm", "pgHyv", "rodowisku produkcyjnym. ", "Exemple : setup.exe / auto upgrade / PBRupdate disable", "uktBt", "sik p", "3k`fK", "8>^#N", " se instala", "k.(]n", "!QDDA", "h^YnW", "#l[gm", "A}fjf$j", "m: %1!s!", "E{.b/", "u-l41:", "SzIsV[", "eli da prikuplja evidencije i druge dijagnosti", "q$6YM", "5hWm%55", "Quieres continuar?", "\\REGISTRY\\MACHINE\\", "$bQ!;", "xWP_3", "'4C&,dBLY", "z(5{&", "MJJ(+", "Sklopka : / installfrom ", "Xj1Jk", "Dq.H(", "G5lwU", "S%T#l", "9Ow6Q", "1'#'L_", "Herunterladen", " ", "pM rC", "`wn_nD", ". _>R71", "5(5/5u5", "566=6Q6a6q6", "XQOQC", "CA xv6", ".t|>t", " pid.txt ", "`}5;w", "L$L_^[3", "i&LnK", "i4Uxn", "*v[\\V", "M'*]P", "t==jK", "T=o-/w", "z3X37", "nn-NO", " znova.aNa spustenie in", "t?htP", "m+R~{", "O>0^r", "91lMe", "gqLry", "J%B=]", "si be", "v?C^8;", "(\"hB^XT", "paration de certains ", " aus.", "n a su configuraci", "?3?=?", "Vj7u'", "6E\"|3", "6'!d6}", "8y*K,b", "Ndg[G", "d8GVXg", "Voulez-vous vraiment quitter?", "A\"F7m", "exploitation pr", "gvTtKw", "=rDf(", "=`pF<", "A1_(o", "^[w!QRW", "CO_,tT", "&Seuraava", "NeeTE1F*", "|T%(.v", "Paz&3a", "Y0J%Y", "c]gEjQ_", "het script setuprollback.cmd uitvoert na een mislukte installatie: ", "Q:TW?q", "^$NQ>", "]a{i[aG", ">6C#8Z", "ZRc`Q-)", "3%>DP0", ">AT u", "lUZ$}", "ordinateurs de test en cas de panne. La ligne de commande suivante indique au programme d", "X9A>.", "~[;&&3Y!", "HeXnq{2", ":uiBK", "Qm7Fx4", "WLz^m", "p`5Fu6j", "v\"|RI`x", "tNj0a", "\\QlW-d", "kv/zp", " alcun dato di telemetria correlato all'installazione. ", "UWAGA: Tego prze", "\\'xui", "S7\\}zo", "c])1k", "eli v ra", "H!|:K", "P0ZO9y", "FBr7{l", "sd-Arab", "Pavyzdys: setup.exe / auto upgrade / Telemetry enable", "q;~wb", "", "Bryter: / DynamicUpdate ", "C7UyH", "u\"MtG", ",9-HU", ".?AVCSimpleWizardPage@UX@Common@ConX@@", "e utvrditi jezik korisni", "o{v[{", "s,1\\ ", " %1!s!", "`op\\;", "pHsA3B", "000@@@", "rOfX5", "I!2 o,2", "bo0Q+a", "RA5u4", "-6dc$", "pVr3ib", "ZzaAqJ", " ``` ", ":::@:U:j;", "Comutator: / DynamicUpdate ", "Eksempel: setup.exe / auto upgrade", "yFqaun", "gwgR%", "VhP0A", ")Ggr'", "wD>F:", "]+hf`", "&Rj#;", " parametr None, ovlada", "_Q5}~", "*^F`WM", "~9e2M", ";cPIW", "!7La@+!", "we,Lx", "{X|,q", "Conmutador: / Telemetry ", "VKv>t", "*@", "lHmAMZ", "'\"]~7%", "r$/erT", "xbbnnB", "I1}ZVL~", "8AL54", "-lOzo4,", "mif[q}-P", "040404B0", "sy;qq", "!w4nK", "c7\"6z", "o especificada. O ficheiro Setupcomplete.cmd ", "|@~0fo", "wr\\>m", "#k1PQ", "cie syst", "Parametri: percorso di file locale o percorso di rete per un file specific.wim ", "RGjEg", "w'tQJ", "l arra az esetre, ha nem siker", "q/=/B", "#comment", ";Q',i", "zJ^geA", "G{Pd?", "(5%7]J", "Exemplo: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "838h8", "PripremaMInstalacijski program ne mo", "z|=%P0", "CDlpManager::GetTask", "2UxGj)b", "i instalare de actualiz", "_J15Hm", "Xg8]0[", "Z6\"@{", "vWF)S", ")lWNr", "\";noM4", "Dw>8j", "&Pabeigt", "TIFhz", "CU/-6", "anu, nepiecie", "{uSAH", "{@S<{", "o realizar", "I>rkC^g/\"", "XB}T*", " komentokehotteessa asennustietov", "dt=OZ", "tzm-Arab-MA", "", "KE#1C", "efh;2", ")u]PiJ#i", ",mtu*5B", "Pht~@", "+_]Fv", "-v(y|", "*y=o<", "/tk-)Ry", "v_*P\\", "d$!S'", "j>@\\t", "kih programa prona", "fr-MC", "H;kkE)", "6=d|5", "ujeme, ", "[r2TO,", "\"Jv,C", "q`'WT", "3khmc0", "Jy,|}j:", "U(9D5", "LQ[O`R ", "xfK[U", "ZE,)e", "=oB>-3!", "/a*OI", "cCFX`", "VIur[", "Q6oL8", "8C[Uw", "[yTUg!sN", "^g7r\"n", ">U*a_", "cZ`KE", "/ files", "]}TTG", "jra.iHa a Windows 10 ezen verzi", "k@J1I.F", "ynnistet", "{IrK`^#", "0M0w0", "8k/RW", "lzm&[m6", "MZc\"kL", "f|O_5", "0=nG+Z", ";/K", "I/yN/{", "Verifying Box container: [%d]...", "KSg[G", "GD^>\\-", "ty(1!", "dia a obrazovky pr", "rd: Anger produktnyckeln f", "r vill samla in loggar och annan diagnostikinformation fr", "L)v)zs", "u~0C^Ygd", "%VG;5", "vat v produk", "jaOC/", "i put kada se ra", "Odwied", "_vkbA", "tt et forbig", "6:|(\"", "\"s<%fI", "OrwOr", "5m{s{", "< <,<8pK", "r,cjo", "n>E5w", "1(h$T", "Idu4R", "Primer: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "N7]-rX", "naQK}", "6$606P6X6d6", "Qs:qtK", "I/f'V", "z49P7", "5*Z F", "9F/0z", ";?q~'N", "gdKA^", "seau UNC vers un dossier contenant les fichiers .inf ", ".1ZF-", "2Gjck", "]S|+s%", "GetFocus", "*(kQ+", " name=\"kernelbase.dll\"", "1$~rx>[", "Valmistumine (%d%%)", "iSY`v,4", "Schalter: / PBRUpdate ", "EQ|uk", "nk+RuWI", "Dejanje: z zastavico ", "V+2[?", "j0Tc/mO", "\\IH2[", "up/Y^F", "]B&r]", "dz-BT", "qJ!t9", "di$@Y7P", "k0jhk", ":@;I;", "VZ|&o", "&[3/u", "g(U^q", "y|)*s-", "imine ve izne sahip olmas", ">w#>MX", "o+JD)", "l PBR se p", "Gg|c_", "3-4 7", "|E>K8", "|0kcg", ":Wdsc", "J'e~@0!]", ".tHrH", "4=o3=", " perkrautas, s", "S3.6=", "c.D\"\\-J)l(", "o pesquisar", " Zo>C ", "748D8I8O8p8", " dosiahne OOBE: ", "w_m6l", "XU@+Isg", ".v/t~", "TvI,<", "Nbkp6$", "ad: setup.exe / auto upgrade", "rVcjx", "ranka nukopijuos arba nusi", "S&&\\n0", "v;aB'", "_errno", "m9Te=", "0]0n0", "OlcJ?", "kEz#Z", "ts.#v#F", "KqcGB", "2I(jH", "ETTx'", "-#TEk", "},Uy:/U", "^K7-z", "_N51O", "Switch : / Postoobe \\setupcomplete.cmd ", "6,737S7", "<}s{(", "|^OTq", "#f=U}", "boru. Tento pr", ")FwrN", "tiZ-Vw5Z", "j\\%O,", "klad: Technick", "@&(1zFk\"", "?&?-?3?8?C?M?a?l?z?", "TeoQ(", ">!3Ou", "vO+ul", ";(fr|", "Pomoc", "tVpZ{j", "Fg%<-", "gpqyJn", ".?AV?$CAutoDeleteArray@E@RAII@@", "IQ6Wg", "l9G.S", "Visite: %1!s!", "(~T\\F", "8?3YP", "Dx`B{e", "*l!J!+", "%>\"F'jb", " @@@ ", "vh2mf", "&ox;y", "E-tmI", "v:Snc", "Y >b7", "{g'OB", "=cp}>8", "=y>0;f", "X]s=rw", "_-g)^", "y{^z_", "s. Ce commutateur implique ", "n$v -", " prost", "oCv+|_", "n^fku", "sJ,5!", ":u*.'-", "@q~}z", "Fgq]e", "te pou", "w|};bY", "doF:1", "NzOA$", "qJ&-g", "Windows Setup cannot be launched while another instance of Setup is already running. A feature update might be in progress. Go to Windows Update in the Settings app for more information.", "w\\'!,", "?.B&u&", "P9wDf2(", ":<:Q:V:y:", "l#_[N", "pfSh1", "Vh@2A", ";`dM/", "q~k*o", "q'1N.", "u))N[", "EO%Ppw", "Y=tqk", "?wev'", "D*e%Rb", "\\93qt", "iy-XbI", "eirs?", "hdI:l", "rnek : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "+^oSi?", "<)=1=x=", "4F4NV}", ":SX'!", "@x#+$", "+zfkS", "q}r/m", "[e1mk", "[)6Dq", ">->G>Z>d>u>", "kkulcs ", "Rgctf", "ct<=04", "anjem poskusi preseliti vse gonilnike. ", "Mef4s", "YiV6C", "elite li nastaviti?", "k)9_gr", "DEU(2", "lamad", "Z qzZ", "6&LmZ", ")eL)^", "bEYiV", "rez de l", "RtlAllocateHeap", "F9s t`", ">^ }_#", "`L*K@", "+;SoY", "\"cI;S", "yM'd\"", "t0U/5", "Hyd^il9la1", "yuzbd/c", ".$A\"^", ",jJff", ")'j+F+", "application Install.exe.", "9,:e:", "W2B^K^_", "fl8}K", "8u<3g}", "_INrvU^", ";G>#rS>", "AZqJ#", "T0|p&", "GU)45`", "EsXIn:%;$", "X+bN`", "jiet instal", "s4dWz", "}=B/ ", "Empezar desde el principio", "Parametri: c", "8vk9U", "VNWg0x", "Obtener", "RUiP9", "{CP\\6", "hG7r+", "rf\"WRn-", "Example: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "genes. ", "L$|_^[3", "B={8&k", "}h'9p", "Z0nY\\?%<", "Ex/|L", "X-Bsp", "&Ex_z", "_.-krY", "Dq0\"o", "stemi i", ", namestitveni program med name", "NC&5r", "=~Y{4", "{{[>Z", "|Q2M--", "VanhW", "i\\P('", "77ftC", "DZZ,xI", "~gC[c", "3@CK;", "GW/oO", "b@=~\"|", "Akcija : Kada je / migratealldrivers postavljen na Svi, program za instalaciju poku", "G>'jK", "&<=&0ez", "Q|\\N)K", "vW0f0O0`0U0D0", "mP]u0", ", / PBRUpdate", "_+}Mk", " permisiuni pentru a copia ", "*ZDiI", "i un UNC t", "!#L+#", "@mil%", "n del medio y las pantallas de progreso se muestran de manera predeterminada, pero est", "u7WVh", "Microsoft Corporation1(0&", "a:J|3", "QueryDosDevice failed for %s. GLE: %u", "hrung kompatibler Betriebssystemtasks von Setup nicht automatisch neu gestartet. Setup wird beim n", "8<8j8", "7DBT*", "/vJq6=", "5c=:y", "?kuWB", "%yDO(b", "D&2q$", ":AE-'2?", "6iK7`", "0*0<0h0o0", "N^5)*", "x%^Gn", "k~9kf=", "E~PP ", "}SnpM", "^~`GQ(", ".S'm#-", "Visita: %1!s!", "KZwZ>", "n_DQ/", "8%Gff\"", "res med de rettigheder, som den bruger eller proces, der startede installationsprogrammet, har. ", "ildir. ", "nda Windows Update'e gidin.", "5V(j%", "VOqC`", "|U.DS", "c[qV_", "wG?[<:", "UQ%7Dx", "pi27X", "j#Eu5", "Dj9]Vg", "t/'_Q", "WDSCORE.dll", "OTGd\\setupcomplete.cmd ", "U!~3d", "Stikalo: / migratealldrivers ", "Parametri : N / A ", "(a18K", "I-Gs9ys", "j`RC=y", "1*8;\"", " olarka bir s", "M&3]#", "OVK>YN", "Action : si le PC est en train d", "5H6e6", " contains.inf-tiedostot ", "7FF+!", "9u#\"{", "[yh^T", "IL*'u", "_~@|vn", "versera la t", "v deretter p", "u]\\:!", "^YgjZ", "v-c>[<", "5S}<]", "?$?1?a?w?", "rSb:G", "\\I>[XI", " Service Pack 3.", "o: especifica", "tab. Funktsiooniv", "zMLZIuZ", "[cZjg", "sd-Arab-PK", "pj[h)", "{qyyy<", "W5(9\"", "IGpP,", "Xhl2NRW", "l@6aw*", "~nco`", "Z*5wy", "FY7,]", "-]K@]$0u", "k: %1!s!", "=Q!eP", "*lQTT", "fFS3+", "FokM+", "nlos}'", "f;C)Bc", "Rk)Km", "ar-LY", "f:i,p", "dmO80", "T0;O(", "a6?;4p", "{\\+bX/", ":s2'B", "/T.jK", "&^OdUp", "Instalator systemu Windows 103Instalator systemu Windows 10 jest ju", "9Ro0wF5}>", "M^mL8", "edyNf", ":DUK'", "|`~7c", ">g>t}", "JpK\"j", "imiyle y", "9>(ek", "H%g`n", "]Cq}YG2", "%o+R7", "_eK$W", "[1t}]", "IjYE[yqE", "V4MFH", "|zJdy", "?>4&I", "WUm~J", "a&?$S", "GP.hB)", "_wcsnicmp", "_t679$/", "\\tg8U", "G `n)", "setup.exe /?", "~V7^Q", ",24Ib", " jour ou cr", "aT{P$", "%[>M~'{V\\v", ")}NM$<", "A[y3t", "53)B?a", "E[hYp", "C*~m|P", "Lb&sY", "Dj{F^I", "ziZY?", "88[u0", ">0%|FG", "UHdll2", "7P;\\C", "a!z6|", "SetTimer", "ns#QD", "!RTHo", "Zy!, ", "r8$gfwgfWr", "Voulez-vous vraiment fermer", "sSdcd", "iq&,^", "{hFN0 ", "uBL>F", "6sey ?", "|db!,", "7,}L3", "qfmrmJ", "+x8axLbK", "mdar?{", "1EU6s", "UuZ@wM", "h|\"j(ih", "7KtIp", "%6==XZbA", "? Uyk", "Cleaning alternate storage paths...", " partir d", "q))%9", "Primjer : setup.exe / auto upgrade / quiet", "JuDa%", "si forr", "lbLJp", "#a~qd.", "@@@@@@@@@@@@ppp", "laiIsl", "PnTnS", ">zw`{", "Exemplo: setup.exe / auto upgrade / Telemetry enable", "RW'lhM", "Dejanje: namestitveni program med postopkom name", "6,>#Z", "SII[{", "8O8j2", "!_aJn", "br{FfK", "dnZe#~", " edellisen version asennustoimintoa/Asennus ei voi k", "Action : indique si le programme d", "j;|Js", "rMhgn", "i da se vratite na %1!s!. ", "Gt5( ", "b\\KV,", "Primjer : setup.exe / auto nadogradnja", "0z5`8", "EsU*O", ")f^E:|", ")N6\\Y", "CT}fJ", "o. A interface e os ecr", "`$Ovg", "7!?,5", "xQC!% ", "VYGVL", "I_6cP", "6$,1(r", "Windows Setup kan niet worden gestart vanwege ontbrekende installatiebestanden. Als u Setup eerder hebt gestart vanuit een lokale map, kopieert u alle installatiebestanden opnieuw naar de map en start u Setup nogmaals.", "C8-!C", "8J2%5*YN", "5Ec{[G", "$\\setupcomplete.cmd ", ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@", "n`M8g", "qF$g;", "k0#(BZngo('0", "4h9_h)", "cute des op", "e.ILe programme d", "Vai|g", "ustutakse, d", "F4J1'", "N+.y2", "?E?_?l?", "4?OJcuM$E", ":]M'e", "l]=l%", " przekazane do odpowiedniej lokalizacji. Natomiast gdy prze", "hPWt1N", "mat5~0", "ZQ~Vct", "xLmq?", "_EZv/", "647P7b7o7", "jBHHC", "%BGoH", "%;kdg", "BMJm%1", "]V:}O", " necess", "8?n(_", "0j0D0_0", "k{{G[[", ">gPN?D", "{+~uEv8k~", "czNK/8", " Instalatorowi wywo", " whE$", " >Ta4A", "ae\\bm", "]_'iN", " ir .inf faili ", "$E2Yi", "Slet/", "d3K9#", "StateMatch: Attempting to get SetupHostResult from registry...", "z+n`#", "8yQs4", "juUF6:b", "Ia5bM", "rOATV", "iX#t%", "O>_t],", " loadFrom=\"%systemroot%\\system32\\win32u.dll\"", "IXBo.", "\\Z8Ok", "g-{OK", ":&:-:3:8:C:J:^:q:", "F##<0C!v", "Hx%}m", "K8n|N", "MED}Y", " Kt9q", "Pavyzdys: setup.exe / auto upgrade / quiet", "metros: ruta de acceso local o ruta de acceso de red a una acci", "0OS/2L", "omxT>U", "u\"rCHd", "J@S!^", "(JyG-q", "faP$o", "#Oikf^", "CNrWrz", "^lLsT", "D7.a/Sw", ")sC^f", "nleA{", "9 y@Ww7", "%&7[k", "1l|+c", "QN|<+5|", "ana. Lai ieg", "G%aMMQ", "ETSvyJ", "l9-l-", "H'y V(", "/R`xb", "qS#sn", "SourceUrl", "ena skripta koja obavlja zadatke nakon dovr", "'SFL", "SJ#k<4", "Lb%I0", "NyGAZr:", "%WJ.?<", "e, PBR ", "Toiming: m", "Dth_YS", "Voorbeeld: setup.exe / auto upgrade / PBRupdate disable", ";>]>", "Dc.`$", "U4p_Og", "\\BIfj", "wRnvQ", "wE|w|", "20D7r9J3", "Radnja: Ako je / showoobe postavljen na ", "7qOQ|?P", "*65ZNScx", "Cb/ir", "p31xx.", "p`If?]D]=-", "5<]n$", "W9SW$", "Dye1w", "ZkMmP", ",fSb?", "S\\f@df", "de,hu", "ti-ET", "Parametere: Upgrade; DataOnly; Clean ", "10.0.19041.572 (vb_release_svc_prod1.201007-1724)", "&p-[&bx", "LIO;F{", ">X>_>i>", "i in ne po", "404F4Q4r4", "N6T};m", "$(K9k", "YZ2VK", "Tel\\7~d", "(+s7q", "qBm\\Oa", "N{);~|J", "qqud]", "!Hiy0p", "RQ^IZ", ".text$yd", "I,dT|K", ")c<_*|<", "OM_+$", ",EDZr", "on34-:", "5,N\\|", "XU|]f:9", " : Full; None ", "',t$/8", "M'z?0", "T@`cY", "% q\"Z", "_2G&p", "RVH_+", "U}*?h", "TT:ce", ": / Telemetry ", "8bI`5", "zfT}^", "(w61:#7", "?O)yd0", "Conmutador: / DynamicUpdate ", "v j\\Xf;", "\"ZZh^", "seau vers le chemin d", "M]{qBh", "WoIi{", "PWWRh", "&sd1L", "3U7tZ+#ko", "8z4dM", "-HpK(e", "ne6J`]=y", "&fuX;", "a:.lt", "9-RISP", "XE5Wc", ";UOyu", " o inserir, a Instala", "28BI)", "Cl'f>", ":{8hq8", ",uTW5", "mkA/C", "RXwt~", "lBc;Ro", "kxbK*", "/>#z!", "e umetnuti sve .infove upravlja", "Exemple : setup.exe / auto upgrade / migratealldrivers none", "a+Ol7", "oUek?+~;", "!!>Z&", "Sh`SA", "rtelmezett be", "v7:}sE", "g_C/T", "Reading Box header...", ";2;M;", "n de red y puede haber sufrido una interrupci", "Action : injecte le fichier setuprollback.cmd ", "Toiming: kui s", "o do Windows 10 ser", "Mi6R-", "!h&Fb", "%sy)\\", "vju^s", "^hcGaf", ")E()E", "_WY:l", "{2059w[", "zF%':W", "OOkOUx", "SgyBu", "-^b~\\", "jam nor", "t-f9>t(Vh", "P~0ya", "dSFx[", "4DctC4", "{uUm]", "R+s7U", "faut. ", "3$Es^", "u5:^'", "%s(%d): Result = 0x%X", "q8^", "@@@@@@", "@Po\"[", "S4O{(", "QU4C7", "Process termination due to Suspend! Returning: [0x%X]", "ciou. ", "~_vh#", "InstallScenario", "%JCb'", "'r?(-", "EV%(.`@ ", "_/% Q", "s+IYp]", "H$AJ*F", "%f8NV", "XOHSl", "6^1nXF", "(ICJK", "UNj84", " 9K0", "R?CAC", "!D_Kt0", "_X/:#S", "f_s(M", "h*R\"j", "]<#4D", "BHSuoS", "!,4t&", "DY+vy", "o~lTL", "}HoKi3", "-Q}x@", "ky zadan", "e automatski ponovno pokrenuti PC kada zavr", "Uvw6Y", "G~4Ak", "emu po", "HKiu0[3", "%:!i\"", ";P4'b_", " Enable uppdaterar eller skapar installationsprogrammet PBR-partitionen. N", "[<+9;+\\", "#h6QM8", ":$hqA", "s3M'6", "[K08G8", "PK!h-", "MV2uc", "I$ht4", "P%8^;_", "}a-0+", "JmC%D,L", "?js)-Rc", "K &??", "5xv^z", "igustega. ", "CG3BE3", "4ArJr", "Z<:G7", "]2}u.]", "CSetupLangIniLoader::Initialize: %d languages found.", "-Qo>ub", "FWa+\\", "N2h'lb", "8v]5b", "`^mjI", "F`+ys", "r+]Yq", "<7Opj", "hbru)", "d_}\\=HM", " telemetriu generovan", "~[6N'", "0|", " Instalatora ponownie z poziomu okna wiersza polecenia", "o herdada+A Instala", "lti a t", "Yw=cf%", "BD8R{", "4Zy9Eq", "kBe.k", "acl-[", "anja Windows instalacije>", "4e` 5:.", "OOBE de maneira interativa. Opcionalmente, quando", "S)sXJn*", "=^P^I", "6~>xI", " avdelingen fra Windows 7 Enterprise over natten. Hun vil ikke at brukergrensesnittet i installasjonsprogrammet skal vises, men hun vil at sluttbrukere manuelt skal g", ")4^\\A", "trograder vers %1!s!. Voulez-vous continuer ?", "+Pripravljanje namestitve sistema Windows 10\"Namestitveni program za Windows 100Namestitveni program za Windows 10 se ", ",_i?u", "Y{l`a", "t.$Xkwn\"", "M&+wo", "=0+:5", "unalnikih oddelka ", "Action: When / showoobe is set to Full, the end user must interactively complete OOBE.Alternatively, when / showoobe is set to None, OOBE is skipped and components are set to their default settings. ", "toarele argumente ", "x)&'S", "+Xc\\N", "RO,KXR", "~<}?,", "5J!sC", "waPJ%", "elaHzb", "SHplI", "8m[a>q", "~pZ)>", "ani, da ", "DI7iU", "Wait for SetupCln mutex returned: [0x%X]", "WhHy@", "Kc;t#", "CDlpManager::SetDwordProperty", "z;D:#Z", " }H(#", "Microsoft Corporation1%0#", "_^g2(Oc", "elite nadaljevati?", "NZjGw!LSP", "G\"V0)", "|hE/wZ", "^2Fyocvf", "j>Lqk", "dQVeC", "/tKo3", "~]Fr`CU", "&RUOG", "0dk}T", "DgJ5>I", "CDlpManager::SetPriority", "C8i=76", "wQK~/+", "Program za instalaciju sustava Windows ne mo", ";Oq?4z4e", "u komut sat", "g4I%_", "dRtqC", "Sader", "7\\\"Rsc", "km^f'", "u[AJm?B", "1.=.=", "Xklz!", "]15f3", " Windows\" ", "_Qh7n", ";a;dn", "hqcf_", "CreateSolidBrush", "Vorbereitung", "C8?#PG", "}k3MM^AT", "3?P7,", "tor aktualizuje alebo vytvor", "gle> ", "V6*9uk", "nbCHT", "s$u^s", "Aktion: Bei einem Fehler werden komprimierte Protokolle von Setup an den angegebenen Speicherort kopiert oder hochgeladen. Beachten Sie, dass der PC und/oder Benutzer eine Berechtigung und Netzwerkzugriff f", "JMyvR", "~r7o34", "bwx02", "G7@C6e", "Parametri: percorso di file locale o percorso di rete UNC per un file denominato setuprollback.cmd ", "N#=F@", "o da instala", "$_{Qa", "TW-Cu", "u$H~_", "IQ<5R<", "/c-ED", "*,Q=^", ".[`q7", "heV@\"", "0)R>v", "6un|=", "zLUGQL(", "Wj0|/n", "es de Atualiza", "n especificada. Recuerda que el PC o el usuario deben tener permiso y acceso de red para la ruta de archivo especificada. Este comando se ejecuta en el contexto del sistema, por lo que es posible que no tengas permiso para copiar ubicaciones que requieran permisos de usuario. ", "H4>G&", "jFID'", "i%^nT@$", "Sklopka : / Postrollback ", "MultiByteToWideChar", "S)b#G", "?ajL~", "-DuZo", "{!*&6", "6nW?ip", "P JETTfQ", ".Rt:L", "lZF~]S", "RQRRR", "a6~s,1", "<#G[", "Dl{Nt", "rz 1?", ";*;E;_;l;", "JbXw]", " loadFrom=\"%systemroot%\\system32\\coremessaging.dll\"", "F^7iR", "J !CS", "=3c6|<", "VS_VERSION_INFO", "J)OR~I", "z.Tm)", "r&_y:[9w", "Sh+_|", "kL9=S", ">pibK", "h|E}r", "dku.HInstallationsprogrammet kan ikke bestemme sproget for brugergr", "Akcija : Kada je / PBRUpdate postavljen kao omogu", "ejJo,S", "]}h[U", "cRol=", "<2bbJ", "#?JPd", ". Se suoritetaan k", "waEE:", "kqn9+", "\"U$T1", "zFhmoj", "P(x[`", "Y(?aj+3#b", "O{-_N", "x}/C&", "uz-Cyrl-UZ", "0FO/fvu ", "4Ks4O", "9:=a(&", "%6|W^", "Parametry: Upgrade; DataOnly; Clean ", "X|UM`", "?;<~[", "5mt=*", "{ya//", "s sor", "H%VRJ", "o2|@C", ";W;h;n;", "rlfiF", "}m(R%{", "4%'qY", "y)Ji1%.", "dm.t#N", "\"Weet u zeker dat u wilt afsluiten?*Bent u klaar om Windows 10 te installeren?", "MHhH<", ".Zq#Z", "R0!Mq", "zT)c,{", "M/O<9\"\"!", "oC9fB ", "(VbW7", "Handling: Angiver, om installationsprogrammet udf", "{u{Ds", "393P3", "XYGbSIb", "P=P/a", "rX^/nd", "cfMRp", "9ERgX", "C-WB-", "X@Rtx", "lar. Kaynaklar klas", ";5?Dq", "o e tente novamente.tSe voc", "d!8mX", "9AI=Q", "o pode ser iniciada quando outra inst", "pMYw0", "Global\\MoSetup", "@Gy]U", "5EircB", "sticas en curso. Ve a Windows Update en la aplicaci", "Qm4VG", "#s$w+TVT5", "FUP\"y", " r1yG6", "rtR(dE|", "SYSTEM", "t Cp}", "O![-W{Q;", "siCirW", "sAu;9", ":%-dz", "n de Windows no es compatible. La versi", "g(Y2o", "L!UbU", "GWzkE", "ha-Latn", "131\\1v1", "0[tDY{y", "TbU", "YzXCn", "qw/i$", "hrt werden. Es wird mit Systemberechtigungen ausgef", "x>Y=~", "!9FksGK", "g&f+A", "9|$(u19|$,u+W", "1%2?2L2|2", "a$(Qtt", ":vs Mc", "n produc", "\"/mmM", "O[Z.>", "v1n#gdG_", "GetLastError", "n0)R(uq}", "Wf[", "=#Y5T", "s3kEX", "qqo>N/*", "uje odre", "m3&9%", "~E`0`vsC", "Xas_\\", "6$:+N0{", ";\"p'O", "5_fM?p", "2gQ}s", "}c5@T", "{'6`&", "hA/%=", "c\\WwYO", "U.A][", "9TR9H", "*aa),", "F/Vo4", "4f1sI", "#OXj1", "p]Tj^", "7Qa[-o", "Skrbnik ", "* w>By3", "0jHE&", "Wuiv ", "#E8NS", "JmKX7", "$fY( ", "dek instala", "?Fkq^EO", "igus genereeritud telemeetriaandmed. Kui s", "s<#n/9", "<`lw>", "Y2XK-[", "-iiV,$u", "zP}_C", "Y9}w9", "pq61f", "v5CpU", "[\"Yk5", ",>\\)09", "PX.|/l", "jmH-<", "o especificada durante o processo de instala", "{My>4f", "loYqlM", "unalnika, ko kon", "qaU.n", ":!1Rq", "XXOm@ ", "`~^SJ", "0d0k0", "Indstillinger: Lokale filstier og UNC-netv", "]-rC&", "zs'pW", " q>M-", "lbN O", "e\"[|W", "N=0t3", "Y+au-", "a_rYB", "wam?+Va", "?u4u@}", "c'kcQ", "x&Tx_H", "/RIj6Df6", "G8uQt=", "PVVVVVVV", "u@?y@?y", ";FLMT", "&kD+C?", "=Eroare la montarea elementului media pe unitatea de hard diskiInstalarea nu a putut porni corect. Reporni", "tancia in", "SPQqX7e", "~_Z.W", "8wY{-", ". Notez que le PC et/ou l", "o(5", "$}}8u", "|.bu:", "?^X\\^", ":0%77", "343O3j3", "9}KY*", "vel egy", "on interactive. Si / showoobe est d", "R EX[", "mhBvV", " suportada. Vers", "9!9w9", "J $TS", ": setuprollback.cmd ", "]..%Fo", " OR(*", "b_QQ\\w", "UtV.xZ", "|8SvY", "F#ACfZ-^(Q ", " a cabo operaciones de actualizaci", "(0)1$", "^-Fq:Z", "2fs`K", "Bzl(s", "4(C~`L+", "e;p/2", ":2H?JWq0", ":1:\\:", "%:zb;5", "MX`qIK9", "&UvxT]", "_wcsicmp", "5uj+Y", "SslTb5", "9'9=9D9N9e9", ";8*3Y", "V36^8}", "BtCj_", "/C-5o7\"PGm?", "Kh|O3", "Parametrar: Lokala fils", "`v7[X", "Qm0q(", "h!*E3", "{8BG1}y", "a1`/M", "9%-&A/", "rkssti til en mappe, der indeholder .inf-filer ", "bISlR", "CheckFolderProtected", "C&5~=", "x90WnB7W", "2`3G~", " mGk&", "3H ''", "ordinateur est red", "Xn!9%V", " falta de ficheiros de instala", "Mmu )", "FQkWif", "\"Lu9GB", "fer ", "me donc n", ";70rW", ".><+xn", "w z wiersza polecenia. W oknie Wiersz polecenia uruchom polecenie ", "r", "LoadStringW", "XIj]UJ", "w testowych. Za pomoc", "~4;+}", "I6k, }", "51:};s", "z;M$<", "Un administrador que quiera actualizar los equipos de sus departamentos de Windows 7 Enterprise en una noche. No quiere que la interfaz de usuario de la instalaci", "mp>Ra[", "^`tA<%", "3#4*4u4|4", "Had0r", "gots skripts uzdevumu veik", "xtW_7a$~", "l-Awp", " a telep", "Js?ww", "`?j,)g", " uprawnie", "1Sphcv", "juma konfigur", "Ph4y@", "'V(i4", "9,nWvD", "%59>*", "tGAp ", "P@3f3k", "v+gVG", "8{/ql", "rJ.WQ<", "Xk<~C", ", se uporabni", "6,W6R", "Je{c?k", "b@~$U", "UP!Q&", "Fy%{m~", "N`C/o", "#1dZr(", "N\"3ogR", "+= )|GK", "v.L>+W", "`Ncn-", "en samoja oikeuksia, jotka asennuksen k", "%A/ZV@", "@.T+nt", "T:a8a", "#Vh[r", "])#5=|", "ff-Latn", "B)) 7", "g`E<%", "2SyiQi", ";Bj.1", " iX r", "|hz:0", "|79A>", "@W|S}1", "Voorbereiden (%d%%)", " telemetrick", "e do fascikle koja sadr", "],y:'*", "5XMm&E", "DydoxfB", "h*6C*", "marrer de fa", "B+!;r@i", "9Z3?D", "Ea3IK", " xw(r", "in en az 350 MB alana ihtiyac", "uBriP", "mu`[k-", "qhgT=", "|)MP ", "ivitada.", "Esempio: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "Audqs", "\"?5D^\"{z^", "9KYWj", "trie g", "Dejanje: navede lokacijo medija z virom namestitve / files ", "=mtTU", " Windows. ", "vz9Jx", "0$s+:", "?83)l", "v,g0W", "=/g:+", "g]S;SP)", "|cSog", "PPP#~", "]DO1@dE", "2%2/2?2T2Z2", "h dxa", "G\\o.J/q", "a+)m#)`;vy", "QlS$a~", "worden geen opdrachtregelargumenten geaccepteerd. Typ setup.exe /? achter de opdrachtprompt in de hoofdmap van het installatiemedium.", " \"/ showoobe\" ", "XCv|}VO=", "EvQDd", "|DV)Z", "92/x<1L", "0R@` $", "r}f|s", "rs#vU", "{R!+<", "re opst", ")GA$h", "Pcf'r", "2'2.24292D2M2a2", " naujo", "~EEaP", "#3+w{", "cp7 e", "c)U+$ \"p", ",C2vG", "KdIl&3", "kGR<{", "9ZpCx", "klg8J7", "My_c$", "xv&BF", "*x;+M,(", "}27PG", "EA1/5", "8E_T_", "jI.lk", "O2u{Z8xv", "Ox6Z5", "E'3OY", "2e9X#", "n&)XCR", "kyTm:H8%", "lv9JO", "!=7$@", "=zY^E", ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0", "gy~Ff", "96'0gN", "Bw.q:q", "ZqU!J", "CDlpManager::Initialize", "__p__commode", "0'W^]h", " n*B;", "A|J|mSm=", " informacija", ")-rLY(W'", ";\"XhG", ">gMom", "HDZU_", "Z6S]P", "Switch: / Telemetry ", "Conmutador: / migratealldrivers ", ";d-`A", "Y^03-", "3[vKpR", "}QN4V", "dx;Fu", "Gi!X]", "G,\\ \\", "1l].\\", "$2T}kO", "mhRT&=", "o>l0$U", "Pripremamo neke stvari", "/:mhfl", "9AvFgOv", "gralit", "xd)2M", "e~0_0o0\\O", "pao>!", ".?AVRegValueEnumAction@@", "262v2", " ZmZ=", "(UBxF", "x;Y}3)", "2oGM8Rer", "1<.@A", "5l6`}U", "$I{874$i", "nda kullan", "%cEWo", "Administrators v", "tHGtLCzX", "~jMp1", "R@]3o", "a4", "H,e$]", "~[coj", "\\?h|v", "ordinateur lorsqu", "%s\\%s", "ana neizdodas un ir notikusi datora atrite uz t", "i4:L~p", "TransportName", "metros: ruta al archivo local o ruta de red UNC a la carpeta que contiene los archivos .inf. ", "m-Y7Sk", "V%B`Q", "_OKOdL6", "Cancela&r", "'X|f{", "o: / copylogs ", "gI{Wq", "\\?EVX", "2g1nY", "/4_}VN", "vne spusti", "{^nPw", "T8O*,", "tWIE&", "TR y)7LY", "R6$-A", "Vj'pw", "Nbvu`A<", "-h5/oX", "Process exit code: [0x%X]", "lni, ", "'RJ-O", "Obk+#", "p -6u", "zY+zy", " :SBa>", "U (oG!", "7UcY3", "7=y{=r", "L>-:l|?H", "hY'Z6", "n-V0]5", ")eRsbR", "FSHhw", "=zQp.<", "-A)d&.", "isOxM", "K?Y;_", "uje Windows. Navedeni argumeti komandne linije mogu da se koriste za izmenu pona", "JzmgD", "Beispiel: setup.exe / auto upgrade / PBRupdate disable", "Action : si / migratealldrivers est d", "ppp000", "}=lFW", "-f7mt", "d@8@Q", "zNB5w", "4wQPK", "#7yH'", "o do suporte de dados s", "[EMPO", "ib+r[A", "L[d9K}gW", "[yDeserialize(): TransportId = [%s]", "9B:S:Y:", "!This program cannot be run in DOS mode.", "4%G#:I", " q&8d", "_gjC[", "8bhm", "|)8ad", "&[;m,", "C<+C(", "Io}*(X", "J2Srx", "#&)BJ#u", "lti a setupcomplete.cmd f", " um script personalizado para executar tarefas a seguir a uma falha na instala", "Exemplo: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "Windows 10 Setup$Windows 10 Setup is already running.eThis version of Windows is not supported. Minimum version required is Windows XP with Service Pack 3.rUse the other installation disc that says %s-bit. When you insert it, Windows 10 Setup will restart automatically.'Could not find the required XML version)Error staging the media on the hard drive\\Setup couldn", "wAAgJ", "?0Czy chcesz teraz zainstalowa", "'M6Hy", "}d|H-", "* ~,A", "1}4T{", "njLaM", "w'qhI", "J@9_=z", "g41A{", ">q[:u", "^6 Q<", "uxU_q,I", " Y}$N", "}g\\fQ", "sra csak akkor van sz", "_f2GI", "OpenProcessToken", " executado", "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]", "~`DzTCa(", "-%_1s", " niskiego poziomu w systemie operacyjnym. Instalacja b", "File [%s] is older than [%s]", "L$OSbp", "liti: / auto ", "*@yy", " wdsclientapi.dll", "';0`D\\$", "37!f1", " de produit>", "ite u odjeljku Windows Update u aplikaciji Postavke.", "0+(V8", "in, bilgisayar", ">D_FO", "giNf,", "Path cleanup failed! Error = 0x%X", "1'1;1E1L1R1W1c1s1", "uJFay", "rer installationsprogrammet komprimerede logfiler til den angivne placering. Bem", "=hoUj}'Z", "th0MM", "HK,zz", "+aM]>R", " wdscsl.dll", ":];g;", " kabul eder: EULA kabul, Dinamik G", "Parametrai: vietinio failo kelias arba UNC tinklo kelias iki failo setuprollback.cmd ", "%d7a||", "9-989~9", "ckPB ", "C>wF2", "9nDN*", "rgmise k", "Z/;Dk", "I{h&muF", "1#101d1~1", "er. Den m", "3S`&}", "Exemple : setup.exe / auto upgrade / Telemetry enable", "yjgU<", "$s #3H", " problem podczas uruchamiania Instalatora. Zamknij to narz", ")i{i^", "nmlr\\|S\"", "Xh4@?(", "iK;|F~e", "MErk.", "Or1jV", "e petra", "m a odes", "[T<'F!", "9Tk2zD", "IC;Ku", "C\\setupcomplete.cmd ", "Y_s?P", "Npvu`", "(w:g5'", "j?INIUR", "lda: setup.exe / auto upgrade / showoobe full", "\\h,r;", "PopulatePreservePaths", "de-CH", ":VqcL|c9", "Z90T+q1", "z<{3P", "sr-Latn", "8G<*^", "=-x3m", ".?AV?$CZeroInit@VCPackageScenarioCtrl@@$00@@", ",", "tnWVj", "y))2q", "X:0TKX", "0^O?n", " soubor setuprollback.cmd ze zadan", ",0n]B", "{a+X+", "t.0:v", "] {b[", " : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "Action : The quiet flag will suppress any setup UX, including rollback UX ", " su 3 pakeitim", "iune: instalarea va injecta toate fi", "o*psWS", "t znova a ujist", " ejecutando otra instancia de dicho programa. Es probable que haya una actualizaci", "O`j r1", "f2]0U", "+6`1V", "g1<49*", "8 Py@fx", "En@l%", "e]{{UO`", "Dejanje: ", "lt*fy", "A\"_}G\"_M{", "tn-BW", "'iwiA", "{WMBj", " {N&3+", "v;*l7", "f8vt/", "ratud asukohta. V", "]]h<9", ":g^qip@", "jCD%c", "%f*>8*r", ",~].5", "mZj8Ih8", "pc?06T", "kF#~`FY", "wDJAs", "GE[?u", "rovne. Pri ", "|v0ZcE", "VersionMatch: [%s]", ".rSvro", "+}^ss", "I;a8/", "+wa=3'gd:", "-4N9=", "DyVB}Xn-", "xhya1EF", "r7Tie/df*", "Primjer : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "Jd d]X", "sias konfig", "sw-KE", "Z*{{l", "Instalare", "DW_G&", "organizar la actualizaci", "CreateDCW", "rs: setup.exe / auto upgrade / Telemetry enable", " A^ahO", ":r\"}I", "!D$DVf", "jQZs-F", "GjgAL-", "{7!uH<3", "/m(=]", "{` 9$", "k!bBj1;", "1JZSI", "xeFZ2", ":D;h>", "!5rp2T", "jiet: %1!s!", "6Bl1qmb", "ce polecenie w wierszu polecenia: ", "67V6{", "r/w0F", "'|E4o\")h`", "nFdKQ", "d> 8Xe", "Do?;,", "Verifica la compatibilit", " Microsoft Corporation. ", "Fm'}m\"v", "[W0f0", "E!Y'Y!", "``Z+[", "wl/98;", "L_sr+", "e*w\\R", "nl^w!", "ZuSDx", "/|Y.Tz", "EVy%\"", "W[t5z\"%~{", "gWCfqM", "kleme) ger", "u<,/CH", "jq\"/o", "^kAz/p", "-4WW$", "lz=l'H", "?#u.n", "2(,P>", "WHg +", "'=(D%", "$'2_n/", "ide: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "wTv\"0", "r~akow", "rXJ$=--]cv", "vP R]", "0M0g0r0", "Hp)-m", "+bf9K", "lVGdd", "-50Hs", ":\\Z/X", "yCDB~C1`", "Tatz@K", ":", "WAc3h", "Prebacivanje: / Postrollback ", "7TCkB", "e da se pokrene dok je druga instanca instalacionog programa ve", "bQJ~1>r", ".+g_M", "oS~VA", "bban elind", "boru s n", "596O6", "x;x'x", "S2Nr7", ".PALiF~", "]'byT", " kompiuterio", "I>Qy1", "N6Q'{", " }OMF", "CSetupLangIniLoader::Initialize: Language name : %s", "k#>=?", "dFm~AD(", ":-:4:[:b:", "JT3Z2O=", "2viQ.", "c#Rrf", "M~[Ix", "lOHLH", "F0Jl9", "SVWu;", "^_ck!", "igus k", "ckh_YS", "bi4lCe", "9sL^=", "tigen mindestens 350 MB Speicherplatz zum Ausf", "\\:w\\\"", "q3i_e", "MPZDV@a", "Nas<~+", "0ezgF", "G1?dt%", "a`)@O", "Eu30K", "+\"h\"<", "A;=9A4", "e-EW0", "'4./;", "SetupHost result missing... remapping [0x%x] to MOSETUP_E_TERMINATE_PROCESS.", "nQ43pb", "\"qv6R", "dDg{s", "n%vqD", "rer allerede.kDenne version af Windows underst", "Q''S;", ",$YO[^(k", "@8T|1", "L9=\\9", ">T,Te", "}+3VH", "Arhitektura koju ste odabrali ne odgovara va", "e9Js(m-", "QT2i1$3J", "r / migratealldrivers er satt til None, da vil ingen drivere overf", "cqP8&", "#}%95F", "(ST58W", "4F-v'", "Kh=34F", "D1.Z;A", "kK8y|", "bgmKe", "@SK_N", "OgIT;", "`*8y3t", "Eyq[B", "7H[Y?d?\\", "/rqwgR", "U:M_M", "ju vai datu nes", "Gt0mX", "97:@q", "$>D>L>T>`>", "qyc=6", "|dm>#d", "V0Gn4:", "e(5oIx", "a instala", "u#`!m@1P", "}lyT=+", "&28Ev", " jour ni ", "cich in", "dH{=b", "(y)3N", "&$EEA", "U4vW7", "o\".nhE", "y&]z2G", "i in po", "HL_+*", "ranka negali b", "X6]&u", "p{xmz", "aDRPF", "DoY/[4", "I>{6A", "ALs?\\Iw", "wN\"9v", "qEUg3}cgG", "[*d**", "D3 n#", "|7'aI", "d[)De", "tN=0J", "0D6F]", "9v6~O", ":$>R>~>", " Disable g", "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z", ">px493yW", "*7?#pGq", "Q>\"lB9:?", "w47~s", "pc)[,JDY", "6|JX%", "i;pn$a$", "C{v#`(", "(i5!i", "GetFileSizeEx", "|dusK", "9 /z()^\"", "Ho$GO", "-8P,-", ":,&\" ", "MXEzw", "q/]@u", "vR.`kq", "v2V.c", ": / copylogs ", "ZSmZ#iH", "er i tilf", "`T]f-tm+I", "SQc?G", "]MBF*f", "cznika nale", "E?WZ{^", "v;4(gQh", "9#492Fbp", ":U)-t)", "(H}h=34-", "4*>d!?", "Pm!T>", "m*|^o", "#;x9#", "gebbi verzi", "/hm Aoc$z", "Ajt2{", "pkEQ}I", "!gXV]_", "vW]%~g;", "W3@ mL", "8O6;bL", "BHTYd&q", ":7\\=7", "ZLgVT", "C$B/CQkhA", "3%424d4", "KvOKc}", ";Z*l)", "Vj?D9}a", "2E[Id[9G?S", "QPSVW", " informace", "78KPp", "Mc/:N", "I.jA^P*", "x\"M[[i", "x.y7i", "0jJ^B%", "Lwiec", "CoUninitialize", "\"bAd$", "!CTp8", "a;Y+G", ";zb5Lu", "tnGfJ", "k)U\\X ", "l*=\"$_", "vP1?D1Q", "LXlS%", "Przygotowywanie (%d%%)", "CDlpFile::UpdateProgress", "J-FER", "nd. Den k", "0(?aV", "ksytty, tervetuloa-ohjelma ohitetaan, pikapalautus p", "M}E*nE", "d}R19", "ConstructPartialMsgVW", "f?ex@", ";5Zow?", "c}eY_", "LBG!s", "92:9:", "d!EXD", "is>}(", "OD\"Zz", "QueryDosDeviceW", "wVD$h", "t8jB=Q-:_", "=aa\\O", "_%ENf", "`lnx8Mp", ";\";0;T;e;", "o : Injeta o ficheiro setupcomplete.cmd a partir da localiza", "KIMFR", "3)3y3", "!pQi6H", ":r&i[r", "m$Ee\\", "HKEY_USERS", "8NG#*", "tbdB6/o", ",=T5l", "Vt%}w", "RHr`'p", "wuOEfV", "CDlpTask::Execute", "I Vht", "puj.YPy", ".CRT$XLZ", "|cr\"*Y", ":A5%Qe", "UjMSw", "f;?bf", "`J}gp", "liti: / Postoobe \\setupcomplete.cmd ", "rio de utiliza", "Clean ", "njem operacijskem sistemu. Name", "tKzOn", ":tpO ", "Forberedelse", "Ki|Qs", "\\g;J~", "89dQ@Z", "43HGf", "sqg!ul+}", "NHd%]H<", "#tvK>O", "#yu6+", "CDlpManager::GetQuadwordPropertyCount", "iXs8m", "4C&_A", "0T0Dx", "Ga3dPI", "e OS zadaci niskog nivoa. Slede", "J6}~|", "3jV2%>z)", "o]p|2.nu)1", "l9me#@", "windlp.state.xml", "Sxe_N", "*8JG/7;Nc ", "@'-Xd", "}< Ck", "E&dasivSetup.exe installib v", "n85>_|.", "\"8|B/", "+UO_9", "EqN;!", "g8vfB", "zi+w$g_", "0)Vu#", "(lc6R.G", "#UdGhm{", "jl\\setupcomplete.cmd", "&wLR3", "kleme dosyalar", " loadFrom=\"%systemroot%\\system32\\textinputframework.dll\"", "Lh!I3", "g^uBk3", "htekaust sisaldab faili pid.txt. ", "~qdgl", ";ZI`I", " namestite ali nadgradite sistem Windows. ", "7\"IOvo", " su nurodytu produkto kodu. ", "rBUJI", "e datoteku setupcomplete.cmd s navedene lokacije. Setupcomplete.cmd je prilago", "5REL'|", "cM9+C]?m=y", "(M,B$", "9s+yE'lS<", "`|;7`", "v:xc>", "Jn=9`+)", "CK)}F", "qT>9G", "K-.G~", "f]wEd_", " en production. ", "DC*Uf", "*@j:cF>", "F+Kl1", ":-Re4`K7", "1eg8E", "l PBR. A kdy", "R}'1M", "4?X-|", "G},lH", " lLm;", " name=\"ucrtbase.dll\"", "F,(rJ", "+@ZO*!", "-,MOJ", "&,V/sWOo", "U?4%8", "_o&,j',Z", "\\JCg#", "^H)[B", "Toiminto: kun valitsimen / migratealldrivers asetus on All, asennusohjelma yritt", "MizQ:", "v`,gI", "- Windows 7 Enterprise ", " 25 tecken ", "TW'45", "'4h @%", "D9_KY(", "6ekF|O", "`|iF0", "i,Q|CqM", "Yc+D}", "^;)t`", "[y}^H", "l)t?D=s", "Ihu+>{", "(h+|o", "SO5@q", "=,TsO", "al8Kb", "f$G}2L[[", "m;N~'", ": gs?", "&Vorige", "b.d2J", "Yasal", "N'-2i", "t?s8(", "010>0\\0v0", "dI[wt", "+a)Dk", "kleme diskini kullan", "Primer: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "Compatibiliteit controleren", "w7|Z]", ",Bk'[P", "xQzrw", "Alusta algusest", "*Mz", "Commutateur : / installfrom ", "Q`@!q", "/PostReboot", "9TI)_", "X9?nZ", "/CC,J", "AdjustWindowRectEx", "0!b%;9O", "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> ", ".}/DF", "anu, jo tr", ",(L/{", "=%c4UU(", "$8&If", "6r\"n'", "AD}jl", "FD^4d", "\"2T.&", "0Y[|g", "WU]]]U", "HQ-h?", "tres par d", "C%1!", "iPQeTA", "O+qO-Q", "5tqr~", ":E_H}", "_ftol2", "Ae/gPW2", "aUcAVzo", "16_*!_", "grb;v", "maD$}", "Z/%J.", "za`Leh#", "d(I.>2:", "CE~kD", "h\\Kx8", "_Q+r'", "2", "XRoT &", "finis sur leurs param", "]r#q{", "cutez la commande setup.exe /? dans le r", "\"<=MIn", "Mq[~d", "Rw\\#H", "4k~ ", "M['gQ", "31tYKh`p", "R36Bjl", "r*kZ^v%", ")Po5[", "(ux|j;", "vRx`L", "\"IMfv", "Vd?b;", "?1KUz]", "[vv~~/", "mE.*/^f", "Primer: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "50yW3", "EventUnregister", "tte / PBRUpdate v", "Y-N", "V6]GG", "(HjQcl", "acak.Z", "T^Gxd", "@wU?0", "=U(w`", "(XZ33g", "O8Lprr2", " de instalarea e", "L$$QP", "ico orodja. Poskusite znova zagnati orodje in izberite pravo arhitekturo.6Pri zagonu namestitvenega programa je pri", "ba: Ja / showoobe ir iestat", "8]Q]f", "@?%`l~", "$`2j)", "Perjungimas: / Postrollback ", "_xbBh", "=MD62", "viD9_", "ke u instalaciji pokrene skriptu setuprollback.cmd : ", "\\/Xa6", "3%-`\"", "K^Kwi", "E/Z>mIh", "dY3Ky", "s lietot", "%XrF+U", "//uX\\", "N!ey4qa", "Goj,o", "R%0vV", " name=\"wintypes.dll\"", "g[h'fd", "WdUms", "NMTOKENS", "=q(4g", "U<{Gv", "FePYT", "'Qn?K", "z:oF@", "b+y@~", "8*8X8f8x8", "s^{b^", "h,U72", "Akcja: Gdy prze", "g;sSE", "igus ", "I_Pj{'sM", "<`Yd7", "h@+%6U", "2`Sp4", "#<}sf", "FqTx&", "terek: A setuprollback.cmd f", "me1$F", "&W1ANx/@", "xprFh", "y^&0dAc", "4+4f4", "*\"bRRU Ej", "h>Ri#", " automaticky restartovat, kdy", "o: / PBRUpdate b", "zLLV&", "\"(m|e", "p8r4~", "?-8m>", "e ustali", "Parametri: Full; None ", "(A2M(X-", "EAgU\\", "n0`D\\", "&ptal", "urare, dar sunt automatizate. Acest comutator presupune, de asemenea, urm", "=g6q.", "KwzO|qco", "'3^m-", "ss{tL", "v:'n!!a", "4C1eY", "0$000T0\\0d0l0t0|0", "m3[ky", "]F/7\\", "~si.t", " +XB'", "*5Obt4", ")\\BFr", "inverse, si / PBRUpdate est d", "]Intenta volver a ejecutar el programa de instalaci", "xel: / installfrom : N", "rOeq}", ".?AVCAtlException@ATL@@", "9g>lYvq", "NzH'>", "5N/yIN", "\"x|Ln", ":hdm#", "a v kontexte syst", " name=\"coreuicomponents.dll\"", "1J2kW", "ubS_l", "ches de syst", "S^iV~B", "6N!M<&", "sMxG;\\&", "ben fut, ", ">:=[p", ",N{,/", "f\\gn*", "6)606C6L6V6g6{6", "e i postavljaju se podrazumevane postavke za komponente. ", " reiniciada automaticamente.2N", "*@", " #-7@[p", "dAzB_8", "y/8DK\"Z=", "v!PBV", "-9hR0I", "n intentar", "Y9=^',", "7&7-7^7~7", ":raP5", "1WSB>j", ">MTg@", "3 3N3^3d3v3|3", "oA{b,n", "'i]2V", "Nep{+g", "Lsf4*=", "7VaZn", "1)NH&l", "c_AKG", "iz?+P_", "%|I~\\7q", "&:\\rt5", "wbIfg", "mF~bVn.", "UId9{z?", "M|*ks", "SM60@", "%%\"wD", "uTbLl", "080A04B0", "BSDz3y", "*O'~dK", "/j25C", "=W4m7;", "PpYXX`cc", "Searching for ESD files...", "Wz8XJ", "LUhsI", "GetCurrentThread", "@&o2j8", "Pna-(", ".data$brc", "Toiming: esitab installiprogrammile m", ";1\\Fh", "9,~r2", "5FqRl", "mfv3G", " informacij, odprite storitev Windows Update v aplikaciji Nastavitve.", "Fq8&2 l|", "J.#%hqF4-", "O3bu?", "f)b@G", "rYvg_", "D$(PQ", ">J|=~", "CDlpTask::ExecutePrepare", ",D,i@,y", "Y$17<", "1_G^p", "5Bx o", "deeFDFFFFFFf", "e)lh@", "r.:E ", "UzjH8I", "Lv&rYj", "y]Qg~", "telek elfogad", ";;\\M_VV", "y)\"oW", "Action : Setup will inject all driver.infs found in the specified location during the installation process.Setup will recursively search through all the subfolders of the specified location. ", ")&@d\"", "aeO_&", "9CyfRQ", "+{-|t", "qR_T/", "d^d,w", " loadFrom=\"%systemroot%\\system32\\wow64.dll\"", ">$?>?K?s?", "`C;?UN", "LvS-P", "Pripravuje sa", "Pq'%T\\", "t7=@O", "DcatR", "B)3y(", "Esempio: setup.exe / auto upgrade / Telemetry enable", ".fjDw", "[yM'pW2m", "o6.%F", "GetCommandLineW", "LU5E@", "tter n", "2x/!2'", "9dBg=", "moo/..~j", "o. Se / Telemetry for definido como Disable, o programa de configura", "PVbF'", "bO3'7", "!M N$", "Comutator: / Postrollback ~", "'L0;]", "righeter. ", "YA!_@[", "ceQBf", "t8j:r", "como Enable, a instala", "CDlpFile::GetState", "4PFQL", "{T", "*.FNY", "#PE87", "&XK('", "qt$n?", "\"oW'E", ",G\\&]M", ":DO&s", "33,-}", "5xa`+", ". O actualizare de caracteristici ar putea fi ", "s*I;m", "GBK/J", "1pg}Sf", "SYSTEM\\Setup", "Ad\"Hg>hv7", "-l,Etd", "6s;ur", "'{BOdl", "/OK$`", ")/fh5s", "bn: ", "b?v:<", "0Hvzlm@", "w=b^6", "K'A_\"", " qmK^", ">y%11", "?+xz?", "qpJ_0", "i3Dfd", "1J9L0", "lich Rollback-UX. ", "ky do zadan", "xz_n1", "~F/gT3", "rK~|f", "Toiming: vaikne t", "|aCr~*", "yla ayn", " loadFrom=\"%systemroot%\\system32\\wow64win.dll\"", "*kx_^", "22~5F", "ix0fE", "w>%fS^Yq", "bp[=w", "9'919T9o9", "t :'*chW", "10.0.19041.572", "outil. Essayez d", "hU>:R}", "Ewb{>e)", ". A kdy", "Ag{RU", "W^2W{xT", ".VMuA", "", "Q50h`", "*T(6!F", "3f&$&%", "$/qzEU", "o que indica %s bits. Quando voc", "B-Xxwa", " z navedene lokacije. Datoteka ", "WBhBN", "1ml2^", " neprob", " finalizeze interactiv OOBE. Alternativ, c", "hrt wird, m", "Prebacivanje: / noreboot ", "Ixkpd1l", "PwzJL", "SEbb*", " pri inov", "8m8}8", "kGY\"-", "Y:|`F", "G2'bf", "V9Fn]", "}1`eB", "N1%NsH", "*^|3lj ", "nssnittet och f", "CharUpperW", "None, a", " rozhranie in", "3Eq5A0", "B;/eG}", "nJoe4<,5", "h8'Na", "90L0R0", "+^F5Z", "Tr=s\"", "|. zV'", "kgL)b", "2.JL!'eN", "xel: / quiet ", "vH;ZTP", "xhF/.c", "^S~(g", "YWm'+", "Dejanje: namestitveni program ne bo samodejno znova zagnal ra", "lgende kommandolinje kan bruges til at igangs", "vania in", "X`]H?", "&{3(Yk", "6n0R`", "iuni de actualizare dinamic", "l^`(B", "@M9s7", "o reiniciar", "/i*NR", "ype:_ut", " cesta UNC k souboru s n", "L^;%z", "DZHqC", "\"4:jA%", "k7v|~", "Switch: / DynamicUpdate ", "uc?", "#Ux?}", "*]6LM", "b.Qx}", " na hodnotu Full, koncov", "< =R=", "2SA+6@", "Handling: Installationsprogrammet inds", "@>U5xX", "J78 O", ".?AVCWinThread@@", "anja instalacije sustava Windows", "kf0s-", "F@\\'@", "&->z/", "\"XvK8(mv", "_3v2J", "UL?\"E", "hren, die Benutzerberechtigungen erfordern. ", ">Vck!p$", "nek vissza", "z|xd{", "qgHf-", "d;y :>", "6AZZ~V", "rz_]y", "dfjSA", "{ Dp*", "/h0a,", "=_Zup", "Comprobar compatibilidad", "Z2y$'!S", "wCkzPm`", "0g0Y0", "t~J=/", "6~6|S#g", "Ni/[LX", "(9p?j", " ", "v&Y{{", "js6&Ob", "ba: klusais karodzi", "J%VV|", "BGB8UP", "])p^&", "XN=+HWJ", "hS^?i", "6Z8i8", "{wMQt", "sp@Zd", "su datoram", "&Baigti", "/ha75", "|2~kn", "sq?1jq07", "+),TX^a", "N*aiO", ": setup.exe / auto upgrade DynamicUpdate disable", "5JUjX", "/Mk{dt", "1+KZ:", "#b]B>", "YZcgC", ")~&*T", "(Out Of Box Experience). Met de volgende opdrachtregel kan de volledige upgrade naar", "0|xb}", "~|{Zm", ":~,C\"C", "[Tw.-", "000@@@ppp", "(8.Ek;", "Q\\L+z2", "Cance&l", "unarom. Na primer, ako ra", "Qg.", "VersionMatch: Source exe build version is: %s", "HpJ#L", "1?1O1V1I2e2l2", "\\Pk'5j", "sben megjelennek, de nem automatiz", "Zkontrolovat kompatibilitu", "0O1V1g1n1{1", "<(P~]", "^.uEe", "Kj7Jc", "'A Windows 10 telep", "nhk!uNRz", " znova a vybra", "zs3?eq6", "$Kd$'", "1-2C2", "ar>3L", ")cx", "555;5M5Z5`5g5y5", "`_Yl=", "UL6dL", "}{\"%,", "XP+bhn", "YeMKr", "Kompatibilnost", "B \"oe", " OOBE)", "MB]O3@", "7@s)P", " Disable uppdateras eller skapas inte PBR-partitionen ", "c ", "sZNIv", "F1lA]", "Ai)H;x", "T'?n+", "mP>tz", "2?rxv", " in the root directory of your installation media.", "z*u.\"", "wDDgi", "bed\\|2", ";#)pT{", "Qvz+I|", "IN04y", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "cz~Bd", "7B`%I", "W7hp]", "n no recopilar", "(MbMd", "8.8@8`8r8", "TpO;O", "Windows Kurulumu, eksik y", "ppkasutaja OOBE interaktiivselt l", "9@\"g9K", "|Da$o", "o#19fi7+;", "N`!6F", "N~/_W.", "B[W#$", "$c!sby,$-", "#8 \"m", "GT2_R", "{/~$Y", "htSXU", "uGRj/S", "5d)3 zu", "&Zavr", "0F +C%", "zn[+~", "]7`-Ip", "!robV7", "sr-Cyrl-CS", "GetCurrentProcessId", "utilisateur final doit compl", "YQD{Y", "oS!h'ug", "_TN%v", "vS-,_", "g:@zah", "Z3Zbo", "v`G~V", "W'`i]", "2t.rm", ";y:#tI6", "1", ": / migratealldrivers ", "G]8'0J/", "T;a.uS", "UYHC.", "dUFrJ", "j|FQ0", "NZruF", "+dP!'+'", "d#]XK", "\\{`(T", "?yq;,", "b3qO/", "in ge", "57,MxM", "b4g&{l", "vu%xK", "[(S7i)v", "uQ=t'", "DpVz|", "uk&w4", "rbereds ", ";#<3.Fn", "rj}m,", "'(9Hi", " valitset oikean arkkitehtuurin.,Asennusohjelman k", "%&&b8", " um script personalizado para realizar tarefas depois da falha de instala", "XGx2X8", "fQul(EY", "R8,8[I", "~|&t&", "vka<=", "$Sjb_", "0Vo_'", "u;y\"N\\7m", "A\\K!Ne", "l_5vN", "F58$z", "!p4&MN", "`-94n9", "%>tB!", "d-`6*", "MainHr", "CreatePath: Unable to create [%s]; GLE = 0x%x", "l6((v", "lc=x'", "4;b-F", "Esempio: setup.exe / auto upgrade / quiet", " migrar todos los controladores como parte de la instalaci", "}nQ=?", "y*w|'g", "c}tj1", "\"j;K3", ": setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "0X%_F", "Q;asMr7", "ua!)#K^", "4,+}cy", "z]x_9", "'XtUx", "Example : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", ">Sh;y", "ZBp\\j", "/xk5~", "nce bir yerel dizinden ba", "\\setupcomplete.cmd ", "#0nz:", "fini sur Enable, le programme d", "9;9U9b9", "elite prekiniti?2Ste pripravljeni za namestitev sistema Windows 10?", "WW+oh", "wW#}_", "p-bYP^N", " Windows 7 Enterprise. ", "s olettaa seuraavat oletusm", "<}U8p", "es de diagn", "Aloita alusta", "8~yHC", "PO5uLwN:i4)", "$*6Ce{", "Ka[}&", "s(JzI", ">MdSpu", "E1vP5n", ",gM3l", "&Tilbage", "SQ^aXN", "B:h.+", "\"l}m=lQ", "*P/I,%", ": / pkey <", "}7qA]", "l*ZX`9", "/_512", "p%]-6", "o\\\")~%jiG`", "dia no disco r", "SendCallbackMessage: [0x%X] -> user callback returned 0x%X", "^KUm_6", "K+e&}aD", "qaZl-", "nt. Ha a / migratealldrivers ", "/&}S1", "0L01YWeW0", "toarea linie de comand", "Egj,K", "x@f/f", "]L3P3", "-zOoIIx", " Windows 107", "^$~ =", "l\"`,Q", "?NKlE", "?6*_q", "nRSa<:", "20201008094712.797Z0", "JU}\\m", "?b!\\`", ".!D@-J;", "ye_:6S", "A<-oB", "D7Y.n", "ja izst", "aX0 d@", "i UNC-v", "vhbs7", " v6/>", "VQJ:q", "*fd893", "pJ;\\+", "f|$O`g", "V{z&N", "g\"oR9K", ">ekx!bu", "I ett annat scenario kanske en administrat", " se vy", "hbK.b", "_]$2_=O", "^h^l]", "O[g1v", " diegimo funkcijas", ">[a.-1", "hrl`EF`E", "mT>3a'", "W0f0D0", "-6ucx", "N9n\\oF", "Ug5XMV", "<#<8\\", "N(CCP=Qn", "pa43M", "N5{L3% ", "Uxw%Z", "v'Wp.V9o", "NMZV ", "C+P8Rj", ".P&SG'", " du bruke 64-bitersversjonen av verkt", "CDlpManager::SerializeSynchronous", "dn7VU&", "hIhn7_", "L? A]", "F\\C~(?", "!xbeE", "Valitsin: / PBRUpdate ", ",iDvF", "R3Hb6", "LbJ)#", "080404B0", "S2}j$8", "Conmutador: / PBRUpdate ptkg", "yG2ln", "?WI'M6oX", "/0c1Z", "*%..i", "_K,xW]*", "Veiksmas: kai / PBRUpdate nustatytas kaip ", "7N{g!", "q_(Mn'{L", "z}YApl", "i gata s", "gLGdX", "ScreenToClient", "~Rr^F(j", "6\\X`28", "Q'lFP", "B+~~ZhH", "*YQpE", "Mtth-", ";pgp@P", "ft6{Z3.", "Tp'x\"", "r)0d-", "vPDh~", "}c tV", "CDlpTask::UpdateProgressTransfer", "QzN|f)", "'ln1h", "5_AK6", "nrJ/Q", "rsa, kurulum, y", "6M,+2", "nimo de vers", "f&fOSE", "*8t;B", "'(p,=", "GetKeyState", "ixS2g", "mn-Mong", "?l#An", "`,FrgB", "s nevienu draiveri k", "trPWQ", "krOV\\", "=356F", "PCxR}c", "m0MiQ^QJE<", "anas programmu v", "#0jB){", "\"oE>\\P", "&O\\'Z", "u1-#~", "U'C{>", "H{6@t", "mu programu pokyn ke spu", "Z_\\rt", "U>gI/b'", "_#Z0y", "'=o}5", "(Jm!%'n", "V*XV},Xu", "&rP_a", "DEBUG", "N#}[4", "rnek: setup.exe / auto y", "r Windows p", "5\\nvV", "Ajf):", "$L_gW", "/PQ},L", "w7fEF", "zi!m6", "E U T", "lda: setup.exe / auto upgrade / migratealldrivers none", "hUM4V", "7z+~jxPf", "xP=t~", "65zoi", "(VLDuR", "w7EVQn", "Z[ {K8", "M sS8", "Oalz*", ",#MuV[", "LEb5V", "~d?d_", "+A=gW", ")I9JHcHs", "7sKzH.#W", "c-7?n", "`}=%6", "mjU'x", "ybg6f", "MbcXN{", " disk", "Skipping cleanup.", "ka do pliku specific.wim ", "Parameetrid: N/A ", "DR_2H", "*cpnJ", "I=1+y", "Jogi tudnival", "ivoTk[", "F$Pqaj", "4yL\\`B", "_ \"4+", "]w$,;", "~|7-3", "Parameetrid: 5x5 tootev", "%Nm8n", "R)U:,", "_^CQU", "T+TKy", "Qp3A3", "646<6H6h6p6x6", "^Cr ", " instalarea, cu op", "driver.inf", "IOfof", ";dPwhz", " ", "O\\zlZ", "R1Bgg", "#`+jz", "&L5`*", "th1uZ", "7JIT&)S", ")yDp0", "0O1i1", " Windows XP com Service Pack 3.", "SG2K|GVl", "F6QsE", "h~tx_", "s;uZe", "Action : / PBRUpdate Etkinle", ",i(,N", "@.}'Kfg", "=`,{{", "Parameetrid: .inf-faile sisaldava kausta kohalik failitee v", "uN[>K", "nCvGi,$", "n42Ev", "3>DI\\+", "ra en fullst", "jg-s@W", "AMF,o", "I9a!~n`p3 ", "QuAp|", "~w,$x", "{)E|;J", "{,)PZ", "Preparando %d%%", "(DiKj1", "Metadata", "D$(PSS", "u6Qn$C:", "]1fuk", "tan ba", "Gcx2IJW", "l;.;!", ",Dyo/Dy'", "5$5O5", ":@YU(L", "ORF>;F2r", "Hkt1H,", "7#Z$a@", "vv:W<", "cw3H}", "Ij$IR#I", "vgP\"s", "GvASk", "@ ;F uZ", "GL+Y]", "Parameters : Local file path or UNC network path to a file named setuprollback.cmd ", " de produit (Product Key) sp", "1n],s~:d", "y{Q%:", "~k(fk", "gZvRR", "S}#x}", "K5A^D", "$ot)H5", "*8nMaa", "?lf%Q", "f>Nk/ ", "utilisateur ou le processus qui a lanc", "(-mhNb", ">OZ-q", "mx.bp", "Voorbeeld: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "x6jC{", "las nakt", "b\"G'#", "^z#+Y", "J/&o'", "Pr\"J\\d", "Z5Kk6", "NTFzG3", "A*#iv", "Vn7Xf1", " / migratealldrivers nastaven", "%PJrg4", ": / migratealldrivers ", "to telemetriju. Tom", "^-yB5z", "Vielleicht m", "0jD,t", "+.v,;", "(0x?Whu", "3IoWP", "m o Windows 7 Enterprise. Ela n", "{B\"Z#g(", "46{W=", "\\:6hj", "gVO5h", "mgkEi", "S8_xv.", "b8d|?d", "hPlEW", "_r%W3", "fo-FO", "{~}^?", "kleme i", "8>o,1/", "d3M{,9", "324F4_4", "*Rgwr", "~CM6>9", "pO}q]", "ZQz9#", "ARu|C`@L6", "u medija za koli", "ti vagy l", "O^R?#", "rZy%R", ")2|e8", "Perjungimas: / migratealldrivers ", "KXgl3", "0j,N;", "enie. Sk", " loadFrom=\"%systemroot%\\system32\\bcryptprimitives.dll\"", "cmd.exe", "k0;bY0S0h0o0g0M0j0O0j0", ".idata", ".(p;R", "R>)ZK", "-W|&&", "rwG$GM V_U", "YKwWo ", "lye a m", "eE8dO", ")4?A7P", "K#N k", "Primjer : setup.exe / auto upgrade / noreboot", "Meiryo", "(N{lC", "3The architecture you selected doesn", "hJd,d7", "#|d8E", "informations, acc", "b:xhS", "B_f9d", "%9Nc{", "QB1cD", ";g<{<", ":wwa[", "oP\\mf", "es-NI", "cV M;apR", "V`rIb", "Jy2PQ", "rd@`Y", "Pc}f1", "+Kcc7", "-u.$ag", "|+@tL", "s diegimo sugeneruot", "K['8Ln", "C`Vfx", "OJD}D", "_/N>}m", "-5p)s", "9RH!mx", ")4=]_&", "&-q6%", "3^brD", "'dxq|", "t start properly. Please reboot your PC and try running Windows 10 Setup again.", "C\\u.{", "8V:w?", "_B.6q", "DY^cC`", "D]#:u", "las, lai lietot", "606c6", "5=j$^", "u=MJ_", "(~^U-", " sau face upgrade sistemului Windows. Urm", "XR!'k", "S?_&n", "Y-)4F\\N>Y#", "aduje jenom v okam", "^h()I!@", "IC|k<", " ", "MOyOQAz", "9++tW", "MFC42u.dll", "$6S=5", "(jk5)", "r X(Y", "H1:61", "Eewg`", "Z{+[z", "Z$FTF", "I|0N'1,", "}|,>cO", "c)`oUa", "FillRect", "hDp -y", "?6v&z", "_cqT\\", "O{n1|", "NdUua%9", "mY`QKA3", "xDLC6", "tres : chemin d", "}3y^NU", "U*h_l", "qXPd[", "@f]Cu", "^7O2i", "B\"Ha%(", "g: %1!s!", "^V}a>", "6VZdl", "UaWzt\\G", "' k)H", "DpA4$", "oLxD>", "Parameter: Ein lokaler Dateipfad oder UNC-Netzwerkpfad zu einer Datei mit dem Namen ", "aI7vS[Z", "UJp4>", "2&2-2H2R2^2e2n2", "D^Ue8", "1y^X*", "6ln':", "ra installationsprogrammet igen fr", "GjL4j-", "n para obtener m", "i\\SQT", "Azione: consente di inserire il file setuprollback.cmd dal percorso specificato. Setuprolback.cmd ", "g>mpJ", "", "uje sve potfascikle sa odre", "Comutator: / copylogs ", "4`d5`", "\\j0O0h0", "n*0KehV]", "k7ySUJ/", "z@XGd", "K!. 4", "jams, ir iest", "#uq.X", "*r&!g", "$ [Ri", "YBo\"LNI&L", "qrvrbI|", "q7R2 %", "ivitatakse s", "5xnO\"c#c", "1-/aZK|", "F7;Jx", "LlS%X", "2hkn#", "/RO?f", "ja at", "|rQ]QK", "&rGONG", "Lejupiel", "g~S&4", "3Y[4E", "Hr!.M", "GhLu}u,", "&;^vg", "Deleting box result...", "ranka ", "FYp\\6", "Dh.4$", "(M2C?", "'zzg9z", "hrend der Installation generierte Telemetriedaten von", "^Rw$C", "ZK7*R[#", "E5%p*9", "Parameter: / Telemetry ", "s=4PuX", "?fHei", "aukti", "_d.XN", "4X@b>", "A&.o`!D", "Xy2bX", "lectionner l", "ZrdTd", " 5Z:`a", ",#7suA3", "ami vismaz 350 MB br", "eqG", "A Windows telep", ";xDRh", ".{u9}&O", ",\"52\"M", ">^=>6VMG", "^-N(W", "$m3rI\"ms", "InitiateSystemShutdownExW", "jt<-5", "Successfully hardlinked: [%s] -> [%s]", "EPeq;m", "el=#(", "Pm:]g", "U&@ba&%", "GetTickCount", "Tq9k`", "&Nw;U", "A a65U", "+u;kJc", "ExKKudy", "%:veh", "kalu uudelleen ja varmista, ett", " diagnostikos informacij", " J1Gdx", "REMARQUE : Ce commutateur doit uniquement ", "<+pw'aK", "[AL?l5", "2pS#y", "ETQTM", "'Fr@rJ[", ">:`JV", "&aw'<7", "Ts\":Q+9", "Esimerkki: setup.exe / auto upgrade / noreboot", ",=oRG", "8T&AL", "r=4+.", "ndas i produktionsmilj", "%r,h=mn", ",|zL}", "Ql\"`U", "Qh0L@", "#{17Y4", "sQ,XO", "Jm]'H", "interface utilisateur.", "=V,H>", "vv9T8x", "j95H;Kp;w", "gaO>6", "fy.~,", "}&%\"n", "v*M4X", ".?AV?$CAutoDeleteArray@PAU_EVENT_TRACE_PROPERTIES@@@RAII@@", "8a6;8", "q;j", "tC;f", "1(2F2", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "2.HIQ>:", "r/4+~/{gR", ", rad", "!EO[!", "mOnline Windows Installation Box Stub", "D3Q4#|", "32JQ[", "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x", "~]xGmU6B", "F71", "F/E=FS", " X)-PPQD", "0|&3I", "r?CI\"", "k/19Y", "o?T:&", "tdLQI|`", "ZqV<:b'2", "rX2_P9", ": %1!s!", "L8$xV", "OpenThreadToken", "MF& `", "i1sEu", "MyO'Qr", "WzI!\\F", "sjJg8", "]$b?_", "[Ly19", "~n.n^", "Opzione: / installfrom ", "Parameters: Local file path or UNC network path to a file named setuprollback.cmd ", "Lc=?=", "=A>jo", "@6j@X", "installation n", "s darbu. ", "dG3F*f", "~eBb[", "$t8j<", "\\lJ?/", "n. Por el contrario, cuando / migratealldrivers se establezca en None, la instalaci", "EF}(3*", "A!M_M", "jligT", "\"m;b$", "}]8M]", "%>Bv'", "qQ=/3", "+B<1`A", "CNBoqq", "ATTLIST", "Eksempel: setup.exe / autoupgrade / migratealldrivers none", "o intermitente da rede. Repita a instala", "MXd'+4", "7$707{7", "I#h P", "f_|:6", "/I7LE", "P!@pC0\"", "Z );W", ";NQzM", "7o0;c9", "orp4\"tk!5W", "w:f>Nge08#", "O}/<)", "ki?RdE", "n har", "r{lXp", " narz", "Beispiel: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "xf4\"1{", "K_Qd]", "@HJui", "&>Q%3", "GDx?F", "UT}\" ", "3$-BL", "I5,H:aA?", "qY_QVt", "-l*Hz", "{-c68", "iljanje telemetrije je omogo", "fy/zk", "5HP'E", "-SBoh", "j;T{W4Uk", "X>\"6=)v", "hKm0R", "q3Femb", "5@_ss", "kHeau", "Leelawadee UI Bold", "anai ", "k gA.", "/@+/A+", "id*'F@R!", "4jA|%", "Bw/&#<[", "CQ)P5d", "p_8xZ", "Gfeh-q", "XIMR{", "r }\"R", "mu ni", "JZ]b?p", "l. A setuprollback.cmd egy", "n pero antes del primer inicio de sesi", "|D:4<", "~&=+0y", ")4YNU", "2E>xn9", "Commutateur: / Postoobe \\setupcomplete.cmd ", "U|)xo", "ZE\\uU", "(JU46", "=d|OJ", " Windows 10*", "455H5", "nQ{e>", "x`,!c4", "@((viG", "rCBC>#", "HT0Rnl", "7{!~}", ")d:j@o", "OQ8W@", "hX,zb", "z4'le7", "_ao?C", "'cQ\\;", ":Yx6c#", "ZOIc%", "f%d:R", "4tF%Px", "A&nnuler", "BqY,#", "&~e$b", "ts-ZA", "E}keZ", "L'installazione ", "&bb2FEdJ", "Tlwb+#", "`}X{C", "/(( ", "tfv%)", "p~1$r1", "J79CI", " L4k/'!", " name=\"dwmapi.dll\"", "sf-;b", ".idata$5", "10(1~", "=-f5Ms/", "xxl?i ", "A*0$*", "=,1_Z", "'u'", "Le@(", "Instalare Windows 10&Instalarea Windows 10 se execut", "vi, ja / showoobe ir iestat", "Redmond1", "sdBm2G&", "@]rS^", "+onBc", "jungti, s", "d@+;S", "zt.xA telep", "A+?cB", "J:J5gC", "(d$PH", "\\\\Jh(*E", "QZ&hg", "Tc;Nqg", "kl#hgg", "X*8n<", "%3G:", "x@8Kd", "|i2rT", " verziu XML(Chyba pri sp", "r?-:,", "T!mjW=", "o+GxBy", "o]YEyo", "~e#.1J", "-IMZfL", "u]na]", "Stsenaariumip", "ber hinaus die folgenden Standardkonfigurationen vorausgesetzt: EULA-Annahme, aktivierte dynamische Updates, Sammlung und Upload von Telemetriedaten sind zul", "C[|Wh", "K%WSI", " procesul de configurare ini", "n din", "O_c#=", "\"H'B&", "(^wUD", "?5&n(", "b%]A,H", "\"$gc?", "#7\"Nr", "igus migreerida k", "inizden emin olun.%Kurulum", ")-!>%E", "W1\"eD", "uXg`Y;", "#8h$eQ", "m};I7", " Ob]_dh0", " sist", "jya`X9o", "I(S1)", "cznik / showoobe ma ustawiony parametr Full, u", "%;A=O", "gU9(K", "3|>xW", " sau calea de re", ";yjPu", "nda, kurulum, y", "!ueXXq", "0<^8c", "5Virhe valmisteltaessa kiintolevyasemassa olevaa tietov", "u4#4K", "5)){*_", "elV8$", "el programa de instalaci", "}|o{ ", "ufFPv", ">bMBu", "=0Cje", "8T!Kj", "YY]R=", "BCryptCloseAlgorithmProvider", "=@~`yD*8", "Wx +4", "l&E4Z", "X %46=Q", ";NDZ ", "Preparando_El programa de instalaci", "(}m{\\", "IaSD)", "0/*o~CS", "L/Ys(", "4Rs\"8", "k3B>w&#", "cii. Ak je v", "Wa}6T=", ".GFF\"", "`)sgb", "0A$$@/", "}ESf'7", "j:Xf;", "E>Xxt", "13Lz33", "2x(uiR(", "lvl~s[", "quc-Latn", "FreeLibrary", "installation depuis un r", "8 \\ghO", "Installazione di Windows 10.Installazione di Windows 10 gi", "stico dos PCs de teste, para a eventualidade de uma falha. A linha de comando a seguir instrui o programa de configura", "vU_-N", "55c3Y", "rskendamise toiminguid (v", "0'>V3", "i{\\j%C", "1#1]1q1|1", "fp@5[", "Installation de Windows 10", "n de Windows 10 se reiniciar", "Wybrana architektura nie jest zgodna z architektur", "u\\1B2", "hA_`c", "Hjs*F", "808;8", "^;t!l", "'5V$5", "bcrypt.dll", "`H?Tu", "CmdLine", "ig angezeigt, sind jedoch automatisiert. Bei diesem Schalter werden dar", "Parameetrid: Enable; Disable ", "3q;,h", "yR?_e", "j@~-k", "galement souhaiter collecter les journaux et les autres informations de diagnostic provenant des PC de test ", "e nadgradnjo izvajate s koli", "6Ze\\kI", "m]~K==", "w(Hx~N", "]E=E ", "o@gN)", "]\\x{5H", "c< aAMU", "|T>)_", "MVIde$", "P]6V7>", "[`[;m", "zyId^", "KQ4HVR", "LsSVp", "ke izku", "FVc\\p(s", "Sm#gL", ". 3g+S5", "d%fHQc", "X2>>>", " SXh!{", "1 1-1Z1z1", "=/334", "@j~65\\", "o recolher", "dLzWv]", "N8J/.!z\\=", ":NOgt{", "6h:#~>", "uh]7)", "=K]gR", "4Eu]bc@", "RegisterTraceGuidsW", "* k{v", "UZL>W", "zOG}V)", "q0{A9", "I?;N)b", "uQC;_", "(g#U[!fll", "''y(JIjP", "JQ_yb", "Es+UT4", ")luF6", "UsE!6q", "wNpNtNrNvNqNuNsNw", "`v`X^", "b6RW0~0Y0", "uU9|D", "hrt, durch den Setup gestartet wurde. ", " spusti", "#Se preg", "EnumFontFamiliesExW", "s6e$/", "D_2HM", "{0l|%", "r ve bile", "WI@>M", "6~J.'", "V/n?!", "a$yvu'I", "CZ&t?", "4'4.4F4M4f4", "n3f%/!", "IctL:", "OpenCABFilesInFolder: Expanding [%s] to [%s]", "U0@'~us", "L`9]c", "97wenjnk", "c&['5", "?X/o7H7", "?~=`n", "KOgBF*Y", ".&Yc-+", "};Qn7", "lH/1N", "'>Wii", "FASN8", "Veiksmas: s", "BuloN", "-PJ_,", "CjD=~", "ob!KWb", " telep", "Ue+TYL", "(/Vn+", "%s: Install.wim/swm/esd was not found!", "CMediaScenarioCtrl::DetectOsUninstallWarning", "xjg.zmh", ":q7mw", ";EFT_n", "diom, ktor", ".qMwQ", "@$*~K", "}jo(zu_", "dET(n", "J[Vln#< ", "g.K0'K", "tr-TR", "e izvaja.kTa razli", "klad: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "sdfKB", "\\D>D%!", "=%>?>L>g>", "memcpy", "a`Fw#", "i fel", "WHK}Bwo", "XFSq9", "h", "eDR$k", "I~c4&", "\"RKDa\\H", "-WZ/", "Bro~D", "e;[fV", "=ObGAQ", "V`?g6", "I|7lOF", "]d\"ic", "##wG&~", "```@@@ ", "h`7!4", "(?}jO", "pk_}N", ".u'h?}1", "gsb%'", "{?Z>j", "b|6eb~", "T_5m32", "eqe#2", "e nie mie", "ttes ikke. Den mindste p", "ivituda. Taask", "KlM>OJ", "x$5UV5R", " nebo v testovac", "((zp~j", "cutez ", "nea de comandos se puede usar para", "zAA]P", "Spustit instalaci znovu od za", "Ii.I9", "k6{\\!", "}wNKF", "y%tmZ", " parametr Disable, odd", "_M'P)", "0F0k0", "}Jgr9", "z}:{{", ":B:a-f~-h", " znova.", " installer Windows 10?", "+Cc;;=", "7%[U{(D", "L$\\_^[3", "d kapcsol", "+1FG+", "WIQC r", "YUcsG", "ra, OOBE praleid", "n2u8}", "ritetyst", "?QYx;T", "Action : Supplies setup with the specified product key.This parameter is not necessary when upgrading with volume licensed media or media that contains a pid.txt in the sources folder. ", "U^lV.", "RFx\\=", ";q4a'", "c poprawn", "JWKqB", "yDQ3VkM", "Parametere: 5x5-produktn", "8q7[1g", "i n< :", "A})GB", "ODg9l-[", "cifie l", "n de migraci", "&tF9`]", "G_KkM", "pc0\\4W0j", "NSe.v", "LZH+Y@", "ANCz[", "_9ziB", "i+7-S", "DgSp,", "k8j,v", "9wE+`", "&:h\"pj", "Z=\"jg$", "S-D;/", "Commutateur : / auto ", "GP[+S[", "Kkw*}", "<{~c>", "7,wg8", "C{-;]&x", "KhhHA", "Programme d'installation de Windows 10", ">:I(m", "[L[`SvR", "N|*u=", "ZX#F.", "Gc,`v", "P]'k&", "ak prep", "K#x}&", "iL*?m#", "i2jm)", "FZ%6f", "OsUninstallWarning: We are running on Server. No need to warn for Uninstall Allowed.", "YO34_", "8Ea4ED", "n heredado7El programa de instalaci", "TW(7,3", "W')>n", "qs,[y6", "_'ez.", "6-uy>", "gp~BP", "324L4Y4~4", "('7{z", "U&>\\3", "\\uN%b", "K%>IC", "biLh[", "0]#oa", "pldSJ", "Akcja: Wprowadza plik setupcomplete.cmd z okre", "rgukatkestus. Proovige uuesti installida", "Vybrat", "Parametri : codice Product Key 5x5 ", "9#9*959", "Ij%aQ", "zg68\\!<", "tit zp", "525Q5p5", "l|A~}", "/g&n\"", "~'`DQ", "d*_Q|", "ijte druh", "}'{U~", "@>?*R", "M}oT*", ";%VBl", "$ou)c", "<*=7=>=", "vtiu]XK", "jjJ' 7,@", "d62g#", " ustawienia domy", "Qc=,a", "];SYm:", "p'>^\\", "R7i4N", "Er is een probleem opgetreden bij het starten van Setup. Sluit het hulpprogramma, start uw pc opnieuw op en voer het hulpprogramma opnieuw uit.", "~:*vE", "bKNpmD", "rfCpP", "Bxvn@", "{<6u2", "BtFUx~]", "yY7=jp8", "/@;$@0", "Z#bI@ ", "D_PuB", "&", "ZO ", "qu;=_", ":`&Q2[", "SAF F", ",J)|{", "(0$<=8{O", "Iz_w=", "le zkomprimovan", "BJk<:P(", "(m@9@", "47:z?n", "&PK`B", "6UP5U", "zUeL9v", "rOH3/", "=?BAGf", "vN6,b", "SystemTimeToTzSpecificLocalTime", "r\\6^hz", ",5jLE", "qB`GE", "\"qM=", "u-_sL", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", ")1~~!", "%s: Box file hash is missing.", "%\"=Dr", ">0/6u", "-vQd[", "PtO!Q", "hKs/}", "#bmRV", ";R;!=", "ke informacije sa testnih ra", "dF\"#h", "O/TV]@", "XzKD[", ",PVBm", ";;wfY", "*RQ/J", "mu Windows 10 automaticky re", "pu-A8", "3;4N4a4t4", "yTII2E", ";E;s;", "q'/sP", "CDlpTask::CheckUserInterrupt", "Konfig", "van v", "3-u!T.", "&[Qv?P7", "~}q7g", "hrt.yDiese Version von Windows wird nicht unterst", "U|@/%", "0#;*B", "o do Windows 10.", "+/8\"3", " : setup.exe / auto upgrade DynamicUpdate disable", "-~N)<<", "uRpZU", "z}4@h?", "do primeiro logon do usu", "qps-plocm", "vc'Jv", "Architektura, kterou jste vybrali, neodpov", ": / PBRUpdate <", "{:g0R", "lI'9GP", "rtuseks on seatud Disable, ei kogu installiprogramm ega laadi ", "*#ksq", "%TLtB", "qqFO@G", "/T1P9\"", "'qi3\\A'", "3#343:3S3Y3f3", "7LzaoM?", "^q/M&~N", "l-xrz", "a#u&o", ">ZDR[4", "dTavL8", "%:+vwn", "Lu>d\\", ">*2LtP>", "8!8M2", "kos visuose nurodytos vietos poaplankiuose. ", "cdkHr,g", "SVIaR", "t egy helyi k", "j,>Tl", "d\"lx%~", "D`;r9", "\\iuZT", "3R*j%", "?\"2j@", "O)2w?", "]$E|a:", "siama. ", ";+IgSORr", "f>nhLH", "2ew!O,", "RegOpenKeyExW", "$g*SS", "w?y%{", "Re{B$", "o: / migratealldrivers sf-\"", "2&29y", "n no se pudo iniciar correctamente. Reinicia el equipo y prueba a ejecutar de nuevo el programa de instalaci", "#wj^'", "Vh$K@", "`A8v^", "b`(#ig", "000 ", "0M{;]", "axWfS", "lje telemetrijskih podatkov, povezanih z namestitvijo. ", "`T!0*C", ",4aMc", "ta. L", "7[#|?", "G\\8*b", "Y?9}5", "anai p", "n hyv", "=/NQly", "vPYO&", "XUL^k", "i-{Ik", "4`&.m_", "DcqYr", "Microsoft Time-Stamp PCA 2010", "UJQonI", " z Windowsu 7 Enterprise. Nechce, aby sa zobrazilo pou", "Z:*[G@f", "]oSF0", "]}>L8", "3||u`", "sfY-U", "ldv4{", "8r5JoaC,ljU", "iQ!lN", "sleduj", "NJCSO", "o de rede e pode ter atingido uma interrup", "ticamente cuando complete las tareas del SO de nivel inferior. La pr", ",4Fi`C", ">u|R{", "pa-IN", "3qPG0", "dT)Y8>", "=o}Sq", ">mOVj+", "I&i~*", "WqGHk0", "aNT?i", "8Mmf)", ") W!+", "1oX:k", "}yVl<", "nja prvega zagona se presko", "i nu va ", "2 2$2(2,2024282<2@2D2H2L2P2T2d2", "XSg=G", "wc9_z^", " B", "uFsua8", "3/G &", "t take command line arguments. In Command Prompt, run \"setup.exe /?\" in the root directory of your installation media.", "0(040@0L0X0d0p0|0", "dent du PC. Son ex", "c2|&e", "WBfmL", "R:5)+", "R`hMff", "V^ZHu", "*{y:7*4", "<$4~O", "2A2I2w2~2", "LoadLibraryW", "SetUnhandledExceptionFilter", "SPExecuteCleanup: Cancelled", "sF^3G^", "$vJtw", "Commutateur : / DynamicUpdate ", "m<1[<", "W\"g/tg", "tartovan", "#ywc^[", "%Pl~Y", "(B<){", "le telemetrick", "3S.+kG", "+St}D", "@:DY7", "r maskinen har n", "w ;{@i", "en er rullet tilbage til det tidligere operativsystem. Det udf", "S-OG*s1O", "5!.CgF", "/n_a^", "bP pqJ", "\\o4}V", "YER))", "ksyminen, dynaaminen p", ", tada v", "ZA)kZ", "xyxx0", "0W2[aB", "-Zal|,/+", "nVn6R", "Link de site", "{qGs5", "} ./N", "VtwfI|", "r;pkHn", "m p@Y", "^c-+o", "p[hCD", "`]!V)K", "G]M]_", "#u`5l", "LzPtR.", "JQyJ!", "k durumunda, kurulum, s", " specific.wim.", "y4cYV", "Bhy,?", "=[je", "xf45'", "0\";q4F", "%<>Md", "VN**x}", "(5u-u", "j25;}", "sactiv", "kjpIw", "@f9f@", ".text", "]{qr0", ".hAD,", "bm'm_", "YUK=E", "0{q]QW", "enite Setup.", "n de Windows 10", "H.I|R'", "js,O1", "Dq3w^", "y&n~\\\\", "U^%/I", "1KbXR~", "0_U(u", "=jnMm", "Bs_YiW39", "F7jTX", "\" n-TA", "!lHzeb", " nutn", "g[]I!", "Lc`JK", "QDr|K", "3#3,3N3q3", "PHN9M", "surida juhendab installiprogrammi p", "*1Zg~", "2JeaaH", "ohnpO", "gW`rd", "mkVrt", "GJx}31", "{(H)u", "IsWow64Process", "Windows Installation kan ikke starte p", "#.74A", "D?K?Y?", "4*A*Kk2", "UTvrV", "D$,BP", "8Q!8/", "X*%~c1", ">N?Y?", "installation ne peut lancer l", "p2eK)Y", "U3MJ/%", "|aR9NT:", "{>8RNt", "Vl!C9", "bh;S0", "Windows Setup kan niet worden gestart terwijl een ander exemplaar van Setup al wordt uitgevoerd. Mogelijk worden onderdelen bijgewerkt. Ga naar Windows Update in de app Instellingen voor meer informatie.", "a1g0X", ",z(C8", "Microsoft Corporation1200", "9qf#7m", "82KNga", "o~Z+t\"}Z", "e la partition PBR. ", "ysiJ;", "P-iuK", "F+X/,", "p\"SJ_", "m#Si<", "mI ", "{zSyp6", "$:zzB", "Kall\\", "6La arquitectura seleccionada no coincide con el equipo", "u. Savuk", "3F1|c", "7V`U4", "GsGFq4", "rminos de licencia, la actualizaci", "sms-FI", "&Mqwwwwwwwwww", "U3K2t8", "`qa^M", "iku, kdy se instalace dostane do f", "=)=/=R=n=t=", " tWy(", "?DI'!", "6hE4}8", "@x.r-", "lalt disc de instalare, pe care scrie %s de bi", "R<<}.[", " executado no contexto do sistema, pelo que pode n", "$]j!u", ":>:{:", "Ip]fv", "q,JS{", "}67'Xz", "&>$r3F", "NQ8a{T", "[XApx`", "W>QoT", "u<<7n", "HY}\\Q$", "Conmutador: / auto ", "+$tzG", "lkj6-L", "uW0~0W0_04", "-w[g?", "ErrorState", "Hjelp", "+QuF]j", "DUDownload\\Setup", "t 6I+j", "**jYdEwU", "Spikker", ">[_^]", "&}H?EP", "Switch : / migratealldrivers ", "^Prova a eseguire di nuovo il programma di installazione da una finestra del prompt dei comandi", "<^Xk|", "TX-;Y", "o para copiar para locais que exijam permiss", "c\\{C@", "ParseCommandLine", "<;I wB>", "x7Y\\d", "ERROR", "0':(7", "pq\"\\|", "GetTimeZoneInformation", "ys7A-=", "+Vz#+%", "F+g'6L", "DlxWX)", "pienie Instalatora. By", "r)GzHy", "Xquzmz5", "Of'/K", "FL'0f", ": N/A ", ". Setupcomplete.cmd ", "ar-YE", "sqBo|", "0,000@0D0\\0l0p0t0x0", "TMj(-", "J,?\"v$", "c(Wzb", ". Predpokladom na pou", "?8?_?", "d|bpW", "Z:%\",", "vykus gedimui. ", "%~4IF", "Go:@?", "&*@$9", "Cxq>|=", "$z\"YK$", "SPWdslibLogCallback", "I,T0s", "LT&eW&)", "Stikalo: / Postrollback ", "~/2N/", "Jw\\v8", "*gY|V", "*nMrW", "OD4K<", "installatieproces. Setup zoekt ook recursief in alle onderliggende mappen van de opgegeven locatie. ", "ndas f", "j!{%sL", "~k2IBv[", ",A~g!", "M;i6U", "Teit.", "Pl$x8[", "qsGSB", "\"qRWf", "T*B[~", ", joka on %s-bittinen. Kun asetat levyn asemaan, Windows 10:n asennus alkaa automaattisesti.\"Vaadittua XML-versiota ei l", "RegCloseKey", "?sMGX", "#\\#x:", "O=s52", "/s|r)o", "ena skripta za izvr", "tqO~K", "t@[/0E", " tietokone uudelleen ja yrit", "f+\\27", "Exemplu: setup.exe / auto clean / installfrom d: \\fi", "GetThreadPriority", "F)n{`", "o durante a configura", "`0|H]w", "E7K:JV", "O Setup.exe instala ou atualiza o Windows. Os seguintes argumentos de linha de comandos podem ser utilizados para modificar o comportamento de instala", "Installation", "dd.R#", "Q@Y:r(", "une copie interm", "v-iQ!", "}X@Y(i", "Windowsin asennusta ei voi k", "~kJ3-", "&HmvM", "mKj&#", "Nvi;G", "eo^EN", "6RNfZ", ":#+{R", "NN|3I", "isR{Z", " &b'7[", "gios de sistema. ", "7(Jj&_", "?-Mja", "eO0sV", "2=WAsCXhf", "~^/n!", "=^3[M5", "m7U'?", ")i!Zw", ":rNJw", "Z,B=\"", "X,4@MM", "X8`P9", "mF*&]", "NjD]s", "tP20U", "r fut.sA Windows ezen verzi", "tora, koncov", "qV%tX", "Qn?ADEG", "J[iI;", "fN0OA", "-J$2X", "?>3@Iv0", "Disable, a instala", "@2x;;", "'El:J", "zh-Hant", "%s: PreDownload mode value not found.", "H%;Fv", "VVVVV", "_1*h'9h", "nQ!`U", "bevoegdheden als de gebruiker die (of het proces dat) Setup heeft gestart. ", ";5ys", "xUz)y", "*NuP+", "*-pYe", "rZxCy7^C", "yy$'{", "Y7{88", "Action : Lorsque / PBRUpdate est d", "PG-\\5s", "s direktorijas, v", "[)mSdmd", "DT|||", ")au[O", "EWYRq", ": Upgrade", "po/t~", "llapot", "%s /ReportId %s", "GnE ", "M\\(=1C", "yFKt>%", "cie trybu OOBE, aktualizacja lub utworzenie rekordu PBR. ", "sVVSKZ'", " niveau compl", "ivioB", "(?9H3", "}2ez\\", "+hd.5", "Z]oeh;.", "SS%m\"", "):,i]", "ZDaTk", "dKemS", "i$GR/;G", "3ANM`", "Parameetrid: faili setuprollback.cmd kohalik failitee v", "qH'F/", "ini unutmay", "BoXWZ", "@+$Ab", " prohled", "7;=Nf:", "NMNEEVb", " automaticamente il PC al termine di attivit", " loadFrom=\"%systemroot%\\system32\\mfc42loc.dll\"", "(`hF9", "G$}ZJ@", ". Dal", ";Abak_dk", "j=v2N", "8t:(6", "VYFmJ", "1d|Qx", "F!{p:=", "cie dynamickej aktualiz", "L3P3T3X3\\3`3d3h3l3p3t3x3|3", "q#)R_", " R>(T", "\\Uyjx", "7.<5<", "ypH<)^", "gGe\\5i=", "\"R7^:", "]y|TE", "mxwOB{G97", "EPFCR", "2H1kBdg#", "|D~", "y uruchomi", "QJ5K{,9", "_\"8 z\"", "[Qztb", " loadFrom=\"%systemroot%\\system32\\windows.storage.dll\"", ")8MqN", ">TA5h", ".idata$4", "\\au><@R", "y}dZ3Nr", "t Go#E", "mE(wu", ">seqiu", "en-GB", "$Valmistellaan Windows 10:n asennusta", "/ showoobe", "?DNa*\\$3", "Ue~M4N", "fP_^'", "rab installimise l", "T&UHU", "$e;dU", "8K8x8", "}TFm0W", "~CF:pp", ":l6_Wm", "|t79R", "Example: setup.exe / auto upgrade / noreboot", "Cance&lar", "chiHZ", "el-GR", "tY91-zH", "i)Am ", "aoaG(/3D", "yvI[M8", "Svu|7", "#=6Lg", "\\?c+z", "CDlpTask::AddFile", "0qb-V", "D@,P)`", "ratud asukohast faili setupcomplete.cmd. Setupcomplete.cmd on kohandatud skript toimingute tegemiseks p", "I7:C%>u", "ko-KR", "ltak. Ez a kapcsol", "-E]?a", "2{*8m", "/.&gk", "cyuDl", "m>Za{", "d0K0c0_0 ", "^@go]", "&VmT5", "]PL]h", "EK$AX", "voLNK ", "es-PE", "iFyCM", "nUrI4", "mTRiD", "Actions thread has exited.", " parancssori argumentumokkal. A parancssorb", "[O\"ct", "mu~T>u8m>b", "ivitub Windows 10 installiprogramm automaatselt. N", " Microsoft Corporation. Kaikki oikeudet pid", "stico de los PC de prueba por si se produce alg", "{oI|_", "8bIqO", ": :O:c:", "1%,V<", "l842{[", "K,g6A", "!i-{$", "3S/ng.", "4th2\\v", "7,J4e", "^}< ", "naPo;8", ")7Q Bu", "_OE.!`", ">_>f>m>t>{>", "installation de Windows 10.", "^8A=V", ";[],_", "Parameter: / migratealldrivers ", "QF`,r", "7cBO`/", "NHcVO", "_CxxThrowException", "?%Av*", "G~(ab7!", "f!q>!\\", "RY`oU", " supportata. La versione minima richiesta ", " }xH[", "@9mBT_", "vP Ab", ".9/We", "P4[yz^>o", "`ogo_", "@.boxload@", "7.Ok(/d", ")|\"8G", ".c 'J", "> @*&m\"", "). Po jeho vlo", "HZkuste pros", "~t8e8", "lu PBR. ", "Vr\\>I", "kBF'/", "7iN-iP", "!w=Fu", "ste n", "5EuEMD", "FfyYy>", "Sklopka : / DynamicUpdate ", "mu Windows 10?", ";+;~;", "e~(O:*&", "fr-ML", ">?>U>k>", "DB%TJ% !N*!", " interaktivn", "ringsvalg> ", "e da se pokrene jer nedostaju datoteke za instalaciju. Ako ste prethodno pokrenuli instalaciju iz lokalnog direktorijuma, ponovo kopirajte datoteke za instalaciju u direktorijum i pokrenite instalacioni program.", "V5(\\v", "dO?[#", "Q\\abQ", "YnP'&", ",t\"![", "0$K{y", "aFg\\_", "|+:l\\", "InitializeAcl", ":$;+;", "g$2Eq", "(t%;[", "ePoRP4&", "Rc\"gH", " PBR. Natomiast gdy prze", "C>Mz{", "Setuprollback.cmd", "vP4aq", "`7:23", " nurodo s", "<4+?n", "hd83:", "EUc(3>#", "%9zo($", "Handling: Installasjonsprogrammet starter ikke PC-en p", "Parametri: calea local", "lemi s", "Job~b", "3hG]p", "0?B$@0", "4XBX#", "tHqf<", "t20/v", "aEYiV", "pNBt^", "lo do te", "!D<[;Ix", "c/[fp}", "K[5G[", "WlK++", "JsQr7", "o, mas anteriores ao primeiro in", "wC4oTDw", "WX,.-", "Instalacija nije uspela ispravno da se pokrene. Ponovo pokrenite ra", "#EwR@'", "&J'mA", "5 5/555I5s5y5", "lt \"Kh", "g'QR'", "[=*^uz", "XllE<", "cie3In", "5j[^~", "xoS/`", "SetupPhase", "R;9N}4", "=K:w^O", "e9!k+", "yor olabilir. Daha fazla bilgi i", "Z&xW.", "i%2lZ\\", ")zngAq", "H> ", ".?AVCFont@@", "uK3WR", "t sader", " U(rZ", "3,3E3J3f3", "3zJdz", "qDOeD", "@mDOJ", "ZgWZU", ".rdata$T$brc", "X yx;", "Z-ouF", "CPackageScenarioCtrl::GenerateBoxHash", "e2\\!&wK2", "Akcija : ume", "Handling: Setter inn filen setuprollback.cmd fra den angitte plasseringen. Setuprolback.cmd er et tilpasset skript for ", "OBUZRK", "9xkpv_>", "L|^E7d", "dzis: / Telemetry ", "58d4JW", "|S'_)", "\\zJ-CJ", "'sNhz", "Switch : / installdrivers ", "~~vkkg", "U)&w^", "t`U!Th($", "4gO#z", "8V@.W", "ka prilikom pripreme medijuma na ", "m}l7-Lf", "Q*u){]", "W:|}`<>Jw", "0?Z:p", "eren medya veya birim lisansl", "\\p_/w", "P'Quy", "IXh\"6DX", "Parametri: N / A ", ">\\k=[5qw", "DFIIr", "uQ+OI", "W+:?L", "['Cv'Y", " 0qM1", "I$$kA", "rs: setup.exe / auto upgrade / PBRupdate disable", "D$8QQP", "!%ux7", "iendab Windowsi. Windowsi installimisk", "K1]:E", "metros: caminho do arquivo local ou caminho da rede para um specific.wim", "Unc%n", "[,Kn+", "F$;=U#3", "Z62Gx", "ntalo de nuevo.TSi instalas esta versi", "Akcija : Program ", "e do datoteke sa imenom setuprollback.cmd ", "11iOz", "zV9\\]", "Parametrai: vietini", "g>CaE%", ":P+gJ", "5zi&d", "\"dSotQb", "rience utilisateur de restauration. ", "o+x XQm", "[(9r3TuW6:", "ranka nerinks ir nenusi", ": / PBRUpdate g", "Bf?Xp?", "enieris var v", "&Befejez", "galement les configurations par d", " v#tV`", "q?&E8", "*99916F\"", " Microsoft", "9D-[*", "KU^JK1", "R$xoT", "CInstalacioni program ne mo", "~(F~60", "yK3}<", "$nY3N;WyJ", "5\"656;6]6p6v6", "[M4g>g", "5x[v^", "pe:~=", "\\iR.(", "8Fv.Y", "#%*>=\"", "so-SO", "z_.Im", "=X9(>", "jaYjz_j:Z", "k KaY", "N&aslednji", "%^\\#v", "2 2&2P2a2f2l2", "A*@M.", "sj{Sc", "j/NjW", "dxLrH", "[!%LT", " prie nurodyto failo kelio. ", "%SmHq", "njo povrnitve prej", "8WrU+/", "X5WX\"T", "4[ Y6", "t/j\\Yf;", "ker rekursivt igenom alla undermappar. ", "1bodf$", "_vsnprintf", "|7)#i$@", "m-Q4xY", "t&-Vp", "' pvN", "a&#{^5", "1Ii/~D>7", "kZtitUt", "a cu utilizatorul a instal", "e da je %s-bitni. Kada ga ubacite, instalacija operativnog sistema Windows 10 ", "o tamb", ",", "Vk3.wU", "Fzyi'", ",xiYmFs", "#tHt2", "1r'}L", "6INe?", ";`yg/", " driver.inf ", "6d\\\" ", "kY%}1d", "4H@ kT", "T\\tBh", "{;[*U", "Parameters: 5x5 product key ", "+lTw%", "d9c g", "BO69 ", " PPP", "=XKX%", "0$OQ>", ";p%8R", "tja vagy UNC h", "M!x`a", "W=i6uS", "O:2d ", "'7X'7", "paiRj", "na pot UNC do mape z datotekami contains.inf ", "Handling: Leverer den angivne produktn", "JF=i$", "9,9\\9b9", "PPP@@@@@@@@@PPP", "8b98Go9", " name=\"odbc32.dll\"", "\\3SnQr", "{/b*1~", "h_wOOo", "gAzc/", "'Kkf4", "B3dqo", "/|ip~", "jL>lx", "3Q\\M(V)`", "SQp&[$x", "wwzxw", "1AV~'@", "`O_a|))Pd", "%QRbK", "MD15(", "?_\\WDs1", "s`(>X", "n linia de comand", "J4=4T", "041004B0", "t_'xe", ":Vfx\"?", "z[mP+", "!:U3R", "'P67B*N", "9?ds)=", "\\yWrW", "G6'1~", ": 6KM", "NF>T]", " %7XQK", "1Vf&E", "N+ScV%", "$@-9z", "o+zSe", "pNO)F", "V&]O{", ";Sbia", ";|QXH", "}DqFX", "{xtsqy~qt9", "hTi0!+", "JT y!", "kr-Latn-NG", "(b${f", "VF}SM", "LKKMw", "rodowiska instalacji (w tym ", "no realizova", "\"StEJ", "p;q[.", "IWBFhr", "c~#=W", "j%!jCO", " adelante. ", "aozhe", "[{/ay", "%_VifRa", "=:B>r", "a\\rp$", "E\\T@\\X", "o PBR. Quando / PBRUpdate ", "k\\!:t", "ShGo/", "6.n/_", "i;d[:", "l?nr6", ";5yPnr\\", "b`0Hm", "CMediaScenarioCtrl::Initialize", ")Microsoft Root Certificate Authority 20100", ">P-WXt`", "$@F_#", "Nj7OWp", "p0~U}ui8", "`JQ&N3H", "sq-AL", "IC,1a", "o3Kx<", "ie>\\setupcomplete.cmd ", "m44,9a", "s2OaVsT", "ST\\W8\\z", "< <0<8<@XWYo", "```@@@@@@@@@@@@@@@@@@", "/DFH ,", "~21m5\\", "t0YP-", "FDIDestroy", "pnie spr", "g64[N~4", "Akcia: V pr", "\\01Nt", ")/F`(", "9nBu\\,", "VnW[z", "SetEnvironmentVariableW", "7_cS:", ".F]hmz", "QQ;t{h", "TqUB=", "EL])L]", "C9o,'", "IjjX%cz", ",b^35", "qX,`B", "]_Z>h", " OOBE. ", "re installationsprogrammet igen fra en kommandoprompt", "Action: Automate install with migration choice for the installation. The media setup UI and progress screens are shown by default, but are automated.This switch also assumes the following default configurations : EULA acceptance, Dynamic Update is enabled, telemetry collection and upload opt - in, OOBE will be skipped, PBR will be updated or created. ", "Akcja: Instalator wprowadzi wszystkie pliki driver.inf znalezione w okre", "cution. Une mise ", "8{@l%", "O;@(,", "8Il]@", "@vAE~O7", " dynamick", "3K4T4]4v4", "v7Y}(A", "dpT8v", "c>7{`-", "cie. Naopak, ak je prep", "CUd*m", "})Cq&%(", "5FQ<}", "Hj(` r", " loadFrom=\"%systemroot%\\system32\\powrprof.dll\"", "5aPTwm", "]_t^J", "wmUn8l", "l+aN2", "1#1S1", "turacak.Buna kar", "edenemine", "wGO1pD", "5o*Sy&", "SU:g{", "W35G+", "Ar<9=", "j|WXKft8", "w<)YM", "CDlpManager::GetQuadwordPropertyByIndex", "5Kuu+u", "M/>ED", "o]5G\\ ", "'C544u", "Schalter: / noreboot ", "rations de mise ", "DlpTask: Suspending task after prepare...", "T[Mmm-", "K+sw/e", "K03<{nL", "Bryter: / quiet ", "i(CNC", ":5mO_", "sp/N68", "*wM'Fi", "Aktion: Gibt den Speicherort der", "gp0JL", "Hbd6r", "e0Tu^", " disk (%s-bitov", "KmuT/", "DK20F", "e$Nvx", "r, ja / Telemetry ir iestat", "KF)9$M`s", "0x~U=", "#a~UBSBD]", "do\"b)", "e je stikalo / showoobe nastavljeno na ", " {\";N", "sgs5n", "8%eE7{b", "lA&7f", "lvn8]", "LR(6$i", "u=`Kf", "V72+;@", "6Z'LF", "0?%T.=", "g@[/%", ":-r4120L", "1E7w{", "l#Y.~", "mu Windows 10", ".PAVCException@@", "FaLfY", "WMRvi", "E(u~V", "Comenzar desde el principio", "[dDjt", "~c@s+f", "LKP>9", "o<%'4", ";oz{~", "^VT2[`V,", "Y\"v,S", "$ ggV", "5L/S*J", "l pou", "Av5P@~", "927;O", " aSU*", "#[]WL#", "t1@-)", "fs8b8", "_Gj_c", "PHsb7", "H5VMTS", "System32", " na hodnotu Enable, in", "<.\"FAB/", "m|]M%", " na hodnotu None, in", "n controlador como parte de la instalaci", "P;XGP;*6", "Indstillinger: I/T ", "pid.txt in de bronnenmap. ", "67PB8", "m:UlZRb5VP&", "g2[$/", "Vjey?{Q", ":X:s:", "sG59d", "?& \"4", "1jsx\\", "X8w0$", "PkIK6'", "(/4Z&}(v", "@o:(H.", "@4+T4R+", " sa pou", "j!%A3", "8-8N8Y8`8", "712~'f", ": / migratealldrivers ", "i.T:?X", "[W|j#\\s", "doHgz", " jour des fonctionnalit", "g$G70", "7Z0@#", ";<;e;w;~;", "/`n7@", "lesben nem. ", "({*TXL", "%CqV:", "o de migra", "No se puede iniciar el programa de instalaci", "Wl@e4", "xtT]C", ":<:E:", "DVmuB-", "9gO;E", "]/G1W", "Af?'%+H", "cWGptC", "Ud}2-\\", "?((?}Y", "Nh1P(c", "S!P,.", "8{W)s", "b=_5YI'", "P$|-r", "=e:L^aB`", " ;XYi", "EB|B<", "ide: setup.exe / auto upgrade", ":1Vj>", "N#m&f&2", "s@fv;z>y)j", "/!8!1", "Launching: [%s] [%s] from [%s]!", "f[k &", "h_`f+{6", "zwB+j[k", "PO2.g", "v[Y/<", "CuOBD", "uF9w0t=Q", "^7bKI`", "lkomstprogrammet ", "zB}q}T", "-^", "Nn04X@bK0", "Configuration", "Q_E'Z", "LlnK<8", "D49@W", "4*qcS", ".CRT$XCAA", "7IRZ,", ")#F`>\\", "<];O:", "U&C}Z", "4D}H^", "8IMG%", "xkRT3", "=9n9WF", " nem carregar", "~]Nsk _", "[\"WdY", "Z_hn{}Q", ". Bandykite v", "uriranje, uklju", "C{6A,)", "q)}C-", "d1wM'", "BS?vFmoX", "&Fwc$", "?oDq ;@~", "\\rJ*?", "!J]*_D", ".f%xm", "5:A8KPp", "m telemetrick", "ZZ,Jf", "=u+ZS-", "igused v", "QO9+(", "636E6V6]6n6u6", "sx]zi", "C$w84", "H)Wf;", "u6mN8]_", "Beispiel: setup.exe / auto upgrade", "5C5]5j5", ";nok?", "_JYwh|", "~Bvj ", "o: / pkey ", "n de Windows", "D m v", "u?-", "e]i\\4", "emqx[^", "O;8xh^", "ide: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "installation ne proc", "9@K;C", "K%$Ar", "hM4NB#", "\\8~Gh&q", "Bi>im*", "cSmvZ", "i instalaci migrovat nebudou. ", "fini sur None, le programme d", ",^s1H[", "v^hJT", "\\JOJ}Xn}", "n en el directorio y vuelve a iniciar el programa de instalaci", ".^V{/", " zautomatyzowane. Ten prze", "qD\"vr", "das noklus", "U2t!03Y%", ":InW'", "V)1U4nd;", "ekjHJ", "installation. Le support d", "LSAyV", "ra verktyget igen.gMinst 350 MB ledigt utrymme kr", "-f\"&JS:J2", "EQKH@", "o>hoT", "CP9C ", "mfy]t`", "definido", "*&k\"1", "$4#Bo", "Ama[;X", "_g:ms", "7Ak:(", "rp=-_", "JqXrT\"h", "6+626F6V6[6a6p6v6", "i '98", "'P>w>.", "W8y(W", "Toiminto: lis", "GO+G]\\", "[~@!3", "LGwro", "! ).k", "i\\=WR", "ResumeMode: [%s]", "^sQ?L{", "tofe*#", "xOQy0", ";P(TZ", "Bl@HG", "Yibcm?", "P-Az1g", "b;Zcx", "^^^]Z", "ID|m3P", "XY!vjD", "Ty,ZjY", "h^L/oP", "=YuVT>", ".rdata$sxdata", "qm%KX", "!~jNcM", "A_?gA", "$`~C{_", "b~yT_k", "bs=&n", "auOl'2", "*}KoK", "w%|%{72", "Handling: N", "%=$V@", "+ISP#", ".?AV?$CZeroInit@VCBootScenarioCtrl@@$00@@", "\\", "m/", "*PdKz", "{~85n{NR", " 0+K0", "ra a znovu spustite In", "LZQ{7", ".?AVCLinkButton@UX@Common@ConX@@", "IpUIVh", ".{Qxk", "m Service Pack 3 i", "UE~n]", "Vh&4}", "{{!I0P`", "wj2ljU", "Nr^q;x", ">Y#2[", "\\'^[N", "82;;}'", "l%\"xG", "Actie: de quiet-vlag onderdrukt de Setup-gebruikerservaring, inclusief voor terugdraaien ", "$Vn7A", "es de utilizador ", "Q.CQD", "/LdB6", "Conmutador:", "'h", " compatibilitatea", "tres : Un chemin d", "jT", ":&:a:", ":*:=:", "T_Eq6Wg\\", "9a\"4b", "Kh8{)", "c\\L1FS", "fhI#dy", "Oc=1,", "rast installimise l", "&Sus$", "d=yIjY", "Bx8-\\", "z*FDo", "mwsZIL", ":.<5E|", "$3\\y0", "Q3E L", "Nhuq?\"", "[X`K5", "Hj)VQ", "is parametrs nav nepiecie", "#OK!/]X", "{_Stq", "k,U|iIA", "WoVzK", "7_!Zu", "VEeQL>", "5,jdX", "EtwEventUnregister", "KnU*e2", "Preparing %d%%", "Parameters: Upgrade; DataOnly; Clean ", "lUwA>", "8q'.7", "Por ejemplo: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "iI^}:\"", "solja vagy felt", "=fIQh", "@X~@H", "trie et de t", "[ql9>", "L{9;Y", "W3Dz%", "VOPnFu", "-li+[", "]$`iA", " jour dynamique activ", "S 2KM", "<-lsV", ";Qu2u", "dsEk|", "EH)j$56E%", "8 >[5", "c{n2+5u", "RiZ^g", "+W8.o<", "lda: setup.exe / auto upgrade / noreboot", "{W^rM._", "Az;G^T", "4TMPn", " name=\"version.dll\"", "=?}^p", "yW8Q;N", "0S0h0", "La arquitectura que has seleccionado no coincide con la del equipo. Por ejemplo, si el equipo est", "v}Wf8", "g. Szabad", "GckCaKB", "e. Pokud je ale pro p", "(cf'\"", "nF`CU", "SaD#H", "Fx=b =", "Gh6WP", "GJu=~", " ejecutando otra instancia del programa de instalaci", "g:%k>", "=%E7RV<", "eHSFJE", "Sn3Pg", "n`cSn", "s te migreren als onderdeel van de installatie. Als", "Malgun Gothic", "OR#I6a", "'f)*8", "}p,lk", "RRJI3", "$d`a\"u", "4HwN4", "i din nou instrumentul ", "E|*j{", "46+r|", "&f\"U;wo", "pcW3@D", " Action : Lorsque / showoobe est d", "v!Sp+", "g;U56", ";C-t1", "osrU?", "4T$W\"", "SUs^S|", "I\\(5h", "Ug%V9yT", " name=\"ntmarta.dll\"", "v`:e_", "V(7a]", "[&d`8", "P3h0\\", "F}MZ@", "Z]+y+ck/]", "7TfOR&t4", "uq\";k", "[6j]+[", "Sup.", "mfRe?", "?9?e?", "mu Windows nie je podporovan", "DwordCount", "vw*[5Jm", "hP&]M{Lf", ")=qCC", ";4vud", "[o(bU(", ",L;V\"{8,r", "bbi verzi", "&Nt+I|", "VoelM", "Action : L", "installation de Windows ne peut pas d", "E.w5Jz", "`\"l7N", ";X3mk", "9sTtr", "=v@dc", "\\NtxCF", "$mo\"2>22+", ";nv[$", "b;=W[", ": / showoobe", "Exemple : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "dg&{[", "ZMSdaM", "^w>}\"", "oAM3J", "~X]6dMN", "kX:f\"", "P`75+", "LCdzk", "s az elej", "bkkS7:m", "?Q*0;", "(z?4!", "&Fine", "^-cT6", ":Xg6E", "i Windows 10?", "<>,_<", "BLAvz.", "CDlpTask::GetFileByName", "nXSjVQ", "Failed to unload hive at %s\\%s. Error: 0x%08X", "=m[)v/", "3 3,383D3P3\\3h3t3", "QDV9U)", "6IXYYXXAFC=:", "]wZq[", "WiY^}", "sYlux3Z", ".Y*Y%", "I^ar{", "E0Vtk", "@Jn3^^", "GetSystemMenu", "'cx=9", "5=6O6}6", "!)rkz", ":v=UB", "b},\"\"", "x+=h=[Ak", ",B)MP", "BfXT8!", "Kk_1#S{", "8X\\;{j", "~?ZNp", ">Z4;X", "^MnGM4", "}1Jl+", "fjv;4{J", "X+0EG", "I5|WOO", " ir bandykite vykdyti ", "gqGd?", "vS^F1", "o do EULA, Atualiza", "#1b2G", "H1YUb", "041604B0", "Could not retrieve error description from transport for [0x%X].", "a?0+i", "j+=|AP", ">*,f>*", "qo.Q~v", "&>;A~", "`k[c\"", "Q-J_b", "koT?i", "Z/IImp", "0W0f0", "r Setup bereit. Bei Upgrades mit Volumenlizenzmedien oder Medien, in deren Quellordner eine Datei ", "x/CZF", "\\x^d#c", "B(0gFt>4", "eX[IU", "gf!l@", "a generada por la instalaci", "na.BM", "1Fj3\"u", "y[9E0", "{P1 W", "F2Z]R", "X~F,f", "'8pBdp", "Handling: Angir plasseringen til kildemediet/-filene for installasjonen ", "/_?%;_ ", "IU(sQ;@=", "Pvjt", "e spustit star", "RQhpuE", "]2o/U", " onemogo", "BY+v+S", ",E93c", "[_IN~", "z!,Kq", "|)wyf", "CliX$", "I8YAZ", "FSN\"Q", "JD2u,HH", ";< ", "T??Ru", "X.S6+", " AwI.", "##8p)v", "N2jXH", "ty6Lij{U", "+Z.s#JLp", "]hbrQ", "*c%vA", "N!`Dk", "wVPoU", "o de atualiza", "5 SUI", "_>Y2k", "a, zapnutie dynamickej aktualiz", "Zistili sme, ", "pp3Q%", "[`N)B(", "PGYi ", "YKC-w~", "&bZvEOK", "Waiting for process events...", "]n$H2", "%Ngu}2z", "d&,.; ", "}V1P|", "8b^j`,", "re OOBE interaktivt. N", "QmQ/N", "#tMU&", "t operace dynamick", "uHT<^", "VwQD1i", "tv~p~t", ":6PhO1", "2{Tja", "MOkAaAY]=u<", "j`dn.{", "xrhf,", "ke programe u sklopu instalacije. Suprotno tome, kada je / migratealldrivers pstavljen na nijedan, program za instalaciju u sklopu instalacije ne", "s int", "0e]4%", "Yns`X", "<2`Mt", "^vte0", "_N_W7?", "-.2(B", " pro zdrojov", "{9y01", ":j19uE", ":vSxL.)", ";+ELz", "B_,j%", "Vy{=V", "0Ii<*", "nm?><", "H\\X_,.", "!i*\"a", "2#2_2y2", "A)$u/f", " arabirimi dilini belirleyemiyor", "*$})D", "..AZLTA", "GetLocaleInfoW", "GetNextDlgTabItem", "n%]/.", "Ra9V9", "k=}m:2", "ter nem sz", "?~%,>", "ren naar locaties waarvoor gebruikersbevoegdheden zijn vereist ", "'0}n2", "iune: C", "B^j", "}pAl=B", "8BMSdw", "", "sszetev", ",6BfJ&#!", "es-SV", "KbM=&", "|)%YR", "toru sa nepodarilo spusti", "x^Qp\\", ".+j5h", "S($zz", "e, znovu zkop", "O5lkx", "nWaQu", "=/>G>k>", "Parametreler : Full; None ", "??6}6", "9}!@g", "&K]Pq", "IkQb`", "?+6}9", "OA28\\", "wGt-/", "r+L9>", ">->6>K>", ")sG)sG", "xN+H7", "pId(O", "&Su[[", "`6raJ8", "ET|x,", "Gi{Z:", "9|$@t", "0(}-U", "mvnh`", "< <%<", "1o:(]", "q?zk8", "4.[`x?", ".#UdgY", "s wil verzamelen", " precisa usar a vers", "unalniku na primer izvaja 64-bitna razli", "(O:Dap", "'`/TE", "r9TY3I", "TcBYb", " ", "(AEG1N", "ke podatke s testnih PC-jeva u slu", "$fH`\\", "0%0~0", "jI|lI~L", "=qH{T", "gw-[e", "6%~Z6", "VdF T o", "RB:H=a", "E=#nvc", "7k2R`", "y osoitteessa: %1!s!", " : setup.exe / auto upgrade", "iB&z\"", "muhxK", "5{9Up:V3", "bAz^^8", "zg;lh", "B@\\6Cd", "|ykHM7", " Windows vNext, ", "]QyoE7", "8+]qR", "/YG?|$", "hHq,5", "S8;&r", "nx%tJ", "Conmutador: / Postoobe HgyL", "yr5sU", "n`5cu", "G7Up*", "ScQ|om", "4\"424B4R4b4r4", "^dyV)", "Launching: [%s] [%s] from [%s] in session [%d]! (%s)", "$zD@t", "?&?D?S?`?", "}rg#7", "+Pripravuje sa in", "~OR-a", "Bw7>n", "Vf:y", "pEx9=", "5&6B6I6", "Sn?3d", "+*kOy", "g;)!p", "2#i]7", "&QyBu?#", "IkPz#f", "e/Ar}", "dia s multilicenc", "\"+8#:L ", "\\x>LCA.L", "u'gTm^", "~7*7}", "ve-ZA", "t/]F*", ".8[x3", "<\\o/`", "Gx}q>", "-!^$z", "j^Q>56", "<9!2M", "474I4q4", "%*?qJ", "mr-IN", "*^Plw", "/Success %s", "B", "^##P#", "(<0ce", "DX$\"**5h#K", "retimde kullan", "|$/6y}", "ni pristup njemu. Naredba se pokre", "stroj zatvorte, re", "v.x3j", "005Pj", ":`A~s", "{Q|?;", "d_A}E-", "hJ{:3", "Dr\"C@6", "?QSVg", "2!F7&", "5dMYK", ":MA=.k", "H'\"_x", ":C0L4", "1:e<,d", "%`IUa", "b82=7", "oJBov", "gZOZ>", "'fXb}p", "Oq,G[", "SEV\"R", "=J0W>:", "6X3;Ep", "J1lq^", ".4*WJ|", "bfT8+", ">gw:9.", "$^3w&", "S)5G#", "`1|,o&6", "l9qtf", "zh-CHT", "{-tS}", "p/JY<", "Aa+N;", "*Lb5c", "&QR0", "~}`B'", "Parametri : 5x5 ", "xuzsE", ")K>E4", "3yw(x&", "/Prompt", "Instalacija izdanja Windows 100Instalacija izdanja Windows 10 je ve", "z20fmf", "=Do.\"", "yY\"|Y", "UMP.-", "3O|x{", "4FfC7j", "MW% 7l", ":):6:@:", "cm{ZB", " loadFrom=\"%systemroot%\\system32\\coreuicomponents.dll\"", "lemini ba", "Stikalo: / DynamicUpdate ", "'7AaaCL", "&'34t", ",+lZm", "en0?B#Dg", "r 3};]Y", " y cargar", "m&]9A|", "`z=oT$-F", "9 :@:M:", "\\4^:p", "FreeSid", "YN0h%", "d |oxQ9", "5-646n6x6", "~1}T8p", ",4'v]D", "qAT3m", "Fortsett fra der jeg avsluttet", ":(9xJ", "WWobg", "rf6zgX", "M $=2", "d@k!]", "b_,+/", "\\S%08", "7)7:7?7E7", "Q{j rD", "kog su", "+?5#C", "r.T~_V", "a:gu2", "Sklopka : / migratealldrivers ", "http://www.w3.org/2000/09/xmldsig#", "Bn4;0", "f\\'Y~", "{iya_", "~jc1g", "1xD*(", ",>[ee", ">y{|!.", "78u*O", "cijas izv", "B?jGF", "U\"R'1M", "}H.=bR!", "hMB!=", "%!*xq", "$m0?UT", "$^&GSgg", "5p]{o", "M>r:Lc|", "O^F=M", "Parameters: lokale bestandspaden en UNC-netwerkpaden", "Meiryo Bold", "jums\\draiveri", "79)P_B", "nLS7@2", "n:8Z@", "xU1G`", "potek", "Bw9:s;H", "zY}'as", "<_=]>Q?", "W7Sop", "-]lnj", "59,9o/5", "JoEZ6", " migreze toate driverele ca parte a instal", "letim sistemi g", "q\\ef*", "W0D[^Gm", "=@3/j|V", "uBT|)", "4BucY", "=Qm4>", "r4&~T", "=*!F!r", "?/6zAj", "jS(p^#u", "Parameters: Enable; Disable ", "Jz%;Mn", ">PRpW24", "e*1M).", "LoadLibraryExW", "uriranje, telemetrijsko prikupljanje i davanje saglasnosti za otpremanje, OOBE ", "7F%)}$K|", "SetEndOfFile", "`b)xX", "~9=[M", "EZ(O`", "ba: automatiz", "]xpJ-u", "xNUCe", "@v|3t", "\\|-iW", "jq7p(", "e je stikalo / PBRUpdate nastavljeno na ", "-~\\-u_", "e u kontekstu sustava, pa mo", "dzis: / Postrollback +>8>V>p>}>", "f.S5}", "k;k;k", "|;TO/", "oP{0#2", "q`6O{x", "%]?xM", "PerformCleanup", "KhdS%Rqqc", " Windows 10", "^MgqM", "R3HW#", "XhYB6L", "?/J;h!", "`NGkZt", "Qy,mi", ".xl?L:,DWj", "lnym s", "{lqon", "RMS,@", "Rzx/\\Q", "v8>}>", "Tv\\fk", "ri1tpS", "ckt Setup-UX, einschlie", "0p3h\\", "iFxJ=:", "wqURA", "cZF?N-", "Ef=]@", "Md\\AGq", "_V@>v", "re oppgaver etter at installasjonen er fullf", "4jg4j", "%Zy]#%uU", "vsut*", "8;c@r", "J?,R1", "CRp'65", "y3[!)v", "c93\"ci", "_x15~wZ", "~h2+u", "OnFailure returned Error = 0x%X", "=u8Q|s", "MUG'4", "1l&Ob}", "B9{0a@", "h;i9O", "es par d", "t&f;E", "F)3ERe30[", "ec33r)", "y&gjju", "8a)n[", "ta-LK", "nde bir pid.txt i", "n{@fLQp", ";Kg,t", " diegimo). ", "#IC,G", "UU-hm5hG]", "[QmCM/", "hendisi, bir hata durumunda s", "%|]az", "ranka bandys perkelti visas tvarkykles kaip diegimo dal", ";r2|no", "2\"#3YL6", "0W0~0Y0", "gokkal fut, mint a telep", "iuni. Urm", "vU_v^", "+!)#\\)", "EX4j3", "WIMSetFileIOCallbackTemporaryPath", "VND(J", "F*|!\\787", "8@Wb]", "%-Ok%iZ", "+>i}#", "pWDiG", "Gw*Nq", ",8?:6", ",0I", "4<4h4", "=!:v0", "InitializeCriticalSectionAndSpinCount", "i<^te", "eu-ES", ".?AVCWnd@@", "E\\xf|z", "Exemplo: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "Prebacivanje: / Postoobe \\setupcomplete.cmd ", "uQXd2", "^_Xf2", "I+Lg&", "&Vp]I", "Av:S/\"%", "%%Sg#", "n'b^>", "zN<70", ";|46w", "W4zlK", "@r3HZq", "Bq|tl", "na6X*tw", ">lQW<-", "9\"ulF", "s=1~A$aQ", "j\\Xf;A", "NfL}/Z", "$3LPYa1TP", "|J:=]'.#n", "Q#9JE+", "V\"\"}rix", "RDR2j", "rken hata olu", "installation Windows 10.", "I|+H*o_", "dir.t%s bit yazan di", "k?}(>", "D ", "P153\"", "```@@@ppp", "*q!pz", "7X0xL:", "#_^TH", "Conmutador: / installdrivers ", "%^8Ee", "mu Windows. T", "<+=5=V=i=", ": Enable, Disable ", "O05>h", "X|}m|", "CDlpTask::ProgressHandlerAction", ".$W;O", ":~;c'", "l6{hx", "JA~_<", "7G", "i privilegii cu utilizatorul sau procesul care a lansat instalarea. ", "V]i_H", "installation est d", "NT%XB", "Orc3]G", "r,mr-", "r klar et par ting", ")WBBW", "aDux\\", "~@c=|", "\"$HHj", "]}vfa", "C>rcw", "5=D>?", "@,hql", ">4o1%", "7w611", "rikd:0", "Setup.exe asentaa tai p", " pokrenuta.xOva verzija operativnog sistema Windows nije podr", "VIETNAMESE", "fi:Qr", "q^f|N", "hCV^>", "xAwnOeU", "R0.H^", "I1]L7", "u0oe-l", "=Cac/p", "<:kd#", "~Nxe=U", "%v\"`7B", "GO*sO", "}]-\\[", "{4Qne", ":uSQ^", "nem criar", "'\"x@`-{", "'^THh1", "e(X|Z", "=H_H/", "98]BQ", "uRRtNJ", "p1nYN", "\\\"rYX\"r", "E(}&y", " xnn`", "=eUrF=", "])\\\\L", "j-s@-9*", "lda: setup.exe / auto upgrade", "Fby\"m(", "L\"\" B", "1Zc^`", "H~^(n", "nzLz-", "rP&{|", "3|Jr~", " 6\\s&", "s/X!;!X", "-'yw;]", "+Ov&.", "J|=/M", "ou verziou in", "GetFinalPathNameByHandleW", "REl programa de instalaci", "r>0gU", "^6DC2", "q}miEu^", "r du oppgraderer med et volumlisensiert medium eller medier som inneholder en pid.txt i sources-mappen. ", "ges XML-verzi", "D$@PW", "(8Bzl", "dK%", "GPwLG", "5h3iL", "Ret}%Y", "XCi}S", "8[J 3wa", "S?$:{9", "rm] G", "LWL!=", "HCWej", "cego plik pid.txt w folderze ", "U\\3FxV", "m\\oLl3&", "O\\\"}|p", "{_Bb_", "*w:zo", "4DZ\"6", "CkvuaY", "piM?0", "C&oncluir", "bbi inform", "mu Windows 10 je u", "X747F\"y3", "aDT}#", "im_sb%", "i din nou s", "9x&jmA}\"^p", "1K\"P,", "1gJcazA", "fg#T)", "\\m%Mp", "Uma situa", ">Nd/f/`", "e[j*v", "cznik: / pkey ", "iTkxv", "Zd|!]~", " loadFrom=\"%systemroot%\\system32\\ntmarta.dll\"", "y={ 0", "n$E#", "inky v zadanom umiestnen", "gioB~", "{mq|##", "e.k0b", "eM-?w", "U3&2{Bb", "steemikontekstis, nii et kasutaja", "<`>25Z", "z gerekir. Arac", "H% kR", "^[ihc", "IsIcN", "k8)6=", "xOIQv", "@n1576Z", "K^r:9H", "I:YB,", "x),T<", "CDlpManager::GetTransport", "c#zl\"", "laties apkopot ", "Jpoh=%", "Mnh^C=*", "f:MjF", "^6RB-", ")Mg#2F", "36pF7g", "c%n>6#!", "anje se bo nadaljevalo, ko naslednji", "3j1g'", "[mQ6|", ">7?G?W?`?i?s?w?", "c", "i&&09\"", "nin g", "wZ)x;", "D0X V", ">?.#k", "setupcomplete.cmd do local especificado. Setupcomplete.cmd ", "~w>J@/", "yBJ0#", "+8a7h", "L2$#[", "c noklus", "o com a op", "p/o0rJ", ".?AV?$CZeroInit@VCWebScenarioCtrl@@$00@@", ",%WJ?4P", "9iI=Fv", "`eb}5", "/[CSX\\", "}]*^E", "V^a4{", "Niof3", "sap-Id", "W9AMUc", "uTH.E+L", "?\"8!qsOh", "rer allerede. En funksjonsoppdatering kan p", "aU\"]8", "DestroyEnvironmentBlock", "K1$xP", " UNC ", "9c+$mZ~", "?{8l6c", "888T8X8\\8`8d8h8l8p8t8x8|8", "1d6Jc", "D$XPj", "liti: / Telemetry ", "VT,b:", "A)?CB}[v", "qvR66", "k{Ivm", "2:S)4", "VQ8AM", "qP>E;$t", "3@9h;I", " de produit de 5 x 5", "dB-6c", "QueryPerformanceCounter", "3*y<#", "n: proporciona a la instalaci", "g~ONw", "'VANz", "B7|*tFLu", ">CS50", "ug-CN", "SiteLink'Rufen Sie die folgende Seite auf: %1!s!", "8eM*{", "oQs9~e", "P`nz0@N", "X'!@T", "T)IQ_x", "StringProperty", "ksi niin, ett", "ipraven", "Wiizk", "xz`vD3+c", "!A$7>", "CDlpTask::GetAction", "]A0HS", "ranka bus t", "R#.1`I", "s^h,7^", "S+XOS", "bTt.$", "210211214040Z0", "t=%_3~r&", "]O[e;9", "fFb>C", "0j{# ", "FuGL]", "%ZH6ZH6Z", "U!S#*d", "PMS\"V[5_", "ssen Sie die 64-Bit-Version des Tools verwenden. F", "Eu(1S", "(m<6t", "[06xm*.", "/Yt]!", " ]]|W", ";v]xv", "31|}=6", "e@)|9", "?&=FE", "CIb(I", "hP{@qS", "/ installfrom d", "]{@UU", ".?AVCSimpleWizard@UX@Common@ConX@@", "nik, ", "=&9_{", "~1;kb", "80>zPl\\DtB", "D&:TR", "n: cuando / showoobe se establece en Full, el usuario final debe completar OOBE de manera interactiva. Como alternativa, cuando / showoobe se establece en None, OOBE se omite y los componentes se establecen en su configuraci", "7}C^}", "ev0Ck", ">Sf\\u", ".hy?|", "-b3=F", "+(y8Vh", "eC.47:Y", "[d~yJr", "rh9=I", "5!555<5T5b5q5", "TX0yr)jg0", "#`q]g4", "jl helyi el", "5)555i5", "1N{cd", "_.HKG", "PV-5U", "_V]EZ", "4L'architettura selezionata non corrisponde al tuo PC", "(B-jA", "z1D6Z", "5Arhitektura koju ste odabrali ne odgovara va", "Fmp1g", "Qgl#i", "Pp22L%", "#j%^(VH", "InitializeCriticalSection", "W0~0Y0", "}|/h}", "Fpwei", ", mihin j", "Fbbv,r7~", "4sTI6", "\"1$n[$R", "yAxCT", "IxB_I", "oGUPWh", "(\\{stmq", "j:%gL ", "f-@V9", "DBH9B", ",+sXAV", "q-O?!", "id?md", "]7y.t", "4rOiT", "Njkxu", "e i komponente se postavljaju na svoje zadane postavke. ", "Tk.8xi", "Q|mQ*f", "DLPLOG: [0x%X] [%s] [%s]", "bD-CB", "aceita", "d:~Tj", "V[>tT", "ajte ponovno pokrenuti alat i pripazite da odaberete odgovaraju", "rguteed ", "9rbl\"", "o do Windows enquanto outra inst", "!dMzQ", "Eller en distribusjonstekniker vil kanskje samle inn logger og annen diagnostikkinformasjon fra test-PC-er hvis det oppst", "7'7g7u7~7", "zNj\"q", "`9&6g\\", "KVhLa", "Akcja : Automatyzacja instalacji z wybran", "hW{>1", "`7Goc(8w", "feAP6yu", "vG[u(rBK;6G", "x@e'V", "A;?lDz", "G_F!&", "MV\"mi_", "85v $f,", "ND3G~", "/Priority", "iau, kai / PBRUpdate nustatytas kaip I", ";+;w;", "q3C^I?", "Exempel: setup.exe / auto upgrade / noreboot", "UTF-16", "@`v){", "$_-8,]RN4", "RZ>&,", "I>S)2", "nu arhitekturu./Do", "I!K,iQ", "OpenEventW", "I(M_!`e", "49__j", "M[4|?", "nY_;vj", "Au3Cn", "Setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers / postrollback c : \\setuprollback.cmd", "W37b}", "N@mC ", "9?3s!", "np*tF", "xvxA=on", "FVdb:P", "iyI|S", "Finalize Resume Found: [%s]", "e_iO(", "B~~,?7", "Primjer : setup.exe / auto upgrade DynamicUpdate onemogu", "rio raiz da sua m", " za nasadenie zhroma", "@'CU:", "hp'%$^M", "%jd;n", "PQQQQQQh ", "sh[YS", "'*a:%[", ">SYkf", "f-IUW", "lk.[v", "'*2O?", "C5)LM", "< $@@l ", "#>(rl", "As3\"R", "|4}'^", "2t,-z#", "vz!4$g", "Eb5`3", ">,><>@>D>H>L>P>T>h>l>p>", "est pas n", "SPLA)", "FWys=`", "ljuda?+Kas olete Windows 10 installimiseks valmis?sAvastasime, et installimine toimub v", "ysTN|", "vykus diegimo gedimui: ", "1IzU>", ": Upgrade; DataOnly; Clean ", "2N|;6rr", "ZA5E])", "Por ejemplo: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "(;oO;", "wcsncmp", "0xG&E", "9k?Y8", " Instalatora systemu Windows 10.", "*ZN5t", "In alternativa, un tecnico della distribuzione potrebbe avere la necessit", "CDlpTask::GetChronologyIndexById", "n, mutta h", "j{-ek", "to produkta atsl", "r=7r3", "b-QY|pM", "`C88L", "4pQqAh", "^A2r>", ")\"1&c", "Br~%4", "d[KQw", "|n8#*@/", "Pse~p", "CorrelationVector", "r endast anv", "PE~bIP", "AK}C=JD", "&guti", "s=SyN", "vFw I", "ktan sonra g", "r inte att starta den tidigare installationsmilj", "2Kn'-", "c'M7K", "26Y~.", ";vx;.", "Instalacija izdanja Windows 10", "u/Q=5", "7uu8V[", "inskim licenciranjem ili medijuma koji sadr", "E6TN_", "$0#U^", "C+eLrU", "Sb-~Q", "tti feladatokat v", "A'L@I\\", "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x", "q3Lk!z", ".:j?WU", ": / copylogs '-", "5Q^GyY", "^]+b8", "x=vL3?", "MtATu", "Z-_,X", ">sTcj", "=,1+3>mZ*", "qPHnL-", "BE<$`W", "vQ$mt", "2#!w ", "Perjungimas: / copylogs ", "&E40{", " syst", "Parametri: Lokalna putanja do datoteke ili putanja UNC mre", "aO[<:", "g/~E1E", "n setuprollback.cmd-komentosarjan asennusvirheen j", "2X,{9", "@qyW!<", "Z^\"tFau", "J2+.c", "KzI;iC", "c3-A|", "8fjA!", "L!qI$", "NtYieldExecution", "4k^|J", "WCJ!\\setupcomplete.cmd ", "Fpv*j", " friss", "Example: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "&obU'", "4mQ|r", "@U>.g(;", "\\&kL~", "ringsvalg for installasjonen. Grensesnitt for mediekonfigurasjon og fremdriftsskjermbilder vises som standard, men den er automatisert. Denne bryteren forutsetter ogs", "7/9eG", "5 6*6", "VA\"`p", "jx]|w", "]#D1B", "iY~G|", "{O6R-", "6rNeO`XNe", "ckU?`u", "ciju, programm", "T+-T*e", ".-LD/", "gE0k[", "eB)[o", "|%,4P4", "lG#Of", "BoxHash", "1Gll_+", "ly sz", "niejszego systemu operacyjnego. Jest on uruchamiany z tymi samymi uprawnieniami, kt", "'{Fnu", "h:_eLT", "jga]\"o", "i( q$", "essayez d", "e)ln/", "anas programma neveiks ar instal", "<0KnE[a", "6t9VA", "n timpul procesului de instalare. Instalarea va c", "z@[6h", ")z|X:", "%s bites", "<\\i0/", "{tyV\\", "Opzione: / noreboot ", "=[c`k", "definido como", "~j]])XW", "Omogu", "|uczi", "&Wstecz", "1)1O1", "CDlpTask::EnqueueAction", "c", "+uK/G", "A8X9X", "s a conclus", "PmWCV", "O-:mT,", "v'j!j'", "6#E", "RfJO=", "Yz{F%", "Ru Jo", "Ib{>&", "+heD:", "5GztE", ")t2Nz[L", "Parametry: K", "f\\I%h", "b7A}T?", "CDlpTask::SendCallbackMessage", "O:#E#Nz1", " vynulovania stla", "]\"1xS", "L*JDY", "oNp&:", "S`bi_", "in 350 MB de spa", "m98QV", "OmF(u-", "g:O>>f", "t`Oe1", "r5m&'", "1JJgP", "6}c\\?L", ";@x9^j", "i!<-fI", "", "K?D2A", "cJ&4_", "FNB@6", ",$vjx", "s}|u6", "telezi: licencfelt", "Ip44y", "Q:!EW}", "cie (h", "a=\"4;", "[4D|/k", "ze-xow", "*3Pws/", "0*4a$I*B_}r", "z0 H+.[", "P,eXL k.", "ech ovlada", "io>&7=Y", "jD50]B\\Y", "J^T@{0", ".C@;e", "P\\B%E", "Verificar a Compatibilidade", "HtH UY", "z2'sm", "s08Zk", "talujete t", "To:Y7@", "}u1 -", "KKJ ", "m1nbY", "q;vgt", "q>-#J ^", ":JDG JU:'", ".FY{q#+", "%1!s!", "B)&ss", "=MblV", "F~J')n", "CDlpTask::GetTransferProgress", ";UrLT", "{y4i ", "8Z'x|", "3?YB3", "G=**!", "/MF?i}", "cZD>&(", "seau vers un fichier .wim sp", "rj;-U", "#^OwNt", "3$Jt2", "ke Full, a felhaszn", "LGS6kq", "Qm[?;", "?:\\$Windows.~LS\\Sources\\", "c-V(#/D", "TYobU", ">v&6!g}", "ru bir ", "+evWFu", "9\\2^9", "k!E'U9", "NRW}=", "Start p", "#a(Yr\\", "864p6v", "$rH\\0", "a^5]^", "8!8\\8", "s palai", "ilerleme durumu", "b@:&,(l", "u{\\fKy", "sma-SE", "Biztosan kil", "&eMQr|", ":Q8Y-", "pgrN~", "vvJ,E", "TKfUG", "q$mkT", "ter> ", "LR4-Z", "Windows Setup kann aufgrund fehlender Installationsdateien nicht gestartet werden. Wenn Sie Setup bereits von einem lokalen Verzeichnis aus gestartet haben, kopieren Sie alle Installationsdateien erneut in das Verzeichnis, und starten Sie Setup erneut.", "Failed to clean installation drive [%c]: [0x%X]", ")4{wD", "rVGYE", "R{t5w", "VYR>C", "9@zOi5", "\"$4b %", ",!`+I0A", "Z`1jh", "Akcja: Okre", "#xbGH", "ucj(S", "1INWm", "Failed to remove MoSetup cleanup value, Error: [0x%X]", "QR-g?|", "eU?'h", "&6|Hf", "|PaS\\G", "fBOUXK", ")?K_`[", "k`H]]jS", "iv)|!", "{T(pE", " # I6An {", "[?+1\"u", "536QG(z(", "DeleteTaskByName: Error serializing state! [0x%x]", ",&bG@G8", "0&FS,>v", "_*.3D", "Launching process: [%s] with command-line [%s] in Session: [%d]", ",,xm\"", "C\"IKgY", "Parametry: brak ", "*[w9c", "HeG7Zj", "}x", "6@EcU", "sek keres", "aR59f|", "o foi iniciada corretamente. Reinicie o PC e tente executar novamente a Configura", "?F3k%", "installation de Windows ne peut pas ", "hA1PF", "suprimir", "aduje len vtedy, ke", "84+*e", "Z1i7e", "3t_rc", "-lQ]NQ]", "Failed to get [%s] directory Hard Reserve status: [0x%X]...", " wird Windows installiert oder aktualisiert. Mithilfe der folgenden Befehlszeilenargumente kann das Verhalten der Windows-Installation ge", "g*yS3", "w73d~7", "=`{R&", " ;8'5", "K'}*U", "\\]U~EY", "K(`Zd", "cm4t5", "Switch: / copylogs ", "{vo,e", "s3R/s", "G.Z{_", "iu-Cans", ".gfids", "j-2zn", "w`.Z?", " _j. o", "sr-Cyrl-ME", "By4P!+", ">3?b?|?", "t~d$?", "bW%n#", "Y)`-H", "]jM3*/q", "J;2{t", "udvatesse asukohtadesse kopeerimise ", "m{qoI", "tor z lok", "6\"uvs", "0Y0y0f0?ceQW0~0Y0", "x JAW", "o]Kue(", "5`\"UN1", ":rI-4", "!>!9>", "ky a ", "en-BZ", "dv[W)|", "ti paleista, kol veikia kitas s", "Hhd\\jd+5", "x(tf`", "47DgctDRc", "c<~a)R", "(G0.G", " poate fi utilizat", "NMTOKEN", "tor zhroma", "&3bR[N", "wWrfIOR", "Kl b0", "_1YWeBf", " Windows XP Service Pack 3", "fvI5y", "inku obsahuje s", "`2p.}", "8~7Oi", "RNlAk", "A` x6H", "[_]+L", "#pcM/z`", "cqY\"h", "Tqo5N", "iPQj+", ":$:4:Q:", "o&ka|", "RKOV=", "-,>Z[", "|@}D3b", "<-wY3", " %1!s! ", "28`EFl'4", " apspied", "I0hF]", "\\DVE#9H^B", "V]?1c", "*|sje", "D~m6x~", "echny instala", ";2) ]1<", "Ol:4J", "ra, znova skop", "9t$ t", "Bgv>`", "'X:fm", ".t~9|M", "N<9wv", "ur:XpO", "unara kada se dovr", "g*Ju%", "tu papildinform", "installation. ", "oiNM~", "G,|+f", "ke None, nem telep", "N?:JU", "IbZnF\"", "[o?\\y!", "z{}6>z", "i u257", "Phd(A", "f3-o13", "Dzz='", "1*/=]", "n7{k^lS", "Ng<8Bp", "I*7)6", "rOXcXM:", ": 'oB5w", "l,K`S", "zrLS3", "1(2S2", "nSetupDUUpdateFiles", "$@[~:", " bez wy", "e!Q,b)+", "R iXMp)", ")')^N", "Z%F:Z", "CWebScenarioCtrl::Initialize", "Parametere: Lokal bane eller en UNC-nettverksbane til en fil med navnet setupcomplete.cmd", "U\\11/", "Asennus vaikuttaa tapahtuvan verkkosijainnista, ja on saattanut tapahtua satunnainen verkkoyhteyden katkeaminen. Yrit", ": / migratealldrivers ", "cwI&g", ")uOuR", "chte ein Bereitstellungstechniker im Falle eines Fehlers aber auch Protokoll- und andere Diagnosedaten von Test-PCs sammeln. Mithilfe der folgenden Befehlszeile wird Setup angewiesen, nach einem Installationsfehler das Skript ", "ptT6i", "JWK7H", "6U_.22k", "*%RB.", "Nwu-{`%=A", ",#6dJ", "oUb=],", "E)MFe", "^]o(8", "\\5e&T", "G72s4", "_oE<1", "n. Cierra la herramienta, reinicia el equipo y, luego, intenta ejecutar la herramienta de nuevo.}Necesitamos al menos 350 MB de espacio para ejecutar el programa de instalaci", "'!#Vh", "unara u slu", "k:Hr|", "=b 0jSq-", "/Update", "#EhkY4", "Zj%`j^", "k`VVl", "Attempting to move working path...", "}R*DY:D", "}@kLi", "cJ}c?", "q?*+m_'", "=mc[S*", "*yImh", ": / DynamicUpdate pn^", "s}(y{)", "etky podprie", "oMT;<)", "n~03Z", "[Tz;.", "|%[K)%", "U:=`t", "50gd1M", "U!shTb", "Y2{#z", "Copying file: [%s] -> [%s]...", "Primjer : setup.exe / auto upgrade / PBRupdate disable", "al5Xm", "exploitation. La prochaine fois que l", "<])$>", "k+M\"'w", "B! \\!T", "ti teis", "w.7U7", "Wd{+c", "tzmF;Z", "1?3\\W", "rF;qN", "_Hk_Z", "}Ej,h", "H6)~~", "\"3iCD", "U4([G", "{79?i;\\", "~?3y K", "Y|!2`", "m!|'W", "Y*FYt", "Y.];<", "e au programme d", "%qbjvm", "QAmWm", "ranka atliks dinaminio naujinimo operacijas (ie", "D9'B]x'6", "`P=_hg", "W+vz4", "Q(m\\:", " nouveau et assurez-vous d", "PhX*A", "USER32.dll", ")9KE%", ">\\WjYU\\", "QSVWj", "ba: Ja / PBRUpdate ir iestat", "15*&D", "unalniku povrne na prej", "-I\\V\"6", "v|HnT", "[WK%F", "4GN[N", "%9lWoS", ": / Telemetry ", "{h-kk", "[|*l$m", "J@I1j", "`%8!f", "b*}DB", ")`iG@7m", "Z[J|\\s", "B_l+s", "pade zlyhania in", "ax+>$", ",)k\" ", "L9+4|", "RZ!MM", "Teisin", "/[_61", "Opzione: / copylogs ", "vJ83:", "7$7,747<7D7L7T7\\7d7p7", "P;]1&", "XGHgfHW", ";{N?7A", "8yWI^,", "xkN:)[uT", ",z:M$", "!`0-H", "FileTimeToSystemTime", "^$Hhc", "l~cS/3", ",\\=_V", "WE^Il", "=Z11G/d", "33g,3'", "D. Cm", "#x!&8z", "=Lut#", "F|]+c", "The architecture that you", "znak quiet potla", ".,D=1", "Z7)Y", "cie, kedy sa PC vr", ";Ew0j'oL!,", "-/rg.", "7+#NT.", "YS?NJ_^", "sJz=KoHH", "fuX]V", "8 ^(F", "ELh@a", "HeZf-", "Konfigurovat", "Microsoft JhengHei UI", "CzBKt", "b&ZhX\\", "UD\"='", "Alternatif olarak, bir da", "s'b9[V", "icM~y", "G-$G^9", "ACv8r", "SiteLink$L", "4GJ+:", "{&MMZ#=", "hZ|7N", "JO);{", "xNA+S", "JHsgA?", "O94A ", ",(#-\"u\\", "%s: Showing Resume mode msg.", "tw5}H", "#!Nmf", "+B*)Z", "g*|Y1", "'2q<^", "Pj2jl", " name=\"wow64win.dll\"", " %XGY", "[}5RP", " =|UC", ";[8lR", "ky Windows Update v aplikaci Nastaven", "8.{\\w?!c'", "Wenn Sie diese Version von Windows 10 installieren, k", "ben&u", "es-CR", "ja[H_", "6w-VJ", "(u7bCgP", "r0fGt", "\\~S^N6", "g)cl&", "A/Q%OO", "n con opci", " program nem", "pP8&T", "Unloading hive at %s\\%s", "WM6v9", "o dos suportes de dados da instala", "Windows Setup cannot start due to missing installation files. If you previously launched Setup from a local directory, copy all the installation files to the directory again and relaunch Setup.", "sr-Latn-RS", " atra", "-P,{x", "versement, OOBE sera ignor", ";m8~a?", "h(hch", "|fpMa?", "ob5c(k", "ivitage k", "T$@j[P", "n automatizadas. Este conmutador tambi", " / migratealldrivers ", "tV:'1", "|#+=O", "y6h)4/G", "3n=2vn$", "NpE\"nC", "\\x]c&", "TU$P5j", "L+|[VNn", "CSimpleWizard", "F\"Z}\\V", "Conmutador: / pkey ", "@//3h", "P^d\"V", "fuz*X", "l,/SY", " definido como All, o programa de configura", " xLD", "R#<=8", "?-5Q6", "Xfm\"o", "H(9?2", " tietokoneella ja/tai k", "g>&7{", "' G+A", "}KX>h", "\\j8W4", "7tP0?", "bin4~-X,", " M3)O", "sFD'm", "4r7YV", "[U\"x/>s", ">+?2?", "\\{@qi", "Vr\\s*", "wdTW=", "s|W/W", "W&2GR&2^k", "Ro#x_5", " versiota. Yrit", "TI&ok", " program shrom", "4MN!8^X", "installation ait ", "RQ^6,", "-Vf&6", "|_'vmM", "4 /t;vkI", ". Instalace bude pokra", ", namestitveni program ne bele", "Se-5t", "5S`Gk", "l(%KS+A7", "_Sozn", "Handling: Angiver placeringen af installationskildemedierne / files ", "z0/R|", "\\cUZc", "Fwu%f", "*5Ln~l", "X%mu](", "l#rr3", "#yylI", "/p8m%", "9#939H9`9", " Diager.dll", "P~r(<", "da ne", "|zvY\\Z", "vwwk>", "%Fj@SJ", "ite: %1!s!", "Jtr{.", "(II1*", "^gJ}l", "/PSpE", ")1_2I", ":Y4l#", "6<6W6r6", "8as~i", "26^dCK", "@c~d$", "#S5DO-xY", ")Ck'd", "26a%7<", "5\"5/-m", " aktualizace funkc", "[BIk-z", "Sagatavo", "*^I:J", "4G:\\C", "Parameter: / installfrom ", "u/vC}", "T')4e:I,", "NcptxU", "e+peIL", "'2T${", "{I`+[=", "be5SV3E", "rja om fr", ",{/QE", "P=}VO", "[5**=", ".b[[$", "e2.k\"", "n!y\";", "Lg%XU", "odsMj", "la lokalizacj", "XFu*r]", "\\6P6bO*", "!Y^L8o", "{ir'z", "}5/By", "02n~gyXt", "7n%[C'", " um script personalizado que realiza tarefas ap", "\"$&4D@[", " _Gva", "n;.i-C", ">h>Oq", "enir morda ", "dGnt$*B", "X`.13", "a8Fq3", "eK4j&", "6GVXc", "Azione: il contrassegno quiet consente di escludere qualsiasi interazione con l'utente durante l'installazione, inclusa l'esperienza utente per il ripristino dello stato precedente ", "9;MIG", "State", "?i[[\\", " komento suoritetaan j", "Idev]", "S(_^[", "\"466w", "c6/F/", "h>^Z,m", "a4d5G", ".sTato verze syst", " [-l@", "!a`Cd", ",:Yl0f", " festgelegt ist, wird die PBR-Partition durch Setup aktualisiert oder erstellt. Wenn ", "MGjDM^Q", "y-4VH)", "n, bilgisayar", "eC&=w", ":@;n;", "JKcK+h", "z^@|:", ")0.!-", "1;2w2", "sureaargumente. K", "6z}`8", "Hv)OLZ", ":h\"v{", "ver brugertilladelser ", " setuprollback.cmd-tiedoston m", "H.3Tf", "|MK/0", "YWy-Xju", "Ojc<\"F6", "o : Quando / PBRUpdate ", "}*a@3", "m, ka instal", "2J3Q3l3", "ZPDx`", ".?AVCGdiObject@@", "J2B6h", "K;l@o", "r\\8Dt", "Setup.exe nain", "Windows s", "czv%y", "Deleting folder [%s] before expansion...", "WSNGu", "nceput", "rd: Aktiverar filen setuprollback.cmd fr", "nR~~#", "Bfa~3^j", "2GH=u", "`NVal", "Waiting for transfer thread to exit.", "nek a megadott term", "Uk(5q", ": / installdrivers ", "kalu uudelleen.]Asennuksen suorittamiseen tarvitaan v", "RPQ`tTQ~", "ger f", "$tWT@_d", "^\\.mB", "UqMd6", "GC,}4", "n kielt", "z_]]9", "u^ohz", "eJ_R^or", "lretbP", "xT$W)", " />", " pirmas vartotojas. Jis turi sistemos teises. ", " la collecte ni au chargement de la t", "_J/36", "SVWPj", "28n|)9#", " grund af manglende installationsfiler. Hvis du tidligere har startet installationsprogrammet fra en lokal mappe, skal du kopiere alle installationsfilerne til mappen igen og genstarte installationen.", "xmlns", "Parametri: f", "uV\\V#", ">h?o?", "_`,_,", "tJ}ui", "`3Ih_", "@jh>jm", "o corresponde ", "UC';aB`y", "YmW=kI", "V'{C2", "7QqI$", "4.nX.", "~E;`W", "V\"LKd", "-NJ!u", "t&SF)", "I(%eo", "Y2])6", "A\"ick>z", "qTK-[", "4/4V4g4w4", "-mEb@", "S$Ad9", "~e8MX,", "()/MsU", "fj'J2", "y1VH&", "k](%M*", ">$>*>J>", "m|ozmd", "zA$RNt", "k%Exc", "Prebacivanje: / DynamicUpdate ", "CVpwg", "g.qw'", "Ch^sc4C&Z", "cution de la Configuration. Fermez l", "Toiminto: antaa asennusohjelmalle m", "*]Ya5", "Anahtar: / noreboot ", "DIXWbl", "QZ'{4", "-byX,zN", "pI\"g\\", "ie diagnostick", "t1VPQ", "9[V'(", "rIlB`zb", "g(w1la", "s6~ 4", "'.%_]\"", ":ort_", "lonej lokalizacji. Plik Setuprolback.cmd to dostosowany skrypt pozwalaj", " Specifically load these DLLs from the specified path. This", "/?ur'1m}", "a4.MH", "ckpTU", "!KIkx", "t1Dt4", "{2-rI&", "mn-Mong-CN", "[zVJ_;", ";9r;4zG", "@n;?b@", "sGr ", "lM(S|d", "?j>vb|", "9T6N'SD", "!(paEL4", "i(&a(#", "x PqB", "82 rX", "KVLVW", ";+><>A>G>z?", "SRd+@", "NKhH1", "o[l>{H", "nW:pwA", "\\[K[q", "#Ue$&", "_!M]?", "#)l=[", "6RhK{nO", "K6h7NN", "Opening Box container: [%d]...", "|FMkX", ",4a`U", "zca s", " asennusohjelma uudestaan.", "3Mol;", "+_lY%", "45gQXs", "NP.$dP", "vQVsa=", "Ii+X@R3", "EXcET", "k}(CO", "Cm$+I", "aujai un t", "EwBTe|", "0\\r@7", "\\P$HO", ".uO)I", "ClO\"n1", "AkN]z", "#ejy|", "u:%6G", "qhF7%", "d^WO2L", "OMQlK", "1$>G|l", "anas programma atjaunin", "mk-MK", "JZQV,", "D3m(u", "cwW$&", "8CKQs", "Zre\"`v", "EE\"r>,+", "8|bl, ", "8,838", "9R9~9", "4\"bC1", ".CRT$XLA", "|r1f[N", "e instalacija izvr", "E#r9 4", " upgrade na Windows vNext. Vstup u", "59Coh", "$J8Mq", "GP(6K", "19bBG", "|_UAg", "mi-NZ", "jTMd8g", ":13-U*", "`:e9*", "1Kurulum kullan", "$tI6b", "ller datorn till f", ">A_DF", "3P4j4", ";mOC+??", ">T|#=", ":P:a:{:", "7z^/_", "]\"&:/", "2Bn '", "Vf1j\\", "c1F5$K", "-5GxV", "lo-LA", "x.jWR8", "3a|! ", "k]yZ_~6", "29K>LE`", "q!AtJ", "w\".$8", "rience utilisateur d", "v1Gr~r", "E.Dp-", "+{?>=", "qElnt", "%,(xdT", "RS7ODM]-", "?Vr5kS", "f^mN,;c", ",in9w7", "Windows9Instalarea nu poate determina limba interfe", "ana notiek no t", ">Z>9c", ":Ri~P", "JId&1", "ZTy~H;", "XN:Iri", "Comutator: / Postoobe ", "Commutateur : / PBRUpdate ", "7FD'8", "Akcija : instalacijski ", "zs{|2 ", "9_5H}", "^vDtX", "trie relative ", "metros : Caminhos para pastas locais ou de rede ", "L$D_^[3", "~gBV,i", "]M[v~", "h^N``", "SetThreadPreferredUILanguages", "Fertig &stellen", "2(323w3~3", "97e0F", "bY:bp", "]EW4G", "+hqU:", "p=Mt.b", "I*;xm", ")|?.{", "Exemplu: setup.exe / auto upgrade / PBRupdate disable", " ?2@f", "b:4/x", "iei specificate. ", "llni a kor", "b|J1>", "u+,Ku", "pWl0w", "Zln3@.", "7).&8", "i selectat-o nu corespunde PC-ului dvs.", "vjJ}*M", "$7h7B", "1\"VL^i7", "NOmAt", "L`OPWA", "vg:Ls", "\\cz_=", "i}t#]:", "lckjPp", "O00{M", "Y`..,", "_JpBt", "*011!", "(+5xq", "klad pou", "}~-9v~", "tQ>SF", ")$&M!", "Comutator: / auto v0}L", "wcC;f", "$Y[A6", "Opzione: / Telemetry ", "reTT`_5", "r3y$t", "local especificado. Setuprolback.cmd ", "dpEQV]6", "|oIi4", "=w!y8", "fr-CA", "Lu-=t", "Example : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "20201009142756Z0t0:", "a==", "Z9I.>", "ctiRs", " ", ",45zF", "n^`~`<", "~Gr.C", "\\nCY8", "$2'p@", "q'J/Z<", " OOBE).", "<>IZh", "lwu3S", "`IO(K", "s9zEz", "75wRW", "7Y'MCT", " scenarijus, vykdomas, jei nepavyksta ", "Wh@RA", "Pavyzdys: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "ivitage arvuti ja proovige t", "(&N)4Setup.exe ", "696@6F6K6X6d6", "'7=>t", "`6-&)", "cijas: EULA l", "(Cz!K~%&z", "u medijuma sa koli", "DosDateTimeToFileTime", ">S5dE", "_+7=4", "CDlpManager::CreateDlpFile", "[xjc2", "Global\\Microsoft.Windows.Setup.Cleanup", "jraind", "ndan g", " i(oK", "\\(gq-", "7Q cM", "\"QO-N", "j]D>5w|S", " qui permet d", "Rqyp8", "T$MIo2", "gC9C(Hi", "Akce: Vlo", "GARTT", "\"#|Df", "t\"GzJ", "5G%)}", "terminer la langue de l", "`Mt3H", "x.#'O", "imi> ", "sMnqu", "Y7'f}", "File [%s] is newer than [%s]", "MS UI Gothic", "tx'x<", "Z1[+M", "-P<{k", "6Q'%AIT&+", "171_1w1", "X=FzN\".", "7r", "sw1{_", " w katalogu g", "}KoA@A", "x", "k", "qycq%", "*2#m=", " fkdw", "7#7=7M7b7s7", " e-7e", "UlA\\Tb", "Oc0f0", " MS h", "dias et les ", " ", "s4@==w", "xima vez que o PC for reiniciado, o programa de configura", "cR)aR", "L0+T~0", "Few~L", "T{7)b7 ", ":yj3", "Ob[K]", ";<'tSh", "ci trybu OOBE. Gdy prze", "^vDq'", "vL 2z", "m driver.inf dosyalar", "\\VWsiA", "* WWc", "ok:.+!", "GaT9K@", "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x", "je automatikusan ", "j\"+2DMdGr", "HcUc\"", "Za chwil", "nfWY{W", "hrt wurde. Es wird mit denselben Berechtigungen wie denen des Benutzers oder Prozesses ausgef", "installation va mettre ", "@@@ ", "lQ=3$", "y2'E'`hs", "9'9.939=9A9G9`9g9s9y9", ":auWB", "CDlpTask::CreateDlpFile", "zz|v*", ";De/]S", " g1|]f|", "G@9_ t\\", "s.U*-}", "-;GW;", "\\f_E&!", "}xTCOr", "%f17A", "\\'1\"Z=", "Gm$DGUY", ":u&d6", "iswspace", "Akce: Instala", "O+Ru|", "gmd+_", "KQ7G&", "Wp[z+", "u0{qq", ":`^5o", ".\\1M(", "#@IIod", "[SJ/{", "Hoq7eC", " Enable", "*$7[i3", "s}eKD", "@8MP%ivp;P", "1#161=1a1q1", "va zo sie", "$Y2>Xq", "tdn&~", "Xu2MC", "7n ", " ser ", ",@ HwuWUwU", "7}1~y", "hKxmq", "i?Y3g", " darbojas Windows 64 bitu izdevums, jums ir j", "c_|OJL{", "E+/e/", "(cNWc", ")32nd", "ndert werden.", "o komandrindu var izmantot, lai vad", "\\EN5d", "5V9&{", "anas programma m", "_6Fil]", "U>L2J>", "#a~Zi", "jypWM", "4H4O4x4", "Azione: se l'opzione / migratealldrivers ", "_Mu7.jG", "tor nezhroma", "Jq`d{", "bor pid.txt. ", "CA\\h{", " verificato un problema durante l'avvio dell'installazione. Chiudi lo strumento, riavvia il PC e quindi riprova a eseguire lo strumento.]Sono necessari almeno 350 MB di spazio per eseguire l'installazione. Libera spazio e riprova.WSe installi questa versione di Windows 10, non potrai tornare a %1!s!. Vuoi continuare?", "`(p!y", "i prov", "C6D,uk", "z{'`X", ":qk75", ". V p", " \"System\". ", "_yC$Y3", "GetDC", "?!t|7", "S-.PgN", "k3LxA", "iAnCiZ", "}DjV`", " loadFrom=\"%systemroot%\\system32\\bcrypt.dll\"", "K;Vk^", "SJmR&", "Example: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "S2w|;", "[(*C[", "GZ.Qw", "D$", "-B[gA", "'b^r2", "HP$)R", "qO\\s!v)", "H8^C{D", "Vf5Y3", "Valitsin: / showoobe ", "i\\&Mj", ".iDH5", "hsF4d", "=pWG6", "uy=~'", "^\"fJiy", "e?m?c", "C\"^%\"M", "<%=>=X=b={=", " uz failu setupcomplete.cmd ", "M)v\"g", "/be7m", "`ypJ*Z", "d%Eih", "2.Tfd", "zP$k #", "/h`4q", "F@3R2", "!b>B[", "P})<.", "XPQSh", "gOw7,", "AB,!t?", "-y6K~", " loadFrom=\"%systemroot%\\system32\\wintypes.dll\"", "t, hogy ind", "+m5XPUn", "/&(k5", "tzm-Latn", "8},=1]W", "installation ne peut d", "j=6O5", "4tMQc", "L(Jl*", "BoxMovePath: No target path found!", "1W/[x", "hrmXw", "oDG*b", "M65s~6", "y+cb1", "l^!ww", "lgende standardkonfigurasjoner: godkjenning av lisensavtalen, dynamisk oppdatering er aktivert, godkjenning av innsamling og opplasting av telemetri, OOBE vil bli hoppet over, PBR oppdateres eller opprettes. ", "R;JWx", "`B0?)X", "\"{.ZQ", "-b f", " nurodytos vietos. Setupcomplete.cmd yra tinkintas u", "4|xcw", "g5 `Fo", ":@-y&", ")LV?8 mc", "q{e>;", "TGh 4", "Ijkjx", "o>$:8*\"", "8G}iU", "#)p%6Q", "RegSetKeySecurity", "dI)k>", "0IMJR", "}\"C\\!`3%", "X#6&~y", "}>(+Z", " knGZ\\j", "!I-", "1G[Q|", "8/8@8", "X~H (", "5'_|EqT2", "(ZlZT", "installation qui indique %s-bit. Lorsque vous l", ".?AVCMoReserveManager@@", "WakeAllConditionVariable", "WRX]GKQg", "9;I}]", "s$wOF", "T$;J", "b1u!r", "}HTis.", "\\A=H:?", "lq1V{", "}5!@S", "nd se face upgrade cu suportul fizic de licen", "v ", "{\"B\"6y", "c instal", "FyQo~", "HR7a|A", "Q[\\+.)=", "un acc", "l>k.Lw\\R", "td5d>", "3ZO%oG[S", "zjnL vJ", "}F:y9{", "ew2;,", "DlpTask: Skipping action progress reset due to task cancellation request.", "$55t@45jn", ".TKSXbI", "OkXTN", "GYa+T", "6VEpp", ">", "DwordProperty", "ms-MY", "4%4F4]4c4", "/+v", "ZgNv`Qr", "ckkehren. M", "#B}aZ", "$mXB7", "xg-Jv", "nsefladen og -statussk", "?Uj}w", ": Z\"B", "WnK[[iK{Q\"", "metros: Enable ; Disable ", "ene lokacije. ", "y\\%#:", "klad: setup.exe / auto upgrade / noreboot", " do pewnych lokalizacji (takich, kt", "tter den, starter Windows 10 Installation automatisk.*Den p", "w8im~", "_j|WZ", "`!fwg", "i28w1", "*!06'", "M4H>5", "R1OT*", "@>dTA", "\\<\\t%::", "Spoofing detected: deleting [%s] -> [%s]", "/u |w", "7\\Zo_K", "^[a`x", "zm6MN", "^m0Hw", "NS7vPc", "h}*vH", "o(=)9", "i din nou instalarea", "~.m$k", "(W?x=", "uW0~0W0_0", "U[?vykF", "qN;JL", "-T~Jo", "ga2rm", " name=\"sspicli.dll\"", "P=7}V", "XdgFpV:", "K3pY+", "Parametri: Lokalne putanje do datoteka ili putanje UNC mre", "]l$qR", "AC24b", "|Cg\\B", "}.t>/", "1{*W!", "RO\\g0", "!PUg@W", "&BhSJ", "R?!Po", "vV<6)", "!Qq'-", "V3<;_.", " @4GQ", "-OSs3X", "\"?_q(", "DlpTask: Adding file: Name = [%s], Source = [%s], Target = [%s]", " ou criar", "~Tb;'#", "}c7y&", "ef8j(", "-O///", "}Uw]I", "onw", "6*D#4", "li izpild", "45S+q", "g8&J<", "loh po zlyhan", "!S$R_", " parcurg", "v[eE{", " Microsoft Corporation. Alle rechten voorbehouden.", "<\"m#y", "ceqvb", "ritetyn tuoteavaimen. T", "Oy@|)", "?EX%O", " kart", "_(}G1", "%s: Finalize mode requested, but not in resume mode", "pVrD1", "^u4ct4", "1P1m1", "tirir.Setupcomplete.cmd, y", " %1!s!. ", "e program nakon pogre", "@ypX'", "Tp5]E", "8N.+l", "bmlUi#", "TbUr\\", ";8:of", "o : Especifica se o programa de configura", "unalnikom", "(&N)NSetup.exe", "br(7G", "|cOxE", "F45-9", "Opzione: / showoobe ", "F5$|KA", "{UY[od", "UpHq*=[", "echny podslo", "ZEy<)", "tB3rJ", "_J8dQ", "ukrP!", "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...", "n tal", "tirip ger", "bZ4~X", "di&N^i", "F_jU*W", "KI]1jI", "F7{ ^", " t3L)", "auY]=K?lt", "eM9lT8", "{:J\\d<RER", "Egy rendszergazda egy ", "arqrI", "x !@c", "`uL'gAiE", "~OBVb", "5BvKB{", "g6!.w", "z2[I/m?", "][p3sG", "!|$<9}", "*\"}TK", "2DyG;", "huVux4=", "$o33a", "{.xz*", "|7 S/", "}]p1]", "=vy0t", "/o8}c", "LuxW>", "/AzureHost", "j4h?b", "\"pOE6x", "041804B0", "tor syst", "`VIy7!", "[", "$ReW3", "9'HH+", "s>a73;", "AH=QS8", "qxhOE", "W8m m", "v6J.[[Q6v ", "dia d", "Iw%JY", "8PXaF)", "|G~/7S", "CZw3z", " !+x!", "{uj,\"", "NOTA: ", "$`2X`F", "sL9x$", "hpXyL", "~DUnV", "mGgi+", "-X?)k", "S*Wlz", "b 5\\5", "KmJ69", "7`2CYy", "pFu])", "GetFileVersionInfoSizeExW", "iXoB8", "=Den arkitektur, du har valgt, stemmer ikke overens med din pc", "D,p'}", ";k9]m", "zc$Lv{", " loadFrom=\"%systemroot%\\system32\\shcore.dll\"", "I^=cA", "Taw|i9$", "J7$6#", "pmV", "{n]$pa4", "nv6;S1", "G5x$BD", "Hx.GZ", "ubqaQQiY", "tu pirm", "+>k?S!", "Ao?`mib", ";|ort", "q/FYN#", "(KD3,", "HG0Vz", "vY7/`+", "kc3;h", "+M`Hs", ";e%~O}", "6vw!f", "E5qK-", "t)hM?", "|:fe\"@", "z#ky`", "be9O~", "eli v primeru neuspele namestitve iz preskusnih ra", "%|{|.", "Konfigurova", "3^66fUzA", "m*,q5", "c`T'8g", "'^\"+|]Z", "Hs[5w", "fp\"u?L", "~Ukja", "EiIHUG", "hb[?n", "dNy5{y", "!Xl1X", "e s mre", "#yLtE", "m%9z.", "_3}`o3", "Parametere: N / A ", "i komand", "h8PS1N", "z?1]'", "bz}$[", ":xy\\%>", ":x.\\G", "A2~P,", "|O5;xG^W", "n: indica si la instalaci", "Action : Automatiser l", "Resetting rolling average list.", ")uU0].", "99veU", "\"n.g|", ";yv]VK", "WB-w`", "|h@@41", "PSSSSSSh ", "#(=Yp", "\\UvNt", "% r/%", ";&!TE", "{CC,b+", "dj/}m", "-/Ra8H.", "ne instalacije. Slede", "hren Sie das Tool erneut aus.", " ]+u9", "\\`Sj)", " ignorada e os componentes ser", "YN)\\B@", "{{w7i", "+ymPwJ)S", "c%?:5Q", "x\"^CT'", "_L$A]a", "T.P}$", "5)<+i", ",gPhepO+", "i(9Q4", "Z_0g.", "?\"?*?A?Z?`?", ":'<+(", "automatisch opnieuw op nadat de taken van het besturingssysteem", " 350 ", "u90G<", "Exemple : setup.exe / auto upgrade / postoobe c: \\script\\setupcomplete.cmd", "-s\"K[R", "Operacijski sistem Microsoft", ". Atlaisvinkite ", "br%'*VWl", "Z}Y^>f", "=&=@=T=t=", "*>xiHo}_", "metro : / Postrollback .*", "U|?>D", "cznik / PBRUpdate ma parametr Enable, Instalator zaktualizuje lub utworzy partycj", "f$v/q", "*s&0O", "ad: setup.exe / auto upgrade / Telemetry enable", "zAeqc", "LWuQK", ")y_?tR", " datora atk", "P;3|~", "%N,}5", "/uk", "cJO(}", "D$0SVW", " 8M\",", "rifier la compatibilit", "VlcHT", "^{@*5", "K\\hk8", "c~", "uc9W*)g", " SetupHost.exe", "-_|o4", "vGo{J7", "bExct", "tcU&Y", "Redo att installera Windows 10?sInstallationen g", "ekK_v;swA", "N6X';", "Operativni sistem Microsoft", "RhFx-", "xO|\"4", "*9;x;", "'F!GS", "!*i.q", "3)Flljd", " / showoobe nastaven", "es e acesso ", "OF.b=", "7#ngO", "CreateProcessW", "PW0f0D0~0Y0", "2<2R2_2", " ", "0avs&a", "ayei`", "DrawTextW", "FKrlr", "Bq9/F", "z^R\"&8", "p}\\?T", "9D9WW", "4ewNo", "n&tL^(", "tUzS9", "(t`6p", "f90CJ", "j{:Lj", "-S~|B", "4!;ed", "^9-)[@K", "O_/uY\\", "~en]t!iP|g\\1", "cessaire pour ex", "\\=|N3", "V5Ecxfr", "lneho adres", ">7{MJn>\\", "B&08>", "Em.e>", "installation tente de migrer tous les pilotes lors de l", " ", "klade scen", "\\j[DNd", "~-z+8", "SetupDUConsumed", "&56wH", "OFqZx", "SleepConditionVariableSRW", "]Q}M+U", "ocI(iS", " arba naujina jos versij", "PUJ;S)[", "o8c&w", "anas pieredzi:Uzst", "mS*uD", "yO`B(i", "s rendszerrel kapcsolatos feladatok befejez", "O7n", "Yq;H0dr#i", "r}[}]", "wY`f'N", "hZ20w", "%WcR*J", ":blPs", "4s\"bWaN", "k*}]j", "d+9S.", "]1]F1UItdE", "#Tn! {[", "mM!}j", "Namesti", "j2X9!", "|11p\"u7", "z alkalmaz", ", instalacija ", "?ZC%0Q", "&F^-H", "gu6%o>W}F", "285r!", "W@9eo", "(Ve9,", "en-AU", "RlG\\U", " alap", "DnufQr", "H\\setupcomplete.cmd ", "OZ`tx[", "zC[m_", "$Windows.~WS", "La arquitectura seleccionada no coincide con tu PC. Por ejemplo, si tu PC ejecuta la versi", "2*#J^", " Windows 10\"", "i;)vL", "D]fEN", "JivQs(C~\"", " palaida uzst", "B<x/l", "gG^03", "c+`zN", "60I>Z", "RegValueEnumAction::Enumerate", ")Q))Qy", "m prihl", "*41 9", "z_:z5", "*XQ+_E", "|tGDF", "netici gece boyunca, departman bilgisayarlar", "Panther\\NewOs", "S7}OJ", "tres : Upgrade ; DataOnly ; Clean ", " : / Telemetry ", "6h2+s", "I2%63A", "E~dB}6", "ppp@@@@@@@@@@@@@@@", ";5F|I8", ": / showoobe ", "XF~q65)", "DU={k", "o, mas automatizados. Este par", ".0PHip", "^lm`4", "qts@g", "S`zWZ", "Nastavi tamo gdje sam stao", "au moins 350 Mo est n", "FaB`~\\", ".?AVCDialog@@", "Cleaning MoSetup Volatile key...", "A#I4,", " permettant d", "x$kOz", "Action : l", ")p+sVC", "fK[?_", "-xe/)", "@s=2_", "^X+~j", "RuFpI8l", "uvei. ", "9n6c'Rp", " |( Q", "Luf9k", "NnP3I", "/Ycq|/", ")5qRB", "Z3#~L", "iune de migrare> ", "insko licenciranim medijem ali medijem, ki v mapi z viri vsebuje datoteko pid.txt. ", "VeB ", "pg4F|", "![1dk$", "\":uEP", "zca makine OOBE", "3W>8yZ6", "qb2Y:", "Action: Specifies whether set-up will perform Dynamic Update operations(search, download and install updates). ", " ", "-Vdee", "W4nG`", "sktoO%", "+3F<}&}", "it jazyk u", "yl,!&fD", ":[vug", "Indstillinger: Lokal filsti eller UNC-netv", "`$m]V0", "Bhd\">", "^(u-Nl", ":nm>1Eh3", "D.gzrl9", "%#!H4p", "PF}~Z", "`WwjW", "-/#Ej", "7,bX$", "MNZ\\DZtq", "q", "~c+@4x*P", " Install.exe-tiedostoa", "Ey^{+", "iere .inf ", "xT2)X}", ";*+4j", "}wkhQ", "^JQvHYsp", "+~r%l", "d%k)j", ":*:^:", "100706204017Z", "cznik / migratealldrivers ma parametr None, ", "```@@@", "'VK\"$", "udNi3", "?ekNE", "Parametrar: Enable; Disable ", "klad: setup.exe / auto upgrade / migratealldrivers none", "Ag #m", ".s2h\"1", "K#CJ\"e", "c41Jlfj", "/=0&!", ",':a8", "d9X_V", "A*D]J", "Gltg$J", "nssnittsspr", "br-FR", "TUScECt/}", "FpfEN", "0uO|Cmr", "V|~0Egk", "<9:HW", ".#)k'FA", "w@mp-", "0VA{O", "zS{q|", ".e5V_", ": Full, None ", "@1m9:", "un bu s", ":Q8!'", "u&f&.", "L!(<(", "@9#M+", "KnILk", "rge. Sulgege t", "*p;j4", "Td=XG", "mo\\he`", "4\\7G%", "9{?^Y", "~l0%1", ",';H*", "`3PPcF", "Z-` D", "crans de progression sont affich", "tJhHu", "me est survenu au d", "`nGQ#", "installation de Windows 10 n", "@=Jwc`", "s,y$y:", "Prebacivanje: / copylogs ", "[t59Ti", "Soutien", "I(dTr", "T~OUov", "N`Q-U", " Windows ", "5OAEf", "e se v va", "6H6S6d6j6s6}6", "I]t^`", "@LOf]", "+@Z/?", ",_sL1", "^Ro\"'|", "m2|7X", " durante el proceso de instalaci", "Ix3p8", "Csx2z", "rzt=S", "Akcja: Flaga quiet powoduje pomini", "ne informacije. S spodnjo ukazno vrstico namestitvenemu programu naro", "w+F$jy[a2", "VvcTT|4", "BBVS&h", "`%|qK", "DNz'?", "t/$_'", "Wir ben", "03C&`", ",2)wg", "om1nO", "LH+rL", "vAZGBc", " versija nepalaikoma. Seniausia tinkama versija yra ", "syuM[i", "m,'ug0", "k5@N-", "uU.hp9", "Commutateur: / installfrom ", "=Arhitectura pe care a", ". Nelietojiet to ra", "y?-==o_", "Z/or:", "#]Ys3V", "JsLVxJ", "brP`Q", "pl-PL", ";&OO_K4K", "hrj[9sM", "J3kHU", "fVJDi", "A[.6~", "d", "Ywu`<", "ba: Ja / migratealldrivers ir iestat", "B)?/R", "]^CFy", "5}((7", "R~dOf", "TH2P5", "MulDiv", "NON:BNZ", "n*V!$", "Bir y", "I4xW-", "1PXrL", "e|%:X", "yXmAe", "Y\\5k1", "G\\BF-k[", "tsa el ", "]wOD?c", "`PeP m", "zOEp.", "88882200..", "^xrRU1h", ":J0m^", "Eksempel: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "Operatsioonis", "t|3A+;", "CX>a\"", "8t7:I", ":R,YZ", "Qy-l<", "#S_3|", "tn-ZA", ":50g ", "WKY.]", "Veiksmas: nurodo diegimo ", "CDlpFile::SetSourceUrl", "=}oN>", "m`)b`", "K*FP#", ":)efT", "B?xF8", "5XEp_", "gT/b0|", "PkYy>^", "M~wt~", "6}6Gb", "elite li zaista da odustanete?,Da li ste spremni da instalirate Windows 10?", "Da*zT", "az-Latn-AZ", "ttes ikke. Minimumsversjonen som kreves, er Windows XP med Service Pack 3.", "Z(Wfa", "tX:*5K", "fBZg ~", "/7G [%s]", "\\#N?2", "NOoQk", "bJlt}", "CStaticEx", "iti OOBE. Ako to ne u", "lp_k\"", ". Zkuste pros", "RX$n5", "diegti ir gr", "uy&Pz-", "L# (l", "/Nyp2<", "iKie>", "9j(E<", "+f'0)", "W{nH&Mx", "^moDB", "XNP~5", "{}#r_", "!+\"f_", "^8.wQ", " ?W{Dm|", "j8X]V", "D$LPS", ".MCoiS", "${mlQ^", "Hb9'U,", "-aDZ8,x1", "*tn*U", ">#WY^", "MoK^V", "E^`)6", "vTTTJJ", "b4KK%8", "e.r::", "F]1:OW&jD", "l[S-;", "CgEi;zNK", "wxdo`S", "ej#?.", "UY%7B", "e se spu", "kleme hatas", "1'1dL", "xp:55", "F$mAJ", "e,wHcM", "e je stikalo / Telemetry nastavljeno na ", "Pj$^V", "'5r[>", "9oqj\"", "ef8_k", "lT&Mw", "w", "Bj_h3", "!^h*'", "Perjungimas: / installdrivers ", "};S\"GA", "a oper", "7uSo.Q", ";xA~y", "\"!e;x", "Schalter: / showoobe ", "PGFGE", "y{Q_\\j", "9\"Jl=]", "TV9C!", "ya6kcE", "{g98-K", "kpR%N", "A&tgal", "A*D&K", "/Override", ")4Uj_", "i vratiti na %1!s!. ", "YO\"*Q", " migrar todos los controladores para que formen parte de la instalaci", "m};OX", "ppp@@@@@@@@@@@@@@@@@@", "Fx_{B", "W_IuUD", "b'/Hf}", "A\"{KO", "cg?nF", "FHPDy", "?ka}p", "[=N%X", "|J>yI", "g\\D>!(", "eX,s`o", "Rvo3X", "0k3:p4", "7L}s~", "FsgylK-", "ro*i&=", "*5ENt", "Z]=uIGo}m]", "NPoku", "U)$O8", "wC>4K", "Wor[II", " tai prosessilla on. ", "3Aa[.", "9<~eX", "KYP,:", "&99Qh", "Xy\\A#", "rio de raiz do suporte de dados de instala", "\\gg.?", "9*&sTL^0B", "i*8cS", "vu^Pz", "TY/0lp", "TGj#u", ":\"Ua>", "Oxd8x", "Example: setup.exe / auto upgrade / showoobe full", "wc?2t", "OjbLH", "VB/?{", " / PBRUpdate nastaven", "GetSystemDirectoryW", "J'3&Q", "VOQZk`=I", "YZ3 }", "YR6qY", "0Xsyu", ":Rpn8", "E&wC7", "/Fe\"=5Sj", "L$L9=", "/hM>F", "\\J)?0?:?j?q?", "mm4sU", "|-$[Y", "1p2z2", "\"g%Viu", "YKp_gAL", "Xg:*t#m", "Conmutador: / installdrivers |6`", "V-,2C", "`(C)8N", "O]e9M'", "}50~_", "yO7q:", "o : Quando / migratealldrivers ", "\".&Mdp[", "c62[P{_O", "zW>6Zq", "|", "b^G{~e;", "05+[S", ".i^t+", "\\QN#To", "^O\\U^", "?A:Lb+]", "MrQ))", " Sn0^", "Am(zG", "a]aX-", "\\vI.K", "Jz {S^*", "Parametreler : Upgrade; DataOnly; Clean ", "\"DB wW", "Onemogu", "A>oz7", "Bx.OL", "LMUwuUuWwu", "_z`\\/*", "Installasjonsprogrammet for Windows kan ikke starte p", "uk-UA", "aBP/Q", "gt_XC", "F{tTM", "%s\\%s\\%s.mui", "z~./0wF", "\"EC1E", "`#c},", "g5Vk8", "Veiksmas: diegiant s", "7K)xY", "{,Re?", "pI\"5G", "j:Yf9H", "=Z}5\\", "mu Windows nen", "g0R&D", "ranka automati", ": / DynamicUpdate ", " ignorado e os componentes assumem os seus valores predefinidos. ", "K\\>f9", "060<0o0v0", "~#KB)?", "(7ab{", "YiU9i", "specific.wim", "ico sistema Windows 10, se ne boste mogli vrniti nazaj na %1!s!. Ali ", "^V*/o", "rtuseks on seatud Enabled, v", "*=@-\" \"", "&<>*", "RV*6.", "ny!T!", "Perjungimas: / installfrom ", "'N2Ve", "xs,=c", "~| < ", "Awy`1", "Mv'>{", ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@", "^]0n0", "!L&d ", "o completa para o Windows vNext, necessitando da entrada do usu", "ro{SR|C[", "BuYGK", "ra neatbilst j", "GC)Zi4", "sLB H", " verze Windows, mus", "dMyY>", "MYL)F", "eZS&:z", "h &Z;", "[\"", "bw<5]", "^{wcv", "JdZezI", "ppp@@@@@@ppp", "Error lowering priority for WU scenario, Error = 0x%X", "v$J*Ee", "~d^bulc", "+++qP", "uf-{%", "V`.0+", "Q]d|>", "q5PWk{", "&geDU", "o:mdG", "1+)lL", "+XM{x", "60666^6u6{6", "hVYi$", "-*Yz]Gn|", "o de funcionalidades. V", "+C?Gj=}", "+ahm(", "jqSq5", "(_ri ", "]gdyv]V", "#dZ R", "oZXJF", "718\\8", "0>J#7", "*_wc[>", "V~N}x&!F", "id7U0", "#}mDUb", "`X{/)", "a (Out of box experience, OOBE). Pomocou nasleduj", "`SIQn0", "nYGW#", "MtJVr", "gwHV0", " smlouvy EULA, povolen", "fDuw(", "Flushing MoSetup registry key...", "WQRw'", "xW:&nK s", "fH`/|", "{k#0:", "i zaten ", "D{QpR", "X?TIT", "O?f<6t", "t t#\\", "y*5Du", "cznik: / showoobe ", "dpm0n", "fT|5S", "~o6W#", "-u#m)", "smn-FI", "%94d7", "vdmId", "1b4b@_", "@Qm6t", "~n\\H.", "Action execution thread timeout period: [%d ms]", "3,333G3O3U3[3a3j3", "1,121U1e1k1", "I\"h&r", "nj X1", "gp1H\"", "je.E1", "z`6z6", " on jo k", "Q!{YBX", "{FqTZ", ":h3qo", "ie inform", ">gltKr}", "O;67x", "kkelen til installasjonsprogrammet. Denne parameteren er ikke n", ")f{$g5{", "{Y5f{A", "fFBo ", "a>/Nn", "+Ut[c&", "8),\"y", "'Wxm_(", "j#,g^", "\"vQ4P", "ekpCf", "6/uqwn", "CDlpFile::Deserialize", "@OWCOOq", "N=5\\9of", "ratud asukohast leitud driver.inf-failid. Installiprogramm otsib rekursiivselt m", "gyf4& m$", "dyt%Y", ":(:X:", "BYhZ(", ">N4uw", "ana un aug", "\"uUvY", "=+j~Hy", "IohE!l", "{t>zT", "3}ST;", "rskenduste otsimine, allalaadimine ja installimine). ", "ii}S3", "Creating directory [%s]", "tv+^<", "R@O>|", " para o Windows Update no aplicativo Configura", "D9#Pn", "Bqw;\"*", "n^ Nxd", "Q7?8G", "b5r}^", "nGK_EK", "S+~?U", "B-n>.", "s$52]", "S67K\\%`", "n7Lr& F", "?jg7,", "H<{Vk", "marrer le programme d", "NYm:;@rN9?B", ",4Y`?", "4\\YN4p", "[osxh7", "+PSA][", "dku spus", "n#sF1", ":G;R;", "lQ^[eV", "WH@?P", ">GG!RD", "D9Ckt", "M@tQ`", "NT Mq", "VN#G", "%&rJL", "Start over from the beginning", "cPQ~h", "NT Kernel Logger", "+*.]O)", "_initterm", "be*N?&", "r pri prvom spusten", "ena mogu", "[6I~1,k", "driver.inf-bestanden in de opgegeven locatie tijdens het", "<2MdDtu", "4yUzd", "iNX1u", "?>n[sH", "L#^*b_", "^6H0Sj2", ".VGr]", "_", "w[RaZN", " 350MB", "GPz.s", "[`Di6Tat", "]9uD'", "!s=&n@", "iune: la eroare, instalarea va copia sau ", ">@JJ;;5", "jwf?j", "J(mQu", " driver.inf", "~DAsz3h", "hw\\86a", "x\"YKv", "Exemplo : setup.exe / auto upgrade / PBRupdate disable", "=81sO", ";&yxz", ".YR'l", "0g0o0", "be Windows Update v aplik", "=&;X[", "RJ~Ie", "@~e4~", "6x|gQ", "LUiFo5(S", "(~J_sZ%4", "$Lig^", "=Z8+qG}]", "CVE}5", " los archivos driver.inf incluidos en la ubicaci", "]zE#g", "q<\\(n", "5;,}e", "B7%Z2", "_Qx7_", "iune de instalare: ", "3NABC", "]J5@@gOH", "Wb`wj", "n no migrar", "D$PPQ", "}yf%GH|S", "9VC3F", "\"ZT)o#", "f[X?x,", "Y5ctc", "T_AjR", "!^TN}k", "J+iT9", "f`|I^", "}pz$*", "g]&LG", "TN=(d)", "FmfY&", ".?AVCStatic@@", " impostata su Enable, il programma di installazione raccoglier", "cessitent des autorisations d", "%u=1>", "`Bnj ", "l2h'(4", "8\"pA5", ";|1j2", "QiCPgk", "&>~&L", "h953Vk", "NtSetInformationFile", "uxJW`", "cYA?E", "je Parametrai eikite ", "2\\R!w", "Kc#{M", "\\\\?\\GLOBALROOT", "Y14ZCd", "s onnan, ahol abbahagytam", "wsrsR", "mas kontekst", "3(7!}", "jFAs1", "oB03k", "Scenario - Based Usage ", "Parametry: lokalna lub sieciowa (UNC) ", ":_}0gQ&}", "i;k_gJ", "Bruk den andre installasjonsdisken (%s-bitersversjonen). N", "Fi^Qa-", "CDlpFile::CheckInitialized", "&Peruuta", "KhCYv", ">,J ", "}k{]l|8", "TpL*_", ">`\"z=", "0O:5(", "6fI6f", "nak interakt", "Parametri: klju", "n9T|%\"v", "jmm}yy", " ", "$2`Tpb", "!81;6", "qkjVj^Lw", "h/9O\\", "\"*9tq", "tl]J9", "o3pO=", "?*z\\A", "UB|UA", "(HN{4", "dzis: / noreboot ", "(\"OQJ.", "k1z-F", "Lxj)N", " dit installationsmedie.", "gar och UNC-n", "lEwP{", "G-T-O", "/=Jw,\\@", "Parametre : k", "CDlpManager::GetQuadwordProperty", "\\x:pr", "e\\ls.", "9$9C9s9", "MO3Bu", ";zX3q", "EjjU(+2p(", "2L-S2T", "VH,.V", "IT>Bv(", " *!\"P", "DJG@$", "fh5qYiE", "OGxu}", "{a|7V", "*W8Sa", "upUnloadMountedHives", "@i;HfG8", "z;}$Vp", "][}:h", "$}8)s", "3rNL\"", "KkL+!", "3B%eUP", " name=\"wdscore.dll\"", "363E3R3w3", "Toiminto: quiet-merkint", "&m4&%M", "Q|S8,", "V1U&>", "Z|5[I", "ide: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "_T:=.", "ok\"`]", "jvj;a", "aujas ", "w)sK0", "tres : Full; None ", "%wNtE", "JxL%<", "terek: A setupcomplete.cmd helyi el", "1XHc=;", " /rrX", "=tkB+z`", "3(4/4=4", "TVLKJ", "L(_lY[Izq,LoJ", "ibdYG", "IU1?|", "(XLGNl~", "U:]?bq", " necesar", "8<:N'", "e/9HN", ";='\"\\j", "-a}6n", "|#Q/R", "H:tIRA", "k)*1F", "jV13p", "Aktion: Gibt an, ob Setup Vorg", "uF3mk", "Bvhb-", "^C[vi,", "q_&1IFx8AXZ+_:G", ".0oO5", "/Override %s", "TF.!YY", ";pkV4", "1\\lY+", "BwvrtXb", "?!viF", "n tai luodaan. ", "Por ejemplo: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "#zkz;}", "J'Msw;", "Parameter: / noreboot ", "Ag-+z", "]u.;^", "%![1Q", "hv:%C", "B4&^n", "\\Ya@f#'", "yzjNi$", "=kxTE", "{]~7F", "$m$Qz", "NtOpenFile", "Mr\"m]", "gM,nh", "eca j", "1at!\"", "n no puede iniciar la experiencia del programa de instalaci", "l. Nem szeretn", "rwwokk", "Vht~@", "ZlA^u", "PIRW{", "#}+}r", "rtelmez", "e dovesti do automatskog ponovnog pokretanja ra", "161e1|1", "rU{Ebb##", " architektur", "Toiming: nurjumise korral kopeerib installiprogramm tihendatud logid v", "zi-LR#", "Q6F$;", "`I9.I", "`U;'T", "}!b{:8D", "\\-o5)m", "OPMERKING: deze", "{Fey3Bf", "H0=p<0o", "2ST\\g", "_%/ok+", "-dd?,*CP", "=54Qz", "2KD)X", "o alternativa pode ser a de um engenheiro de desenvolvimento que pretende recolher registos e outra informa", "nottoteknikko saattaa haluta ker", "!'w/w<", "q/A6{", " OOBE, ", "EnableWindow", "&ilg4", "-SJRz", "A]?91", "rD&1)", "t8c{ ", "/^z$f5", " nastalo kr", "):zN8", "j\\Yf;", "IN7A2", "e=D1^", "AZB-T", " tyto v", "__RTDynamicCast", "NCry)", ";b'DW", "4J4y4", ")lDt8", "architecture s", "%MB=:4", "3wA+}", "z0 R/VJ3", "n/54[,", "!kx0(", "7OF=l", " wdsutil.dll", "uiU|a", "s;`GZ", " XML-", "$u?Im", "}s|s}", "pF6yC)", "W+0'<", "&+}d0O", "po[Yd", ".7&gw", "(x>?Q", "IRReM-=", ": setup.exe / auto upgrade / migratealldrivers none", "Nz}tm1", "9`\\", "7F8O8V8`8", "G=v@p", "RV0;^", "TGggo", "zDFAA", "]T\\YT}a", ">A%x6c", "7$818J8p8}8", "4brjt5", "R+kh%", "}}Vlg", "omf$S", "Px AT", ", PBR ", "eW0_0h0S0", "o&_9zo", "]_", "h1Ncm", "5Y{s3", "n\\crg", "2y?*`!vp", "ja-JP", "TH*!U", "q", "9=9`N", "unar i poku", "Iq{+g", ";-47]", "&9tqH>|", "ff~\\i", "}3!;p", "g9Y\\EI", "Xd,7N", "~2#\"M", "F4O(U", "installation. Le programme d", "BGtEV5&", "#}e_s", "e[Io.", "u/c,i", "KPMc` ", "c#x5<", "BB AK", "r / showoobe er angivet til Full, skal slutbrugeren interaktivt udfylde OOBE-oplysninger. N", "[WV.v", "jnZ[L", "y',bwx", "s enged", "PA\"BS0", "^zYK'be[", "8o>8W", "~`iqt\"=", "CBootScenarioCtrl::ShouldPreserveWorkingDir", "7G2Lz", "i zahtevanu verziju XML-a2Gre", "<@6_P", "O^[Pf", ":OK5=", "^Q[>T", "]f$MBS", "WvL{x", "er podrazumijeva sljede", "eX", "sterilir, ancak otomatik hale getirilmez. Bu anahtar ayr", "7?-9g", "$,f/[", "qnK~g3", "7F?SP", "eli, da se prika", "%C3R\\", "m\"ulE", "KUS)d", "EBXU7K", "setupcomplete.cmd", "<=IkK]", "&Suivant", "+4E^!", "tk-TM", ">\\setupcomplete.cmd ", "?\\Z})", " interfa", "*.kDR;", "~9~y~", "YQuDr", "O\\\\>I", "}Tuh[cl", "CSetupLangIniLoader::Initialize: Adding language: index: %d", "!W`&ep", "35&hE", "C.|4F", "l+',+", "%s: User decided to Abort Setup to keep Uninstall option active.", "*^B!e", "8X;=e", "*Z32[", "qL \\V", "_:!SU", "oURd].", "Executing pending rollback command: [%s]...", "is]", ".WvFaA", "Sc}$KT", "jies intermit", "Beispiel: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "fM\"(7", "UZBx(", "w`#ku", ">[7`^", "]b[tGK", "ZHiba t", "s\\>sh", ",-`Wv", "'f(O(-", "c<'^0", "t kell haszn", "QhO", " -,CaA", "r att testa installationer i testmilj", "4tu#`", "E}V;VJ", ")rb~+", "+'rwU", "-ifTH[", "UNKNOWN", "575j5~5", "F/c e", "bp~bA", "){ddXa]", "Suspend! Terminating process...", "@J9G^`", "JjDf-", "0G1U1[1", "kog programa prona", "CreateCommandLine", "MKtOs", "{c55U", "G34_+", "CQV M", "c71kw", "L$(!t$", "cw@_tg`M", "ter OOBE de fa", "Parametrai: vietinio failo kelias arba UNC tinklo kelias iki aplanko, kuriame yra .inf failai ", "1?\\+`5I", "lETq~", "<7PD;", "zX^R,e%1X", "5BWWuE", ".YOpF)l", "Ylbcw", "{~eIr", "-3\"]?(", "GaJ6M4", "KC=fm", "Eylem : Kurulumun Dinamik G", ";N+w4", "sq~3r", "->iA=", "bWtlg", "F+JPN", ".WI)V2", "&<1&E", "0V)v|", "4p|U|", "Y=\\co", "`H?UO/", "$Wd/{/B", "|sHO}", " a zkuste spustit instala", ";'b_X|~b", "F@l'@", "j\"v@05v", "<;KV9=", "P5tey*", "6LEAkJ", "JK,<'", "PM\\j7", "ev[.Y", "\\#f`|", "n: cuando / Telemetry se establece en Enable, la configuraci", "mPMFL", "jams, tiek veikta l", "CeLB=w+T", "zati kapcsolat. Pr", "IdqKJdq", " nytt, fortsetter installasjonen. ", "/r|v >", "Cmzi!\\", "V\\,c8\"*]i", "Comutator: / installfrom qu", "Veiksmas: tyliojo re", "tXz_&S", "{/hJ{$E", "$J()){", "~qa\\iO", "'vW7d", "DuplicateTokenEx", "D0^0i0", "p.)K5", "A preparar %d%%", " till Windows Update i appen Inst", "'eO*{", "sR+A-9}s", "CreateCompatibleDC", "}l'*]", "Informacje prawne", "s)cgo", ">74AZ?", "de ni ", "gJ61U", "(OD8+$P", "uXA1+", "cursive tous les sous-dossiers de l", "M/q[/f", "?};sb", "?#?)?F?K?\\?b?", "enjima. Ne bi je se smjelo koristiti u produkcijskom okru", "Por ejemplo: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "CDlpFile::UpdateState", "G{0Dp", "R)Kz,y", "c=mN%", "hN6`w", "8K<#2", "rsel, OOBE springes over, PBR bliver opdateret eller oprettet. ", "dGCcuGX", "\\[b\"j", "Deleting path: [%s] -> Result: [0x%X]", "jV+k;z", "KfR| ", "|KRl9\\b", ":p(!|", "dia install", "S]`b*t ", "*c]^.^$", "#-Q`=[\"W", "Setup.exe installeert Windows of voert een Windows-upgrade uit. Met de volgende opdrachtregelargumenten kunt u het gedrag van de Windows-installatie aanpassen", "575\\5", "RegQueryInfoKeyW", ")WU. ", ",[ida", "U{jiw-", "; ;(;@;D;\\;l;|;", "a5_.BA|#,", "6A:\\[ ", "Ij>Cp3", "}p0b,", "Z#>8]", "dc3c8]3", "fini ", "lkeen, kun asennus on ep", ":|i+do", "n la clave de producto especificada. Este par", ">`xZYMU", "klad: setup.exe / auto upgrade / quiet", "e}ip[", "KdciF^j", " Microsoft Corporation. Todos los derechos reservados.", "\".2${h", "E-x@'Rz", "(eL*-q", " softv", "e}$~}", "rGj(W/n5", "DVf+7", "o Ft'", "o0VCM", ";>1az ", "Parametrit: 5 x 5 -merkkinen tuoteavain ", "lK(F)", "LL'Am", "i spu", "mFv8u", "Rozpocznij od pocz", "e\\yM?", "KP/{X", "Yvo8xN", ".~*N,", "czv\\g", "*+%aee", "n: especifica si la instalaci", "5GR='", "Df.hm", "001B1", "y =qB,=t{", "kOf]X", "dZg,P", "bs-Latn", "va vyhraden", "/P//Q*", "l\"OR:", "Parameters: Full; None ", "7]Am$", "Xg0n0", "['&`4", "8@8\\8z8", "Ss-E.", "k(05fpD", "u kroz iskustvo kori", "Nr|46h", "`fdJF", "kog a", "Bryter: / installfrom ", "17x.1p:", "pM#mF", "Y}sS@i", "r `>;", "=zE)zf", "n automatizadas. Para este conmutador tambi", "3ro]8", "n desde un directorio local, copia de nuevo todos los archivos de instalaci", "iatku", " <*l\"9", "|Sybgz", "BKE0^\";.9(", "t(sO\"", "b-avR", "\"zMj_", "#G}W|", "+EYN/", "6G;Do", "CBy68,", "eNB}W", "!r[/T", "`-1;I", "mk{o]", "~67K`{2", "eKP\"N", ":x3P9A", ";lf=Qn", "4N^Z./", "v[IpS", "&&JB2!m20!", "$EdMjM", "vflfw.", "A-<6B", "'bY?U", "ges syst", "ciu syst", "Zw", "\"41 !", "g`4TPbL", "$V`xS+", " : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "S-.VZB", "cHYT~", "ti a Windowst. A k", "s:++y&", "u2+0M", "CDlpTask::GetNextActionIndex", ":$;<;N;s;", "x}YeYAc", "vN7w{", "@W-V[", "i ^1%x", "6KD)R", "j#:.w", "FyQaT", "n. Aceptaci", "dwM<0", "*z\"k$", "qA2 &r~", "~XQxl", "?1L3H", "_z3pO:)|", "~SEX_6M", "!MGll", "cwz+z", "0L01YWeW0_04X", "z]<|+(=", "i pid.txt. ", "$5N]P", "(yHNU", "L9jX(", " reTYQ", "|6i\"~", "H71,'", "~@I:H", ": setup.exe / auto upgrade / showoobe full", "+SV6|A", "5vNn@", "8'rr,", "*f%+{", "zvom setuprollback.cmd ", ",r+aP", "x_=FI", "ranka rinks ir nusi", "xwG7l", "$b#[.", "rPvV5", "]@_~Y", "|{4V2", "g!X{-", "(y,&nz;", "PVq~x", "rberedelser g", " que lors des tests et dans les environnements de test. Il ne doit pas ", " niveau avec des supports de volume sous licence ou sur un support qui contient un pid.txt dans le dossier sources. ", "@^UpU", ")CWaa", "< <$<(<,<0<4<8<<<@dK", "Qh$/A", " inov", "xbNz|", "s. See k", "? ", "9x )TT", "viJ!ju]", "5xeIK", "la, czy w ramach instalacji b", "myI(c", "UFUPU", "V\"aX!", "};dod", "(KPK~~", "MeNB?'E=h", "ynnistym", "qhr4tF", "skb8W]q8w", "]{tTE", "?w$tQ", "Y\"sdT", "9.5h>", "69&`C", "~VC);E3", "K\"ks#k", "SgU*aC", "n)@Vn", "&dF0.", "9$9,949<9D9P9t9|9", " versiune de Windows nu se accept", "0wHM=", "3 install", "CPackageScenarioCtrl::CreateCommandLine", "il}wqF", "s~Oiu", "Ah3&`R", "aSi\"%s", "{{|||{xqokg_YS", "!#(zEdBa1", "{(FoN", "\"Iiq=K", "(BpAN", "ktan sonra ancak ilk kullan", "ceQIQ", "B~qjg", "$45y|n&", "]*|a&", "Palaikymas", "]{|TE", "|(0Z/", "a/_VGl}", "!>QJ:0b", "#~R9&7G", "v[/I~", "rtuseks on seatud Enable, siis installiprogramm kogub ja laadib ", "TlToi", ";o@~u", "=Pe.`", ": / Postrollback ", "%P?4\"", "> ?@?G?Q?c?", " finalizarea instal", "0CnKp/\\_", "U(q]4", "Uf;f$)(", "n no puede determinar el idioma de la interfaz de usuario", "bC6#~", "Il programma di installazione di Windows 10 non accetta gli argomenti della riga di comando. Al prompt dei comandi, esegui \"setup.exe /?\" nella directory radice del supporto di installazione.", "6{!eeS", "cBwf<", "tGVWj", ")>iLiG3B", "qwtOQ", "EtwEventEnabled", "G^LYI^L6", "jS{P6", "GBp_P", "DlpTask: Deserialize(): ActionId = [%s]", "3I3c3n3", "1FNKF", "$kxVD", "=8=B=l=", "'b$v9S", "9QRb))", "4OL`E", "7X8+9B9", "Sb0^n", "&z[:q", "JH}|9", "-oJ,_", "Sources\\Panther", "W[us5", "_N~8CT9", "lY$7<", "O~(4w*", " sa m", "ywQJ.k", "%?N*goV", "ncia de Primeira Execu", "Un amministratore desidera aggiornare i PC di vari reparti da Windows 7 Enterprise durante la notte. Non vuole visualizzare l'interfaccia utente del programma di installazione, ma desidera che gli utenti eseguano manualmente l'esperienza della Configurazione guidata. ", "5)LDH", "ny kimarad, ", "WideCharToMultiByte", "='^{<-\\", "*%mTm", "k nor", "1\"PYa", "$D$aH", "o, mas quer que os utilizadores finais percorram manualmente a Experi", "6w!!aY", "?}>1.", "M|1Mm", "k#{vL", "-c[at6", "ta vastu k", "`@XU{b&", "4^-%t", "SMhD@", "V0V\"F", "Por ejemplo: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp", "Jez+G", "2*0Dt", "kmesini istemiyor ancak son kullan", "`vX@3", "sI?QkKd", "O.b]GX!", "ONcLz", "j,loL", "5o0#\"", "/%[R(", "YZFZjM", "_~&h|", "sNt.39", " komand", "anja vstavi vse datoteke driver.inf, ki jih najde na navedeni lokaciji. Namestitveni program rekurzivno prei", "u|yRpD", ",H7\\D", "zh-CHS", "81--=}", "tzt. Die mindestens erforderliche Version ist Windows XP mit Service Pack 3.", "r \"setup.exe /?\" i kommandoprompten i rodmappen p", "zi*iV", ">tovM ", "(ZEo]6", "n`-wE", "YolmAl-P", "uvrA0", "ana verzija Windows XP sa servisnim paketom SP 3.", "ReportData failed: Error = [0x%X]", "Sources\\Rollback", "Switch: / quiet ", "*~;_W", "Ql/;IoM", "0n'+?5", "sik, ", "elite prilagoditi vedenje namestitve sistema Windows, lahko uporabite spodnje argumente ukazne vrstice.", "f^vMA", "3,3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "SSSSj", "UP+z/", " ZW@l", "n: la marca silenciosa suprimir", "041904B0", "jota dinamisk", "j1^WV", "AfVZt", "N*N(u7b{vU_MRgbL", "X\"}FL", "#;$;!+", "@4?RJum", "tky k %1!s!. Ur", "}{20d", "d[7r)", "e preuzima slede", "OI1uF9", "yV[d(d", "1>D>M>Y>`>w>", "Priprava %d%%", "iOipi", "t% 0d`,,@M", "[`yy?", "o do Windows 10 novamente.", "z_91y", "llningsgr", "oHbn8ZtX8", ",g)VJ", "{~E6r", "RnzqNq", "&?R\"^", "*EU16:", "cr'SV", "virkelig grensesnitt under installasjonen, inkludert tilbakerulling ", "9>#Od", " ]*}%", "@Arhitektura, ki ste jo izbrali, se ne ujema z va", "ZHCIE", "1gB8}", "`On!IF{", "oI?\\3", " Disable, ", ":0i5%", ".EkB#", "gKlbI", "F|60t", "HHs", "tres : Upgrade; DataOnly; Clean ", "o. Uma atualiza", "['Eb)", "Obs! Denne bryteren skal bare brukes i testing og testmilj", "slFb}", "Exempel: setup.exe / auto upgrade / migratealldrivers none", "Microsoft YaHei", "D:tOU", "anas darb", " verzia Windowsu, mus", "{)e698", "$1SWw", "__wgetmainargs", "4YJvX", "6GGrD", "wg=U++w", "tgci~B", "Z+**^", "e da pokrene iskustvo pri radu sa zastarelom instalacijom\"", "uje um", "%lPb/", "FMOWgoFQP", "yor %d%%", "h|f|h(", "?,&-OKj", "ivitamisel: ", "xel: / showoobe ", "s<_ee", "f0f0 RU", "lb_L,", "ranka bus automati", "&,%,8", "g*XCV", "hc1zrEp", ")r:q", "iF}M#", "bZ(E}", "n PBR ", "cnico", " Windowsin 64-bittinen versio, sinun on k", "o novamente de uma janela de Prompt de Comando", "8:.a<", "d06Vi", "S4/&%*E", "C!vTe", "TM4dX", "q:)?{", "Y]]U]]U", "Provera kompatibilnosti", "{$m}8)", "5_J-Uh}wn", "[jE7E-", "n_>OW", "TIDvQD", "", "Action : le programme d", "v6E50^", "9^s4e", "+ ]3&", "15*&Dy", "%7e\"Qh", "S[N8\\1", ";VU^(", "5A:/6W\"", "{@|Bq2r", "n: cuando se produzca un error, la instalaci", "oS^J>", "mH[MGv[M", "[o]l? X", "C^_nx", "._[>[", "V\\W=&", "iRi#$", "ivo u toku testiranja i u probnim okru", "mPNQ!{", "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x", "?sfzuV", "`hnCv Gre", "uz-Latn-UZ", "f6:pjZ", "<$4.`q", "%$!(`m", "/n=\\l", "anas k", "n(X6x", ".]B[R", "WAceE}", ":t zm", "FmS(/", "393_3", "kU>Q_", "`sl<5", "KRw=2", "i43bh", "ao)8S", "]opcWu", "7?*n).", "8?8I8^8g8q8", "O=>TC", "aR*=^%Jr", "HoZhc", "<4mOz=", "Tg7:;8", "V{+yb", "o procurar", "+fqzy", "+bn1m_/i{", "?$?d?~?", "Parametry: N / A ", "NRinS", "installation de Windows 10 est d", "marrez votre PC et essayez d", "m*11p", "&s}G(I", "/#NWo", "?4T t", "mQ w3", "Exemple : setup.exe / auto upgrade / installdrivers c: \\myUpgrade\\drivers", ";QQeudHI", "pJ(+6", "Parameter: Upgrade; DataOnly; Clean ", "4gh", " lokeja ja muita diagnostiikkatietoja testitietokoneista virheen tapahtuessa. Seuraava komento k", "YCvth2Q", "^Z]YU", "[(wT%", "#/rWp", "U.<4>N", "i3w ", "ea UNC ", "l=5@_", "040104B0", "CrFOA7<]b", "!A+{'", "Y5<+@Y", "iMNet", "cj*tB", "(6Wu,'", "%YJa:", "'[1wg<", "@jt>3[", "vne inform", "]~IH(", "\\}}*^", "CDlpRegistrar::CheckInitialized", "9vaw:", "w*,)w", " Microsoft Corporation. K", "18j_-j", "VQjB8", "'k11)", "lQ_6o", "L^='M^Y", "V81Q;", " o%e!", "%.{ncu", "eP@P|P", "74w&4", "FTL0b", "*':vL", ":D}XbeO", "\\;e\\;", "*C\\e]-", "yxgh|-9=", "pabeigt", "w(I'", "| ?)(", " na starost nasazen", "X7T@)", "Uyumluluk", "$L^S3", "8ikXM", "{f^Q~a", "\\0=qu{", "5{-RF8.y", "[G=lF", " migracji. Interfejs u", "\\U$31", "ve selected doesn", "sd|NG1", "&>Nlj", "0LQ*5", "V;Iy$_", "=(8F%", "d[cFj.$.", "Z|uwh", "suBZw", "Voorbereiden2Setup kan de bestaande Setup-ervaring niet starten\"Setup kan Install.exe niet starten", "IF0e>kK", " dans le r", "ko izku", "mtZBn", "a><*K", "D]d|.", "SPExecuteCleanup", ";&bvh", "7Kszh", "r fel uppst", "\\WJdJ", "Q39S^", "0~0Y0 ", "Kqo&s", "!:LOR/", ">*?K?Q?", "x/zGZ", "HN{K[h", "Azione: il programma di installazione inserir", "v8XZe", "!lY?ztVX0", "F AqT", "adovanou verzi k", "(=*Z(", "i beavatkoz", "ZqV2_n", "9%$JBY", "yACQP", "w]\"VA", "/_GaGv", "r\\>=1", "Zkp:(", "71N{cD", "th-TH", "E?RI6", "s+%NO", "CreateFontIndirectW", "F%%g,K", "iJI(T", "Ur)kJ", "8,;}WN", "`CfN#;%", "`7Rj#m", ".CRT$XCZ", "7}aA-;", "d41#=", "9K'/y", ">%?=?S?e?z?", "qVhQ{", "_~.f8", "s-kBI", "be-BY", "6SZD,", "t-fD*", "~3Ei'", " galima paleisti s", ":zqWH", ">ITM0T~", "ZCL\\k?", "t\"jdY", "Qh$0o", "cPq}R", "eno, bele", "YrH/9n)y", "Kx+%w~", "gt@H>", " je prilagojen skript, ki izvede opravila, ko namestitev ne uspe in se operacijski sistem v ra", "cutant Windows 7 Entreprise. Il ne veut pas que l", "mm)6V", "nd / PBRUpdate este setat la valoarea Disable, instalarea nu va actualiza ", "}7X!i", "llningar f", "GGlHY>", "I%>*t", "QOf\"H", " a ocorrer a partir de uma localiza", "Nr:*Y)", "1hKl]}cdyJ", "~gbi~", "est pas prise en charge. La version minimale requise est Windows XP avec le Service Pack", "Failed to convert NT path %s to DOS path. Error: 0x%08X", ",t1a'", "jK4a2", "A[En+", "2-2R2w2", "vca potrebuje cez noc inovova", "0h49pt", "kc=\\J", "5%535T5n5{5", "d>9 6", "%bI&U", "X-!I`!", ".CRT$XIAA", "o. Liberte algum espa", "0w4Nu", "3.D${", "Teine v", "dM/WtI", "!,[)'", "v~oIB", "((Bx,R ", "=rgRV,", "c6rr;", "j\\Zf;Ty", "taluje alebo inovuje Windows. Tieto argumenty pr", "T+Owa", "n\"+Q:", "nCzz:", "0@y$@0", "~4LZl", "6:}>w", " u#bd", "'OE\\D>", "h%|gO+q", " #{w6,", "2x\"_2+", "rTkYS=", "AWDz\\", "`r}b^", "a atjaunin", "EULA ", "\"oyZy@U", "zati kapcsolattal a megadott f", "5K65\\", "j!1!LT", "~ :X-P", "mbO*Z~=", "1N=){", "#'_j6", "a sa vy", ")c/|V", "2<|ij_3X", "l+p]~", "g<\\[GA7", "/J[*J<", " ~SkfB", "Exemplo : setup.exe / auto upgrade / noreboot", "yfO>+", "sxTe{", "=A=G=z=", "bd#.@", "Setup.exe instalira ili nadogra", "|^Y:<", "3bInz", "]}tSU", "|W\"Nl", "VdNr6", "C9m;^;", "18)@2", "%{?z", "+dQ[9", "Segoe UI Light", "hqN}NN", "=DgXW", "tos komandrindas argumentus var izmantot, lai modific", "EAz^+", "7PIT ]", "Wcq+KqD", "_3y%|", "Wyy=x", "Compatibilidad", "dzis: / PBRUpdate ", "Z$~S}i", "N$1,a9", "uvbF=", "0V1f1l1", "RF|Hi", "kuGn`", "`wUx/", "c_bNUM", "P4nRC", "iK+eK ", "+o`R++", "cia sa vykon", "O(W,W", "L:RTb", "hGVh5", "wq5gwZ", "4EPH/", "5bHSsB7", ",d9Gh", "7#{^6", "qw`a4?;", "816;~FVn", "iR6cqK", "V,(B\"(B", "Parameetrid: faili setupcomplete.cmd kohalik failitee v", "6w(.T;", "ntF`A", "5GE15", "CDlpFile::Serialize", "si folyamatot3A telep", "aX$zH$", "je}t3", "!q/Um", ".1Wyst", "Ready to install Windows 10?", "iendamine toimub hulgilitsentsiga kandjalt v", "PnkZn", "R8Nf5", "t skriptu setuprollback.cmd gad", "Stikalo: / Postoobe \\setupcomplete.cmd ", "},^K+", "odp$18N", "ib(6Gc", "9@ms)", "S5umm", ";*uvx", "rer installationsprogrammet den telemetri, der er genereret af installationen. Men n", "E?Qm{^", "Por ejemplo: setup.exe / auto upgrade", "pf#8:", "+B;,R+", "9<(#p", "K]o/x{", "B%::D", "~-&CK0nJ", "tBk!J", "ivcVL3@", "DlMG/", " OOBE) darb", "y5'/~", "FIXED", "\\w1]X", "[bgMuY", "(S?e{m", "a komandna linija upu", "R.H.L", "1BIpp", "!zrS/", "+c-4/", "?&:n$", "Beispiel: setup.exe / auto upgrade / quiet", "2Valitsemasi arkkitehtuuri ei vastaa tietokonettasi", "G0PE=", "g;\"}+", "O/T_o]", "*d I S", "yC#Bbd", "c~=&+", "es-US", "8DRt{", "/$C:8", "{u;yu7~|", "JWL}g2", "T_VMOu", "]n2Aw", "YCZ~_", "g till specific.wim ", "R{%Ohfc(", "ghCU\"", "t%^9`", "apKpp", "ajVbH61", "ECo/h", "sdZCQ,", "e{<3;", "rw-RW", "2CNC/Y", "Xf'U^c", "2}vqm", "oDG05J", "=3|>]x", "9x&ZV;V`x", "ojXh4", ";1X.k", ",C[Y%K", "ba: Ja / Telemetry ir iestat", " desteklenmiyor. Gereken en d", "ncia da Instala", "sqnRb", "x8!D$", "Ud\\sorn", "L'installation de Windows ne peut pas d", "cxV]x", "&Prekli", "xB]m2", ";4kxr", "y=[Ic", "hk~g(M", ", by mohl cht", "fqYbs", "k}hGkO", "@J<>[", "#>;'/", "848J8U8", ".?AVCBitmapDialog@UX@Common@ConX@@", "C(qu(Y", "rodowiska wycofywania) ", "WdDVg", "Qzye/", "_G`SK", "M|'MK^", "uje, ", "hoz legal", "250706205017Z0~1", " : setup.exe / auto upgrade / noreboot", ":[_Nu", "'b_!17~j", ">x6DJ", ">9,E-", "SbdIIp1", "Z UeKUYR", "YU\"Ys", "L.#N@/", " gerekir.Alternatif olarak, / showoobe Hi", "Tq{E\\", "VersionMatch: Verifying that the target binary at [%s] exists...", "=2=1QFA", "Akcia: Automatick", "se-NO", ".G=#/mS", "z0X=]0", "2r(b1", "j2fC|", "Z~.jZ", "S\"&8.+O", "D+)+^", "huw%iHC7", "d5?HQMz", "vs2Fel n", ":t)`A", "\\94!", "ranka perkels visus tvarkykl", "kseltmek istiyor.Kurulum kullan", "Cancel&ar", "uriranja). ", "O}S}K", "Xf\\4j", "Installation de Windows 10;L", "0#*;f", "Xhr,AHS", "5|/>A>R>Y>_>d>p>", "tfO%_", ">Ico3", "a3GyI", " felirat", "lineen p", "Den arkitektur, du har valgt, stemmer ikke overens med din pc. Hvis f.eks. din pc k", "CDlpManager::GetDwordProperty", "VhH9A", "-?p6*", "vetkez", "rSo`Ssqf", "cpsC7fB", "\"Windows 10 y", "Er is ten minste 350 MB opslagruimte nodig om de installatie uit te voeren. Maak ruimte vrij en probeer het vervolgens opnieuw.bAls u deze versie van Windows 10 installeert, kunt u %1!s! niet meer terugzetten. Wilt u doorgaan?", "]Xh0#", "%#Ue`u^h>zy", "ier specificat", "l(c3R", "Y{t}~t=", "7=8U8k8v8", "j^HYm", "[0xD7", "n kontekstissa, joten sill", "$4V\"Zh;", "zMhep", "iw\"4cD", "ejs<2", "rnyezet", "B\"|B&QWc", "RegValueEnumAction::Enumerate: Error enumerating contents of key: %s\\%s (error %d)", "yP CI", "SRS --", "CreateProcessAsUserW", "Un5WmO", "S?AEHli", "LsQz'ez)", "a>_?A-", "2f@g>", "^06*7", "CDlpFile::GetTargetFullPath", "r / migratealldrivers er satt til All, pr", "A iniciar os preparativosHA Configura", "eu&v2\\", "OriginalFilename", "\"g98z", "~>=U[", "KJ]WI;", "B!G!OS", "ndarna manuellt ska g", "j8&/p", "ygrcW", "2Sj{Y,}i\"t", "NjUU,`", "CDlpManager::DeleteDwordProperty", "iT;,#", "ndaren endast beh", "r installationsprogrammet slutf", "+\\stx~\\", "rd: N", "KDc4!", "G6Po", "vne, ak je prep", "$t", "CE!A= **zN", "0lf:k8", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "rgmisel taask", "c,6V`", "Q(:;Q", "8N*rZ :z", "8kbZ#", "6%brL", "_Q$R}", "u/t,(9^", "bSEPo", "4C'GS", "3`kz'", "4E{h/", "9yD#OYE", "lCnH>", "h{]2%", "Microsoft Time-Stamp PCA 20100", "HaI;}", "emiet v", "uRx~ ", "8&9-9", "e0SZd", "&eE}$", "ad: setup.exe / auto upgrade / migratealldrivers none", "rvQ.DF", "jy7b/", "@@@ @@@", "ii de diagnostic de la PC-uri de test, ", "|6^W!=", "mtoqn", "ho programu.6Instala", "a}h!{b'$", "Action : injecte le fichier setupcomplete.cmd ", "CBdx~", "irn|J", " name=\"cabinet.dll\"", "8['{<", "tl6Uk", "Parametrai : Upgrade; DataOnly; Clean ", "p520n", "n\"t$4", "',/*o\"N8", "3XBs3i", "Z{m Pd", "'lT'%", "None, worden er geen stuurprogramma", "~G'Lf", "$WT*$I", "(q1/L", "=$=0=t=x=", "ho41a", "V:}]g", "!nugv", "YH)TmUT", "a de instalare a suportului media ", "By!Ae\"", "An3cw", "nTBV6", "s!jtwM", "|uF\"1", " a sk", "sKE@$ ", "d'X1-", "t opr", ";b b/", "ivitada3Installiprogramm ei saa faili Install.exe k", "Dm`ijo", "l-^}]K", "h2b<,", "0yr)jg0", "MJKHM", "\"&Ec@", "]~D##", "ba Full, lietot", "Na primer: setup.exe / auto upgrade / noreboot", "fq%g:", ")MxN(", "$*1LT[", "XJy22k", ",a\\!f", "Xb;\\T", "nssnitt, inklusive ", ",?2av", "1/2e2}2", "&{0F)", "DJd2L", "?30*l", " Windows>Namestitveni program ne prepozna jezika uporabni", ";-+W.y", "|Qf}L!", "PO@g1", "*H2CA?", "C}!TSy", "g)>qCb", ")V>%G", "^hx[^b", "jr)%-", "Jt\"q/", "l%?2:", "Pj?/u", "Voorbeeld: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "rsta anv", ":[#z\"{{iSN", ">ky:R", "I.a[f", "_~1o7", "z!;S'r", "Zq_D8-", "|GCG+", "r#i07", "M.`]M", "UR:$^~", "o corresponde a seu computador", "Administrator ", "K}-R<", "CopyRect", "fXh", "ste znova spusti", "s65SZ", "e zleci", ",(X72", "%'`I?", ",qHkS", "qU?Ed", "wu4!0", "*o[W1EWA", "\\lX1~", "rankai nepavyksta nustatyti UI kalbos", "a, aceptaci", "SetupDUUpdateFiles: Source directory [%s] does not exist.", "pravu spr", "; ;&;1;M;S;n;t;", "@?A|X", "O'JnT", "K5=l&", "g_t76", "3a5Zf.", "P5Kdp", "S@zs'|", "VKJ7KJ+1", "8' I{", "I>be3", "U;X\\@", "/p\"fBw:", "rsEUy", "Roy+J", ">Die ausgew", ">8L8^", "2OZ(g", "9;9A9", "'YjoO", "j'Ft{", "|<=ySK", "\"yC8B", "\\v$^A ", "Xf$P6l", "ajte ponovo da pokrenete alatku i vodite ra", ";g=4-", "1k1fE", "interface utilisateur du programme d", "> ><>^>z>", "aO!KDk", "Comutator: / showoobe ", "gHrQu", "U9OT5", "I(", "a8D;F", "CY%=Q&'", ">X8bm", ">Q?Hm", "zK7i=uj", "yv)?\"", "'9c f", "8\"\"~X", "fubWZ", "", "Exemplu: setup.exe / auto upgrade / showoobe full", "prs5n", "T2\"\"J", "e|.u]Y", "L7#3koS", "q]`_Y", "*D:)h-", "0FQ-0P", "iereWim\\wim_particularizat.wim", "7 (\\#", "7oH@{V", "unar ponovo pokrene, do", "PPWSW", ",CC~,", "8=;hp", "*k\\5>", "site ", "e4SKX1nj%4C+", " konumundan ger", "ld`$Xdl<", " povolenie a sie", "UIB;M%", "uhy=,#", "7SfU_", "(R5rF", "r#}(?)(W", "~~v~v", "G(!O&", "\"va0:", "gHKLm?", "Ta=yf", "Yns&6", "3qSez", "Windows 7 Enterprise", "Configurar", "D~r?3", "<1Rt ~", "5(5<5S5f5v5", "admin", "ku-Arab", ">d$:`", "Toiminto: virheen yhteydess", "1pL6v", "t. Ha a / PBRUpdate ", "*O]baq", "+PupW", "rKpKF", "n: cuando / PBRUpdate se establece en Enable, la instalaci", "a>9\"r", "|d&_C", "kSt2c", "byFBy`#NK(", " 4bda(", "PKeK$E", "9urn#", "Parameter: / PBRUpdate ", "vne m", "Ejemplo: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "h7}FY(", "-dcyEx", "ho umiestnenia. Setupcomplete.cmd je prisp", "LK;3O", ">zn[o", "%`DLy'", " ist ein benutzerdefiniertes Skript, mit dem Tasks nach Abschluss der Installation aber vor der ersten Benutzeranmeldung ausgef", "3>eQXDPk", "GN^M/", "AJM{AN", "eXIEX0IF", "_De}n", "!5Wy\\=w", "V[q=C.", "^YgYT", "/]-nY\\oc", "'2pvLK", "U@nkcE\\t", "fqe,3", "WJRbD", "?G\"]q", "'_$sf", "tCr--", " Z&&d", "\\fZ63", "-D&]C7(Opg", "0!kn0", "WShpw@", "6?v}n", "6&y~s'(", "\\`|-.0=V3`~6", "aN?{ Q", "fO7Anh", "x=bwsP,~Xu/", "}Xe/4", "r@j)`", "\\8k*$", "B %BT", "!gl40", "#j]m)%", "base\\ntsetup\\setupplatform\\lib\\static\\utilities.cpp", "$C5Lx", "5fRiH", "lkomstprogrammet. Om None anv", "F*t8H", "f',{,e", "?sX^^", "lU#,~", "rg]dE", " disco rigido", ".::;?0_", "MVeuillez relancer l", "&)7ue!", "^~~::255", "tted Windows Update.", "V>&[|k", "o da Instala", "Language Pack Location", "V)3(%dt:k]d", ":W;3_", " ", "[\"[Mln", "+<`+T", "2/sG~F", "G-J{6", " / Telemetry nastaven", "|$ab@1", "l=]BO", "XD@QZn", "anas programma neveiks autom", "#i8[f", ".,r'B", "t!14=", "zati el", "d Product Key. Tento parameter nie je potrebn", "G#1E-", "S#_inr", "A Configura", "0q^vi", "@/;_$z", "mPrUy", "Sm@x ", "QAd??M+", "&8M=q", "zB}$W` ", "9c:j:", "unalnik, nato pa znova za", "\\}g`]", "+!]Ap1_", "UVHixv", "|/$G&", "#VK0$", "=*bnI", "!Hw2w*", "Gkj`Q", "0$0H0", "Ouy~,", "/G]O)", "anas programma nemigr", "iT!V8'", "YXvhU", "ytyneet driver.inf-tiedostot asennusprosessin aikana. Asennusohjelma hakee rekursiivisesti m", "z7[+-", "Hb&#q", "cqA0|8", "xY^V}", "zfxY!", "5#85T", "Error [0x%X] deleting file: [%s]", "ciowe problemy z po", "a)RA$", "[_?^o", "HKxvl", "N(};/?", "}~ zP", "/Media %s", "I1ai!NQ", "4<8r;", "#r>;|", "cY*_u", "Op`0", "2yXI5", "O\"ifSET$5", "GetTickCount64", "B7VV6", "`A6LT", "'*C=sh", "C#>.k", "wjO [%s]...", "p*EX}", "w>Y{~P3:", "bb-B)", ":/;q;x;", "E{#Co", "j~%KHh", "e/YKt", "+h4q]", "4P3Sd", "8Go)+#", "$\"V4&", "#mvl5", "'}Mh(", "r en instans av installationsprogrammet redan k", "V(eV5[", " copier aux emplacements, qui n", "2lr=4ix", "w_#jh,", "=D!TzV", "2[~TM", "f1C<&^", "Setup.exe installerar eller uppgraderar Windows. F", "Ng,]EU-", "4F>~2-", "FT#}V", "Si|yv|", "g1|d1", "r 64-bitarsversionen av Windows. F", "p&p-Y;*", "KoT=1\"", "gFM9a", "y7 x\\", "gh< h", "^6)WRSb", " znova za", "Jc=Zl", "WRJ^-S", "t-f]DIe{", "0op_'", "E|r%o", "+nedd<", "nD'5q", "t3F;u", "p.R;R", "y# i36gad'c", "kk|$U", "@", "TF\"80", "'vI.p", "7<9{6", "0;,Z%", "gp'uV", ",_|s$", ">D/3t", " aufzurufen: ", "i\\GLi", "%&AVK", "Wm9S*B", "Snart klar8Det g", "}+m^u", "wMyzv", "3w|uU", "C0F?m", "%g,P>", "afKI0", "rKZY*", "\\'GuU", "VON]+", "G+Zn9", "z*'Gv", "rg for, at du har valgt den rigtige arkitektur.!Der opstod et problem under startaDer opstod et problem under start. Luk v", "W=!7*vI", "tre de ligne de commande. Dans l", "o recolhe e carrega todos os dados de telemetria gerados pela instala", "Error registering working directory for disk cleanup, Error = 0x%X", "BoxDeletePath: Error deleting path [%s]! Error = 0x%X", "OjpGt", "6?XYD", "VOR8Y", "?[kyL", "rbereder %d %%", "AllGg", "g%(aW", "e1q8+&A'N", "_X8q;%,", "rO1++", "*#Aa]", ")\\-=z", ":6:O:", "XV3Ai", "h`8ogq", "TR6GrOg", ":c%wT", "EOf=*?1", "^YWRa_", "zdrg5;", "Es@ja", "=}|SU", "ri a kezd", "_^[Y]", "+k&)=", "2p[1g", "(''%`", "U1d~+v", "20u:;=", "CMediaScenarioCtrl::ShouldPreserveWorkingDir", "H ;N t", "M}gI~7", "#9s7Na", " T+[M", " Windows 10;", "GwyZ9", "0$0I0r0", "dCaP9", "9HUmi", "\\Dr:VA", "<4ol", "uh,kUAV", "bw5FM", "Pomocn", "3_.8_v", "}L7|Skwg", "pSA8a", "F ;C t2", "Zao$U", "h1i)L", "l`d?W", "qe,Q:D", "installation. En revanche, lorsque / migratealldrivers est d", "^KVe0", "ZFzgk", " ", "fA.#>C,]`_", "sihU~", "{u0qs", "j~F3e7", "Tdj%%", "_DLT\\", "}Yoeu", "o^p${", "re i gang. G", "ste anv", "F\\W@!h", "!ds)l", ":2dD>v", "Elp],", "OuWv$dr*", "JS`n}", "m Windows XP s bal", "d;5,-", "_lock", "&I'%F", "54R?}", "[EgBt", " o cargar", "wVj5y", "^*aK;", "LPs*i", "Storage Reserve Manager Unavailable: [0x%X]", " soubor setupcomplete.cmd ze zadan", " se b", "Microsoft Code Signing PCA 2010", "&O4QP", "'W` ", "n$\\Y3", "se). ", "o\"7D8", "<^=/]c", "'9\"4J", "A'i>@", "K?Vz>", "tre> ", "=O*@I{", "#rNLL0", "`Drt:", "zSuRL", "+fRWl", "qena\\~", "B&e3R6!e", "T8w9x", "$}'s};%}_", "q?#S4", ".%w2y", "B>Fk7", "N~~$M", "?TTa&:C", "d Product Key 5x5 ", " Windowsin versio ei ole tuettu. V", "PGJkP", "|b_y!C;", "07A)f", "B_qe02!u", "r(Jqm", "WQ-zMht", "W8bJ8b", "A{UF$v", "o9m*e", "yn_eO", "i]:p>", " nytt fra begynnelsen", "e da se koristi za uskla", "7HO/1", ":a/\\lKn", " em execu", "L ", "ranka nebandys perkelti joki", "j@x/Ge", "@)K#!", "\\p{+`", ",[n7/", " Y\"j-", ",EH/Ww", "Ua/$]H ", "nXlUCOQ7", "irmeyecek. ", "tres : All; None", ";[Od5", "ivitatakse samasuguste ", "=@=hp", ".aPKo.", "DY\"eI", "Z`DP]", "W6aY^", " ", "uRJbR", " a Windows XP Service Pack 3 szervizcsomaggal.zHaszn", "S_y,J", " Windows 10?o", "4:::e}", "Xf9ABt", "+Q^D?", "etky nastavenia pou", "rVd:V", "XuR]Rw", "AJLf}", "(=8~D~", "dzi lietojiet tikai test", "kseltir. Windows y", "ivitys Windows vNext -k", "qP/I%b4O)1`8", "Ikw6S5", "h=*;~@_", "jWqjW", "hw4eQ;Y", "|p]J<\\", "=rw`U:", "2;UahKE", "cbM{hW", "DW;q2", "6TQl'", "Z=zvN~\\", "jsiPR", "nbEK_|", "An admin wants to upgrade the departments PCs from Windows 7 Enterprise overnight.She does not want the setup user interface to appear, but she does want the end users to manually go through the Out of box experience(known as OOBE) experience.The following command line can be used to orchestrate the full upgrade to Windows vNext, requiring user input only once the machine reaches OOBE : ", "mp%D%", "m$P&rc", "_wtoi", "P%RdWM4", "6[C@o", "D(Xv/", "Gxb3dI", "]!0\"^x", "Rw>I|", "d6DJ2", ".+3j1", "q=*SL", "C^OO-v:", "FPI2V^", "L#ud:", "b-fxia>|", " : / noreboot ", "!;9ZMw", "o~3cZ", "EIWbT", "XjJUV", "YPPPh", "5S]*:<", ": / installfrom ", "CDlpManager::GetStringPropertyByIndex", "4W{il6I", "iAA(]o\\", "}iX_j`", "ni dostop do navedene poti. Ta ukaz se izvede v kontekstu sistema, zato morda nima dovoljenj za kopiranje na lokacije, ki zahtevajo dovoljenja uporabnika. ", "O_(Az;{O", ">rmpBb", "tirilmi", "s van folyamatban. Tov", "~P,C2", " Windows 10,", " PBR ", "swho|LmU", "?+>aM\"", "Global\\Microsoft.Windows.Setup.Box", "ActionableCompat", "Or7&Af", " ", "LuZpy", "X h004MH", "Sh`t@", "'/#WB/^", "{$R(#Q", "\\XN,I", "Teeme m", "ProcessId", ":~7[M", "'L >y^", "9R*BOY", "iFDkZp", "(4[]P", ">hx\\M", "cia s v", "T\\{e2)", ")UaUW", "IP:-Q", "0 0,080D0P0\\0h0t0", "4- ';", "MtvvYw", "-Leba", "ySi(3", "5%|F)", "o de utilizador. ", "B%:;Y", "L`T|g", "> ", "8?}j(}", ";8dDp\\7", "c9B}(J", "CompareStringW", "V_yA4p7W", "s que l", "kleme ba", "n!^0E", "na pot do datoteke specific.wim ", "B%8eV", "^eK%0", "){2Kg", "J.]qvG", "Sh`}@", "mq7Rd", "]2eIdL", "OD9F2*5", "tq&?{", "CSetupLangIniLoader::Initialize: Cannot save current directory", "M]`\\q1", "m=SK#;9", "Zha@oa", "7Oz6i", "A;[mQ", "tt. F", "nya fut. Lehet, hogy funkci", "qdZ", "&E;Kt", ":]wm!z1", "$m'GR", "OOBE). La siguiente l", "NvocO", ",87m+", "ivityslokit", "IGpZ N&", "E0_o!n+", "Cf9Y*", "GxeP~4", "N{<4u", "}K!2}", "Primjer : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "rs: setup.exe / auto upgrade / postrollback \\Mans_koplietojums\\skripts\\setuprollback.cmd", " invoce scriptul setuprollback.cmd dup", " ", "zk>TI", "Kld&O", "YCnMMD", " procesului de instalare cheia de produs specific", "}SX=v", "u>{Xf", "/]f9`9C", "UYPBS", "IsDebuggerPresent", "Sklopka : / installdrivers ", "ukg5C", "ta0#f", "6id-$e", "HO@\"f", "t]iUY", "72zp6+", "'Wi}A", "g3(Z>K", "Setup.exe ", "^WhIR/", "JGb0.", ">1>Y>", "cuter ", "YVz1-", "Ao`jv", " spune procesului de instalare s", "`#]@JO", "CC\" +", "Ru1lR", "", " parametr None, po", "]){N=<)fI", "&(%QV", "Yt{(5F", "b<7^*Y", "[YxD.<", "v4m'd)", "o!U;R3", "/ showoobe ", "`rG)L", "B~\\f!", "CLP}5", "v~GkU", ". Uzst", "iiG?:", "!\"n\\C", "@qGIi", ":P=Y=W", "K Jdk", "/B/zs", ".UJei ", "sGang", "Error registering ESD image download directory for disk cleanup, Error = 0x%X", "^%!&LP-r", "bh0W0f0", "bd:uv", "fico. Este comando ", "GetVersionExA", "j[Y}To/", "!ue0=", "'&AGp#", "8 N$^", "+8`^r", "lg/e1", "6L`o5", "040C04B0", "j\\UIWZ", "utilisateur final doit ex", "u;2Y>", "y.^Jv", "S_J@R", "^rLCh", "#m(.c", "X\\I0Oq", "eZ=S*", "8-Q=b", ")cy\\(", "[\\Oic+)", "Installera", "W`%>K<8", "V4DBc", "ch>W?", "eG*ds", "jszaka alatt friss", ".?AV?$CZeroInit@VCSetupDialogSplash@@$00@@", "tietoja on Asetukset-sovelluksen Windows Update -osiossa.", "\\;Vc|bU", "czN4t", "Fr{sc", "$AHBS", "v'7v3", "ztWwuU[", "ZOBxI", "/5Ye6", "Vz #;", "RL\"^f", "lN;1^?m", "n+MV2t", "D^C_CB", "r Full anv", "s telep", "ZcU>M", " injic", "L{L7?", ": / installfrom ", "+4p6{", "Z<]0O", "/ PBRUpdate", ";TaxA", "CompareFileVersions: Couldn't get fixed file info of [%s] and/or [%s]. GLE = %u", "2VQp-h1", "B-'sz1", "7^0SQ", "^lB?>v", "@@@@@@@@@@@@@@@@@@", "jv?IVN", "(>'VS\"m", "d%YOn", "tartuje.)Nepodarilo sa n", "1dQdw", "3r4hO^", ").qXI6", "`ysss", "wz>jP>j", "P7l-@f8", "~K`;/", "E>56\"~?", "a%$9_", "~\\x{Z8", "* X4_)", "4Y=rovnT", "tt;ok}}M", "YC@Av8H", "F_}^6X':t", ">Hh3a>", "g", "ksszW", "D\"M0(", "gyN='Z", "N:k!Z", "GwuuUw", "Wfqc6", "9H-5t&", "Sistema operativo Microsoft", "lRiJCV", "Exemplo: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "Vsb2_", "mica (pesquisar, baixar e instalar atualiza", ")}E9ud", "\">$h}", "~;-dq", " habilitada, recopilaci", "'r3PZd", " Microsoft Corporation ", "tOjPW", "]Ko+Gv", "50I0g0m0", "Mdlx_", "Action : si / PBRUpdate est d", "'trT(", ", le programme d", "0_0h0H0p0", "n95A)", ":w:?W4", "; =lE", "q7Khp", "TuHk0u", "_f+m(.", "xK\\}F", ":g7;\"", "eu4{,", "ZZZjZ(", "tW&OU", "vat argumenty p", "LX.9XLjV", "81]#N", "tTelep", "J~~r-x", " impostata su None, la Configurazione guidata non viene eseguita e per i componenti vengono usate le impostazioni predefinite. ", "sa ut", "rijs ", "EjK%R", "nzYk](", "e0T#@", "4~*bob", "L~~TDS", "N|l-", "(J+(\\5", "altini", ",p&b^3", "OID+~", "Windowsi installiprogramm ei saa k", "~Hjk2", "\"O?v-", "o8A+G", "`K lQy", "dG6N;s", "3v'\"JC", ">J?`?k?", ",(PG.}=", "jZ'b4", " nastaven", "EnumeratePathEx: Failed search path is >= MAX_PATH!", ">3>P>V>", "=DnP:a", "|F>'_", "RL.dl", "iO3M2", "ndra Windows-installationens beteende", "$/Pla%", "pv?a_", "Telep", "|xT,i", "jG{t} ;y", "s@59r", "PPxf8", "Yja?MP", "*;!~~6", "~(9~0t", "l`sV0", "/-%d++[x", "kleme medyan", "%*pFT", "er la partition PBR. ", "D9Ln)", "41w`=bngZo", "~2%Mu", "n predeterminada. ", "si}R,", "/u,", "BoxDeletePath: No last path available.", ":1K}<", "|AaSm", "f^d*!k ", "P1heT", "3(:XW", "=8gT3gT", "bp&/3", "uv%??", "YLqF*", "P9Hc;", ":):B:`:m:", "Y^[tL9", "V4?^8", "s volver a %1!s!. ", "\\qKrw", "coleta de telemetria e aceita", "+ugP~", "i)F'\"", "O{UT%{Lr", "anai un testa vid", "!~6ZV/", "^\\=='", "OUOw4", "UlJb.r", "q+SzTG", "5r9Kj", "U,Yr=", "nD;IY-.n", " przej", "esGjf", "%wLtC", "96?vql", "msvcrt.dll", "[Pgtl", "+e&S2", ";xC7.&LU", ")g`|9.", " a komponenty sa nastavia na predvolen", ">t\"A{", "6E7_7j7", "\"j|WT", "\\&>qhX", "0F0k0Y0", "}YqG ", "fif>qF", "%{icB", "Eksempel: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "jdeFS", "I|&gZzd", "e'bK3D", "zj_<*", "]B\\;h", "Handling: quiet-flagget skjuler alt brukerp", "cemu opera", "aOEU~", "g9LEin", "Os+PN", "DO_$u+'u:m6", ">\"Y?43", "gh1~o", "l@B:4(", "TDF=5_]^", "R!=(J$q`", "til fazer uma atualiza", "4P4h4", "0Lfe.", "]~: 0", "$31\\-xn", "X+Ux/", "(Z2 \"", ":iDHnW", "glicherweise wird gerade ein Funktionsupdate ausgef", "_wQ;e", "-t#J6", "ny kihagy", "]`,>A#", "s\"]wAi", "888b8", "]J)y8", "Ew`L#", "u^r5", ",s&hK", "^$gu8", "6Z;u\"", "!9d^2/", "|Kgj[:", "latuq`[Hj", ";~^RTT", "Vh", "(q5\\}", "2&2-2j2q2", "kV.xE^", "Up+gA", "b3r&J&", "rtuseks on seatud Full, peab l", ": / quiet ", "J< YS", "vB2FR", "F%@gm", "q\\qtA", "sQp(/Bp8", "~46__", "<\\}24", "tte / migratealldrivers v", "]q`m#", "b>./e", "/R{=?=_kzkr", "DsAS6)", "i8.vy\\", "Bryter: / Telemetry ", ">fT", "iQ?|b", "]zzC3", "yASK%", "2ttQdk", "cia alebo vytvorenie vynulovania stla", "eAq/q", "@WSq{6", "/U7`#", "%jR8[m", "'1Wt=H", "`rw^'NyP", "qV~qQ", "X^|Oz3", "O9cPL", ")J_Pgh", "ZH(yks", "VQ~i`", "b7{_\\rD", "szlelt", "ivituda, kuna osa installifaile on puudu. Kui olete varem k", "ybv5Z", "xm (O(M", "!FKUi", "R_,^^", "Task error [0x%X] is being set while task is not in Error state.", ",}>w}", "fm;U;", ".AFDB", "4T6`$", "nDp7K", "bOhciK", "Lataa", "k0_%1#7B", "cifique ", "_peo0", "`QU?CN", "marre pas automatiquement. L", "9l*/^", "=ycQ%", "~n?(c)", "&Siguiente", ";p+!n", "qV3)x", "LgqZu", ">*k3W", "oe#.1", "{zYip", "&Back", "F'}9fi,", "MNev7{", "QcjBM", "GetFileInformationByHandle", " Disable ", "Bryter: / showoobe ", "y3lA7+", "hx*<7", "Og7c#", "z-eR{", "}LWw}", "SIvvd{", "d4X2K", "HMks$", "7-osJ", "dzi tiek pie", " implicit interfa", "ytkownika", "Q.9e>", " se p", "Aktion: Das quiet-Kennzeichen unterdr", "$9p.]8 8", "0A$$@0", "1R2d2", "I8HE;", "111WWWddd", "+T}\"(", ">NeAnV@", "TQ^_+", "pu?8w", " lxm6", "Detected existing box mutex... exiting.", "Kc{,0", "~Lf6X1)", "vd.9N", "vV2H9z", "Commutateur : / Telemetry ", "aqrj L", "l futtassa a setup.exe /? parancsot a telep", "n con la opci", "f/F=m", "FU_i?", "ll\\", "nario : niveau d", ";{G\\V+8", "c}Oi;", "}0tmM", ">?zi_+", "@i&6O", "9DD2\"", "QCk(*3", "EV|1p", "}", "98u,C", "L_k_r9k", "J-{62c", "utilisateur. ", "WVShx%A", ":NtT~", "HiZJk+", "*:.vy&", "4[^)?", "EtwEventRegister", "Sh0u@", "s!jBK", "QNHQtB", "w.MoE", ">4mX>", "o+A[b", "e migirati sve upravlja", "ktqid", "AC#'ZS`", "C#\\YR", "Zm\".or-", "INDIAN", "=x2=#", ";u>zD", "%K#+-", "&rU*6[", "Action : si / showoobe est d", "jMjc<", "'l #-", "ZagAc", "MkO*e.", "ana). ", "i|ECq", "y*!xog", ".?AVCSyncObject@@", " na in", "tz]J/", "Se^[1", "es-ES_tradnl", "_G\"eY}", "ine potisnut ", "XI9-m)", "?]zBO", "k+j?x", "o para a instala", ",9p\";", "$?A~=1", "stup k zadanej ceste k s", "\"@&=/", "t{NUO7i0", "?Z]s/", "yI8Nn5", "j\"i0\\", "wC_kJM", "Ghf+L4S", "B|Jk\\s", ":M3k.O", "f@nc\\", "$&6cJ", "[([ZoK", "[1B<.FP", "unar radi pod 64-bitnom verzijom operativnog sistema Windows, potrebno je da koristite 64-bitnu verziju alatke. Poku", "k(`}5m", "*wvE:", "indicateur quiet supprime l", " Q^ J", "U4ll9", ":k v-", "u,,`hfff3KW", "9S0vmR", "1\\[L5Z(.", "Fhd=W", "ni iz po", " : / PBRUpdate ", "upU@5", "Enable, la instalaci", "BukFS", "\"*|[XE", "on appropri", "ciu spustil. ", "zwVDen", "%1rb@", "{gjZT|", "h{KMvA", "DEEA||Tr", "1i*YdPl0", "404<4\\4h4", " completar", "2#0\"9", "<#<*X>c>", "EDCz!", "CH0h^", "\\/41-", "v[WF}", "q->4>&", "A}Dv|72", "6K5+ uEL", ";uQ9{", "*******SetupHost Logging Begin*******", "ZeS){6", " v produk", "Instalarea Windows nu poate fi lansat", "Gt{BB", "!W^ctLe", "/{Ktnt", "!Bp'B", "1>5Hj", ":z7c?x", ":fC? i", "C@$Wd", ")Pm0e,e^*", "w;bH:", "#=d6}/Z|", "o[FoHPo", "--aKK", "cMh'Ey", "Exempel: setup.exe / auto upgrade / showoobe full", "U#hHl", "Wq?sRF", "R}:s^", " quando l'installazione non viene eseguita correttamente e nel PC viene ripristinato il sistema operativo precedente. Viene eseguito con gli stessi privilegi dell'utente o del processo che ha avviato l'installazione. ", "hD5RT={", "a4w.f", "@@7J3>0)", "l'`y:", "Op: / showoobe S", "YeWx,", "@!/6wP7", "C;L:g", "}Oyc~k", "r lavniv", "%'XLH>", "Esimerkki: setup.exe / auto upgrade / showoobe full", "EF`~m[$=6", "'<)~Y", "(qG1)J", "Im#Vm", "Beispiel: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "Xnh.4", "Xc)H0", "&'0X[", "An[MO[n", "`_iUb$V<", "PdCl@", "bKX4c", "f;rsYS", "oLx!G;", ";A#AW", "p?0}O", "Y__^[", "asw`s", ".:<@^", "uab OOBE-ni): ", "o|:Ui", "bVZ+E6W", "_)@oG", "041A04B0", "49:W)", "!Wp?z", "x!Exd", "towlower", "i7@jr", "ne instalacije i povratka ra", "a~(Wn", "I`KGm", "jo~by", "1zy!6", "XKb~6", " conclus", "{R-onr", "SetFileInformationByHandle", "Is)^b^", "Z:[~3rf", "tres : Enable; Disable ", "espace pour ex", "|hK,_", "IMlH24", "-;e4}", "ps;Qn", "enje in po", "=[]sI", "uz-Latn", "x5O=R", "#~I,W:", "H4qn+", "9S@bk", "s?A telep", "PG]Qfa", ".?AV?$CAutoCleanupBase@PAPAU_EVENT_TRACE_PROPERTIES@@@RAII@@", "FLlG4#Tx", "'49oav", "'.eI?B", "TSOq/", "^}3n-", "SetupDUUpdateFiles: Could not determine whether target directory [%s] is empty.", "gar som kr", "tjaPzG", "qHgAZ", ")GwJg", "wS6}Kd", "(jTG.O", "#\\P]rJ", "LpSb<", "a\\$Vn", "}Cm`w", "BE7aF", "6AifFj", "\\9.c]", "N?pr{u", "PUxH]", "6Izabrana arhitektura nije podudarna sa va", "l is a 64 bites verzi", "BuD+j", "!==m=", "#8`?Fk", "HC=94N-", "nmEB\"", ",X5xb", "Zf\\`U", "GZ)LB", "AU\"T%", " program prov", "&daXq", "k1a\\PA", "p/\\ *V", "CK|]y@U", "Rc:/m", "rY!Tu", "$fOiI", "8=gw`", "%Nl:)", "\"V3y9", "Ejemplo: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "iniet palaist r", "9Hr3$", "fz/z+Z", "V^O_c7O", "$ m>b", "inama kompiuterio ankstesn", ";G8Ao", "}ipe?{", "tHvn_", "Ak!'e", "R?\"_'44zm", "T,;`Y", "&wYl-", "siNapl", "}\\dnn", "t-ci)c", "=BZNd", "w;9n6", "Por ejemplo: setup.exe / auto upgrade / PBRupdate disable", "7$717g7", "RV\\fSfC", "Parameters: lokaal bestandspad of UNC-netwerkpad naar het bestand setuprollback.cmd ", "G%4h54(/", "opJNn", "Zt2I.", "Parametreler : setuprollback.cmd adl", "Q<_}M", ">w>rk", "9F9V9c9", "sr-Cyrl", "ALtJUD", ",9V/D", "njIjp", "}10loa(", "%s{%s}", "r Windows 10 om automatiskt.1Det gick inte att hitta den XML-version som kr", " e06>9\"", "Pripravljamo nekaj stvari", "y~%J`W*)", ":(:4:@:L:X:d:p:|:", "c|vSc8", "F1-Qz", "BqNbw@", "r|]!.7", "71f9{", "!1,:Tm9X", "ad: setup.exe / auto upgrade / postrollback \\MojUdzial\\script\\setuprollback.cmd", " loadFrom=\"%systemroot%\\system32\\riched20.dll\"", " instala", "R+*lS|", ":_B{y", "j`Vvdb", "[>2~3", "xk\\h>&", "}+I? ", "Start forfra", "A+es)", "tm9O.", "Uyu", "}3=[,%", "i. Pokud na po", "7Yt^9e", "CWizardPage", "\"0fe(", "%X>@P", "{?/uAO", "&}lc0}l", "5k|Cy;&a", "0XW\\D", "JFU)P", "_?eLg!", ",3ldE0[", "Comutator: / quiet ", "D$hPW", "4e(Ab", "]zZY7", "UanUD", "a komandna linija mo", "ENeGGGlllAA", "8=#&+", "2KbW-P0WEO", "=z%eO3<", ", hogy a felhaszn", "dH;\"~", "AU8[b$", "Ed]hZ", "eyJfH", "!qKv{", "RhaM$", "<\"$-L", "0t2b*", "8J>'G", "n de Windows 10 no acepta argumentos de la l", " Wg^L_", "xXo2'", "(\"-mN", "", "u[Si6d", "96z7m", "anu. ", "fT!GJ", "A}]!d", "''yhH3", "L({fB", "effectuer des t", "Failed to flush MoSetup registry key, Error: [0x%X]", "o consegue determinar o idioma da UI", "metro: / auto 3/", "WX{=+", "@.dY>", "~Kg1;", "\\}W7b", "mY-{+", "0D0f0", "qb]s%", "H37-~#", "Parameetrid: All; None ", "DBKa$(}", "}otZc", "sHW\"DO", "W!N$(", "5&5D5]5", "blHX>HvA", "3~DVR", "Ck:oL", "7K8p9", "Eylem : Kurulum, y", "buj ponownie.rJe", "ria(Erro ao preparar a m", "ho nastaven", "+A5Qe", "%E>mX", "zA|Wl", "#|2|o", "=e?xQ", "tYyK7", "Gatavo", "CAzureScenarioCtrl::CreateCommandLine", "D_^u~", "&R'BM", "nS6v[", "Y2V5s", "e,\\Pq", "A4Mqw", "yPS*S", "|A_{q", "NMRn0 ", "[2;[5", "27.dM", "bf4Xv0", "y2shY9U", "0!n,h@M", "N\\'!p4", "Ct;KV", ".4P?}'", "59XU9", "HeapAlloc", "OtfM> ", "vN|Z~r", "fini sur Aucun, le programme d", "6jr@x", ")1Qr)", "pOLDD", "S1~.v", "PR\\-n", "cpbdL", "IPe<}", "ZtxYb", "I)T", "=(0 0p", "fjgt=", "Attempting to preserve existing logs...", "bYnZswN", "?~Y$_", "gezzen-e dinamikus friss", "=(>B>O>", "VfCS9Rs", "dgs@G", "H~)\";", "lry8L", "=e2EE", "Mnt?_", "MZ{*N", "V`EZc", "D2HH7e/50h/ir", "5$5(585H5L5`5d5|5", "pN~-o", "#rn\"vm", "ZreY+", "uux", "DW_kr39:U", ":$O;+3", "uUmU_", "P6*=,=*", "!#* Z", ":t{\"T", "7ku[.", " architekt", "Q!P[.Fh", " nukopijuokite diegimo failus ", "%]*\"U", "XRKi-]", "@_^[]", "8My`P", "re wymagaj", "Action : Injecte le fichier setupcomplete.cmd ", "9lcfx", "14FNd", "Xd2bJ3b", " pirmojo sistemos paleidimo programos veiksmus (OOBE). Naudojant ", "N'EdNX", "B.>W?", "041204B0", "4=WF2bX ", "W{7|?", "CompareFileTime", "]224__8", "<[9_(m", " endre virkem", "J<))1^m", "f~XgTU;", "Eylem : Belirtilen konumdan setuprollback.cmd dosyas", ")I@zf", " vom angegebenen Speicherort ein. ", "oHo:$o$", "AWfQW", "OC|yRXq", "G x<(x<[", "BHYE.", "N\\1z<", "?Mn[L", "/oI4x", "X$Rj*", "klad: setup.exe / auto upgrade / PBRupdate disable", ".?AVCSetupPageResume@@", "ZRfr7", ")/w", "o:u1@y", "e zadane konfiguracije : priha", "S|t9:", "rcare ", "l*p8r'", "W`(fu-", "1#xP/u", "99~^Z", "ZZZvww", "D!Q*eC", "EH0Q|", " ve UNC a", "'-OqI%", "*rXt+95", "*@`RG", "=is+z", "Ky\"lS", "f!C8&\\", "5ltbl<", "]A1=W]", ">?(u>X", "@TRN~", "@&usW>v", "HIIYTB", "k6Tv4m", "aU?[x#", "[}'}^", "U2C|d", " Windows vNext ", "x=|~uV", ".data", "gG&qE", "0Ne'PJ", "ches ", "*Priprema za instalaciju sustava Windows 10)Program za instalaciju sustava Windows 10:Program za instalaciju sustava Windows 10 ve", "'Qu7G", "End;U|", ":y.(pgx", "e biti a", "lreiz.rLai palaistu uzst", "Ag2,BTh'", "^cQ3?h", "%pUxVv", ">S0pobQ8r", "8;:q]0", "P?b>4", "sYhly", "q_eje", "A-mK8{", "qMXoo", "exploitation Microsoft", "bO:>{B", "N>G6{", "sLY-", "RR(TV", ":l\"=a]", "rY\"#k", "IfI0Hy&", "l(f45n", "rB5?v", "Anahtar: / Telemetry ", "Bryter: / PBRUpdate ", "8_=\"fh", "hu-HU", "zune_", "0[\\1UJ", "\"_J('", "ica sistema Windows, morate uporabiti 64-bitno razli", "COMCTL32.dll", "az-Cyrl", "/+>8c/", "idK>t", "]QN=_", "03YNW", "A4;F\"m'&", "W}N/b", "NOTA: Este conmutador solo se debe usar en entornos de prueba. No debe usarse en entornos de producci", "emplacement indiqu", "qClWb", "dbJzz", ">QLyQ", "&7@$BCI", "CreateFileMappingW", "h3nTI", "RmmPm", "C8tUw", "a^Ib-", "U&#s&", "ra neatitinka kompiuterio. Pvz., jei kompiuteryje naudojama 64 bit", "eD_V&~", "sO5~#", "LI5m3", "_GgM-", " olabilece", "ivitata arvutit automaatselt. Installimine j", "Exempel: setup.exe / auto upgrade / PBRupdate disable", "H\"fP'", "q0#,S", "ss^gq", "o,d}S", "< !T^`wv", "dBV>\\", "j%tW`fU", "-j1}?", "!je'6/", "_F]5Z}", "]#\\nWT", " complet, l", "G_Q>`", "\\1A{g", "cL.]C", "PBOdg", "2Ka|wq", "2[?-I", "} :>w", "Hj%mB7", "V8293", "=En8E*", "L$;tJ", "}IuF|", "u`6Gy", "5hAV", "t^9_`tY", "j-3EP", "t~/)V", "{UP:Z", "kseltme", "mas Windows 7 Enterprise. Tas nev", "tb+rC$p", "|:BVL", "S>311", "@zibf", "micas, recopilaci", "!0(0=0D0x0", "?wxu8", "}Tr]x", "?2xQTV", "(DoTd", ">$>0><>H>T>`>l>x>", "m94\\u)", "z2phC", ">Dv=|t0Sd", "GetCurrentDirectoryW", " E-uM", "JOb}7", "uxtLg(7", " ni crear", "!!gE0", "de-AT", "Q{F0@", "JD vAv", "rMUwM", "O]tG~nd", "l>^Op", "Ix<4m", ">.6J4iB,", "f0^im", "Do&kon", "n*g)O", "4(5B5m5", "s~yL{p", "ur-IN", "nika licencjonowania zbiorowego lub no", "a querer recopilar algunos registros u otra informaci", "S,_^[", "Juridic", "5\"6,6M6g6t6", "2%`Te", "fV\"&\"", "rguasukohast ja ilmnenud on ajutine v", "@czEkG", "LdAV^s", "nqA$#", "(33#j", "GywZ\"'&", "#ry`%t", "hO>)g3", "bCUlv", "KS3C|", "@@@@@@@@@@@@@@@@@@ ", "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x", "metro no se necesita cuando la actualizaci", "Jnd{<", "iant s", "kllbbj", ".Setupcomplete.cmd ", "RtlDosPathNameToNtPathName_U_WithStatus", "aH5i.", "Vg'8Q", "Parametri : lokalna staza datoteke ili UNC mre", "Z@N)2+3", "Gi'E>\\[", "pir\"A\\", "D'V%6", "ConX::Setup::Common::CSetupLangIniLoader::LoadLangIni", "\"T=j1WHa", "/Teie valitud arhitektuur ei vasta teie arvutile", "HWi:]:-3", "~}=zYb", "sx~MN", "0@>$@0", "ra, s", "+ut.5", "\\Gx$}#", "SgY,%MP", " ]e .", "2e`)~?!", "ESEMT", "}]{cJ", "BE1-!", "Yc3zz", "H[{G )", "GetStartupInfoW", "7+1wK", "ratud eelmise OS-i peale. See k", "6%777_7q7", "ZEa\"az", " program nedok", "tavate arvutite versiooni. Ta ei soovi installiprogrammi kasutajaliidese kuvamist, kuid ta soovib, et l", "7ZZ;@", "3=#8C", "xPah}", "IV6H2", "TfoSr", "o\"Ov04M", "&X8:RiYUG", "h0(`6BF", "c9\\N;h", "r\"PMXV", "KdEsy,+", "NIZO)", "AEMq-", "b?4G[", "m=<{zZm", "! sV2>=-", "pabeidz OOBE. Alternat", "a&gho", "R~\"Xe", "-'ZSb", "Beispiel: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "L:.zlW", ")^i&F!]", "hxkI@", "/Vybrat", "K+WYT", "Tj_R*zCR", "Tjuu!X", "@#'t<", "$RW UQ*x<", "de origem. ", "hT3B|e", "U?Li7}ob", "}azR]", "v5j:Xf;A", "V^\\>6\"\"", "2i7vm", "4[| wB", "9 tDpv<", "_UO|X", "Y!mQj", "C!q+!", "C'B'B", "@D!{N", "4^!G{", "qXMS@", "?A;9[", "F3Vz[", ", ktor", "Windows 10:n asennus%Windows 10:n asennus on jo k", "n/kxa.", "-\\)Df", "klad: setup.exe / auto upgrade DynamicUpdate disable", "### q", "ljande kommandoradsargument kan anv", "A9S=C", "8MKcD:", "Dfs.C6", "&XJgXL", ">2jO-x", "*!jXxQRy", "4Zv-/", "*',,ljf", "5tRgr", "}4ro ", "iSBN-", "O^EOk", "HA`gM", "Nc+>}", "]6hq7", "5g]L)Z", "`uusG", "Of#Y7", "+z|X0", "CX;'d", " a sz", ": setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "-$#E;", "{bSsH", "}I{OG5", "/SmM~", "'qd2;:2s", "e*6e]", ";Mh}.", "lHJ._<", "7bk4~b0", "DeleteFileEx: Unable to open [%s]; GLE = 0x%x", "\\g]ma33", "A-cVr", "ll[rI", "{+Sv)N_", "0H*!}//e", "r / PBRUpdate er satt til Disable, verken oppdaterer eller oppretter installasjonsprogrammet PBR-partisjonen ", "Y;?\\B'", "X&J}t", "nw}]O", "CmdPAZ", "O?el?", "#yog]r", ":Nw69W", "7uQXZ", "zV4Yp5", "zLMX9", "RU]UU", "MRr},", "``{KN^7", ";3;A;Z;~;", "o+wn4", "{Q;hv=", ":6i:O", "5&u[N", "{-6r\\", "(((B8", "Ih6Z5", "H2 !U", "FindNextFileNameW", ",7z:7E", "eno dinami", "IAwr}", "aO7!#f", ">_|?b", "(r-Hn", "nda kurulum otomatik olarak yeniden ba", "]oq'q", "..DJ@", "041304B0", "GO$J}", "xVh4z", "&sX&uf", ">71{A,", "8S|[,", "0@w$A0", "z67sB", "i=F(Y", "terek: Egy .inf f", "qiQ$m", "k]?\\p", "tbbdp6", "tJj\\P", "/WUCachedFileName \"%s\"", "ESD source file: [%s]", ";SA>vVoS", "Te[CU", "M&;48$", "\"2C/j", "m,?TC", "xBTPQ#", "=1XjJ", "[@JvI", "c-J(I", "X37:\\", "Z ", "W\"\\IpY", "LI1D|", "8Im:8", "1_?dyg", "YeN;?V", "bKd_u", "$%%qu", "Li#zb <", "/Recovery %s", ">a^\\n<", "RX0N4t", "TZ9|V", "[qzr/B", "B\\H_h", "\"eJq^-2", "RKD[TInA", "anas, bet pirms pirm", "4ZDAJ", "~PQu}", "H0/Y_.", ":A:Q:a:q:", " \"All\", ", "%'omgw", "=M\\cC", "gu)Tj&", "d5.@3", "Z8'G\\", " z&43", "StateMatch: [%s]", "Parameter: Ein lokaler Dateipfad oder UNC-Netzwerkpfad zu einem", "u6V: ", "Op?Q-", "$AbT'v", "`&wvSYA(", "DdO(w", "EnGMv", "r inst", "r1nA-", "UuM]Wo", "Gj96a", "nJiSOQ", "!|oIt&", "%fsXd", "*{-8r", "v-/E]", "(M (Z", "Gzn@[", "s(^Z_U[", "*j1W|K-8u", "=C:NW", "Uik>^,<", "\"e3_s", "l`RCf", "]6r/E", "RF<)Z", "739rVt", "Oa,\":", "k eO\\", "`wpVV", "\"RQ43", "\"q\"\\>", "7&7@7M7d7q7", "Prepar", "metros: caminho", "2/pf{", "kqK]G", "Y:JK1", "VH#sq", "#zr0TF", "Kontrollera kompatibilitet", "dzia. Spr", "n'5qK", "-Wm/fq#", "[V\\$V", "chTG[", "en-TT", "Panther", "hPe;:", "s adathordoz", "czeniem sieciowym. Spr", "dia pr", " telemetriatietoja. ", "%SCz,", "mDCM;", "@)WQ8", "xfO<}l", "F1MkGz6", "Detected existing setup mutex... exiting.", "ide: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "anas datu nes", "{M?Z.", "^@yx#b", "IZCIv", "cL}F?[", "@r?Op", "6Ex'dm", "ini belirtir. ", " pendant qu'une autre instance du programme d", "DJw6+", "klad: setup.exe / auto upgrade / showoobe full", ".s~71", "9AXGb", "TWks-", "nd den andra installationsskivan som det st", "b!B/e", "anas programma veiks dinamisk", "*7k", "-El2[h", "t fra det punkt, hvor jeg stoppede", "metros: clave de producto 5x5 ", "`0]/_G", "rF^6\"", "we(c1lzw`", "UhI($ ", "gTk8 =", "bbtef", "WVa5oW:", "000@@@@@@", "]~N;<=", "WY-/N", "%Z!TWE", "s veicam sagatavo", "!s_k#", "L$4_^[3", "MJbM,[", "G-P|g", "c>BD+", "Could not retrieve error description from action for [0x%X].", "bo,{1", "Process timed out! Returning: [0x%X]", "en-IE", "_v8o5", "Ga4b\"", "T},6,@", "4QZ*]", "q|M]T", "6T[B9", "@JMA+", "'>&F+", "Voorbeeld: setup.exe / auto upgrade", "%5UJM", ";JAqth&", "fnL`h", "Bryter: / Postoobe \\setupcomplete.cmd ", "OutputDebugStringA", "~eCM.", "_Z4=1MU", "vSB>@", ">{7jd", "675>o", "is diegimas atliekamas i", "Qp3rAB", "anas oper", "e, le programme d", "d$wV%", "'mks}", "2*2J2U2^2h2m2r2~2", "5m(m*", "R`cWZ", "Switch : / installfrom ", "nje stanje i OS. Pokre", "b3\\ej", "zo(z7", "%4{gC", "}.6P]", "Actie: bij een mislukte installatie kopieert of uploadt Setup de gecomprimeerde logboeken naar de opgegeven locatie. Hierbij is het belangrijk dat de pc en/of gebruiker beschikt over de juiste bevoegdheden en netwerktoegangsrechten voor het opgegeven bestandspad. Deze opdracht wordt uitgevoerd als systeemopdracht", "zeUz/", "ma)u'", "K)m*'", "-F{Ir", "CEe`|", "Q&8`|", "oP$5U\"", "Y1/DFm2", "xel: / PBRUpdate ", "Ar9s|k", "FD\"zD", "r inte att fastst", "lja a m", "N>CU-|_U)1", "fykFV", "O|||y-", "n~'e,Vw", "SO'4H", "n]lleO", "o`kP.", "[92#F>", "0;1B1L1S1$212h2o2y2", "NMyYV", "gb]U4et", "'n\"PV", "r{` Bk", "df~;(", "83,X!", "ZjLks", ")VoC'", "RpPeC", " -kYVWB", "SdjnYS*u", "oihZtW", "sekor. A sz", "klad: setup.exe / auto upgrade / Telemetry enable", "!esgp", "wS,to", "&M\\Ph6", "u<#S4", "X0j$AT", "|c\\HX", "u{1Mc", "Of.'c", "^w}nj", "Tarkista yhteensopivuus", "e}@v[", "N/~\"6WYM", "cznik: / DynamicUpdate ", "[/oR^", "roLoeu", " OOBE: ", "u yeniden ", "-)[V+N", "t=Du2 +", "16}H.", "!J G@K", "7]O{?", "RSSq1", "m'mmE", " niveau vers Windows vNext, en ne n", "7K,_i", ">PLRI", "m$6CL", "g7LN],(", "dC!*/", "b\\|z7", "S:Wi`", "wO4>N", "{8n^l", "a'vRC", "#Y3)/", "db\"6z", "Vz :6", "o: esta op", "f\"\"UZ", "2Cm7t", "\\`~cJ", "gu-IN", "qs-S,{", "Action : indique l", "Q'(/<\"", "A~!?m", ".boxload", "Opnieuw beginnen vanaf het begin", "GR@(]", "^J=J\\", "!eA", "iV$K>", "!ElP#", "dzis: / installdrivers ", "!FZ*F\"", "CopyFileW", "parationQLe programme d", "s7%%+", "Cleaning working dir...", "[g0M0~0[0", "191113214040Z", "`o`/m", "h/lA8", " vc4A", "avanje zadataka nakon instalacije, ali pre prvog prijavljivanja korisnika. Pokre", "0#1h1", "Tg:WO}]", "E@NNNzbL", ">}\\'5", "&i.Y^", "I>f_j", "OL9>K", "6>6n6y6", "&VA+9", "wt=sFT", "Jf(Yr", "lNek8", "%!p0p", "wLu:C", "r %s bitar p", "|7RFA~", ":F9a[", "iOi0:", "V0xp=", " predvolene, s", "v;mEJ", "Ow9Owy", "erw3~", "?r,p=.", "O|w\\qK*VK", "D$HSV", "(CD9I", "}h6C9", "D$DPWj", "-9I_pz", "f [so", " ir i", "DQU_vu", ">rn1;", "@0I&W", "A!z6C", "wPG@7", "3WR\"q_", "*%]Ex0", "VTgk}", "ozVGu", ",$Xw-", "kUo~6", "Process timed out! Terminating process...", "u'1Qw", ";92y'", " e non caricher", "]A0-p", "2ER5t", "^>{yC{", "'Jtv|s", "5r!7P", ";}^yi'", "gQO3-R", "Px4.>", "OGQ\\4", "l=gB'R{Y", " interakt", "/fM\\)", "\\Odzv", "Oaf^Saf", "0\\> A", "RPCRT4.dll", "qU59B", "1U#a2*-", "DsaV*", "k+[Yf", "E(d6LS", "nom prostred", "0X^aQ", "G\\f\\p", "R(W/\\", "8|Vof", "Parametrai : N / A ", "nda 64-bitarsversionen av verktyget om din dator k", "n de Windows 10%Programa de instalaci", "6j$M*", "cii s multilicen", "5Kux9", "mn0;3Lu ", "'0D |", "zN", "Prebacivanje: / migratealldrivers ", "(GiC9", "o%80T", "i0.gv", "Working path still exists. Cleaning working path: [%s]...", "'./$\\~'%2", "9]Qa,r", "hOoL&", "jK3(ev", "{a?<4", "!|e[$", "3=i\\3", "y{kz;", "{P_3(", "gtViS6", "2C[`h", "FindFirstFileNameW", "~gMOt", "$|wX'", "`Ahttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "qps-ploca", "D\"(XX%", "ZZ1:{3", "?4?D?X?h?{?", "[Eswu", "q9G#4", "MOX]|rD", "fHT\\ ", "N.+}@", "9Rp9$", "[!n^Ejn", "njega stanja. ", "Fdm7a", "i|~80", "QIl[?", "_wcmdln", "zy`tR", "&r;=\"]", " uruchomione inne wyst", "1^bGx6>n", "q]~;je", "qpmy|", "ZC-yV", "P1Ll$", " jour dynamique (recherche, t", "/Yjk[<", "NOTA: Este conmutador solo se debe usar en entornos de y para pruebas. No debe usarse durante la producci", "ie komand", "'=o!4-", " \"bcR)", "}j-Yw", ".!M7\"", "5c^X;", "2G2Q2e2l2z2", "UC:~M", "nika zawieraj", ",>vRq", "+3d9{`", "Konfiguratsioon", "vTkeO", "(W2)2<,", "8mN;fp", "+::h=rCG", "@rY+O4", "da nemate dozvole za kopiranje na lokacije koje zahtevaju korisni", "bj+Er=", "VAi5;", "D$\\$)@", "z\\ T#", " partir de l", "~yJ>4", "'X%2x", "OOBE ", "C-&Kl", "0@d$A0", "Q\\'dG", "Valitud arhitektuur ei sobi teie arvutiga. N", "6jcpmq", "~28o9", "e;:0}t", "j-Yf;", "9Mks)", ",f6l;", "8@8Nk", "233p3", "uQ5*1", "!AbmC7", "]3Wh5L", "+9|O(", "*8yl-", "`^Wqpx", "N}Q}K}_M", "c`G/n", "t?o.|", "n01q1", "sistema; portanto, talvez n", ">,><>@>P>T>X>\\>d>|>", "boru specific.wim ", "u~90$", "d~3sQ", "hB %6 ", "anas programmu.", "R2WZ5", "o deve ser usado em produ", "%Ty|5j", ")uR;,", "VVWk(", "040B04B0", "YBC0/B8%", ":MwnD", "UjNrM=", "vi-VN", ":+o\\$", "da pak ", ">BtJD", "~Vi^y", "Phh!A", "=|mzT", "x;\\we", "n. Si anteriormente iniciaste el programa de instalaci", "Parametere: Lokale filbaner og UNC-nettverksbaner ", "%SRJn`", "E`af@", "2rmo-", "OegG~", "c_\"gd", "o7e<1`", "XQp2j", "d]s&7Y", "vyrCg", "e@#w ", "ao concluir tarefas de n", "Lowering priority for WU scenario...", "_=>S?", "U&`mU", "L.llt", ",>qm~{", "rbf.;", "%9Be>~C", "b8+;c", "rak olarak ayarlanm", "w3AV!", "$EtW$", "?p p0p(p$p4p,pOHk", "X!(_)", "Veiksmas: automatinis diegimas su diegimo perk", "s van een afdeling. Daarbij wil ze de gebruikersinterface van Setup niet weergeven, maar wel dat", "n 350 Mt tilaa. Vapauta tilaa ja yrit", "UJNfTJ", "ver anv", "5jCB)", "rp>O|", "TYm\"k", "ho po", "chec d", "rgmiste k", "chec de l", "U*M^%", "kqV:j", ":*[dC", "DlpTask: Resetting action [%d] progress start time.", "2sQV_", "l*;*\\", "Pb/9j&?", "Prebacivanje: / quiet ", "MnV0{", "0(RhM", "L])EZ", "/Ouup", ">(Ko%", "9:J8Z", "3h_YU", ".?AVDirectoryHiveUnloader@@", "fPnic", "bNr.|{", "olvDU", "K`CqJ", "gsrVA", "rv} E[", " /ZsCa", "T4N>Z", "R]?;X", "+gc\\Z", "SendMessageW", ">=>h>o>", "GAYsh", "Mlj[6", "s\"!Ku", "b$\"yJ3", "VC\"$A2", "~[SUk=d", "0qDu&", "o!q(ImV", "ZkdN+", "dzie jeszcze raz.wDo uruchomienia Instalatora potrzeba co najmniej 350 MB wolnego miejsca. Zwolnij miejsce, a nast", "a9Tqz8;", "< ='=>=G=", "S`o07H", "]C;XuI", "kseltme yaparken bu parametre gerekli de", "jumi. ", "cego wersj", "r installationen misslyckas och ", "tuzO]7", "&_HxS;", "^8{a1", "|@SOj}{", ";%=k=", "n3)0'", " fail", "Instal", "j?G8;B[SJ[", "09Rx2", "8C9T9Z9", "^V;[h", "+n6@3", ":yO@-", "^VfFY", "0hC{n", "3#4?4", "a&UOA+R1", "*|e~J", "D$0SVW3", "$TE=DX", "V/]$s", "2-\\*zg", "andamento", "Gt+G]", "ho programu. Asi je", "L{OFc", "G=|2h", " Microsoft Corporation. Minden jog fenntartva.", " setuprollback.cmd ", "Toomine", " jour dynamique, accepter le chargement et la collecte de la t", "7Ur", "nssnitt ", "ch soubor", "bb 350 MB szabad helyre van sz", "^?ewb", "Un ing", "Px7rf", "pTq~1", "!%[`v", "u}@'c.", "rMOcT4", "GA AI", "/bBc1", "fxeKi", "fXFM2.", "o %s bits. Quando este for inserido, a Configura", "otfk;e", " asennuksen l", "7k-T)g", "1.4(O/N]I", "(z54!l", "s$kfL", "ti, nem fog tudni vissza", "re mia", "gZqS ", "CreateThread", "~OBaAw", "Cy(\"M", "Z2ZR8", "##8Dj", "If.S2", "Windows 10 Setup", "? ?,?8?D?P?\\?h?t?", "?:TC9", "rskendatakse v", "ndig uppgradering till Windows vNext d", "DZ=;L", "tSd2r", "`cM!tJ`", ")hWrS", "F\"`C.(U", "m[4`rO", "Hadx=h", ":K#gj", "rio somente quando o computador atingir a OOBE : ", "tAF;u", "YPvg[", "'MUN=", " 2wX$", "yp/_m", "B^q%=", "1.ZT,", "7x1_mP", "i!1T;)", "\"oH=}o", "n[TkJ", "]1}K.", "/_Z}}", "]m?dsl", "Y5M@M", ")k8A)", "s1C3peQ", " bulunamad", "dia / files ", "RtlNtStatusToDosError", "_\\z/B@\\", " adathordoz", "hyZ-+p", "~$PY<", "gk_,", "C|\"{i\"{h\"", "[4}n_", " setup.exe ", "%1gaE", "n que indica %s bits. Cuando lo insertes, el programa de instalaci", "&Neste", "urnalus ", " e caricher", "R", "lYdR\"", "(d(e`", "Parametry: lokalna lub sieciowa ", "cJj|i", "i PC-jeve u svojem odjelu nadograditi sa sustava Windows 7 Enterprise. Ne ", "?DK7 ", "f[s)(bb", "utY}6", "6[>'&", "\"4.X`", "HF_dM", "L>mxJ", " kaikki m", "Fk>Jk", "jiet uzst", "A=4tn", "IQrB|", "lTn*O", "DzLNV", "l bandykite paleisti ", "9r0st", "A`Hl:", "nYoxa", ">Z*.c", "i'v", "/P/.B*", "etky in", "0k0o0", "tsa el a setuprollback.cmd parancsf", "/M6`?", "che soll nicht angezeigt werden, allerdings sollen die Endbenutzer mit der Windows-Willkommensseite manuell interagieren (einen Eindruck beim ersten Ausf", "GetSystemTime", "8+9^9", "s;#D\"W", "j8z0nPN9irn", "37Jkz", "[LKHL", "GB_c$", "Azione: specifica il percorso per il supporto o i file di origine dell'installazione ", "vcvpr", "'tPL~", "ggs'r", "lda: setup.exe / auto upgrade / installdrivers c : \\saj", "s local ou un chemin r", "O.7*8H", "2knThn", "ryejzs", "A;%>F", "+4{e~", "Y/GX1", "9ToK0", "(\\gH$w", "9/FxB", "y^w+7", "3h3n3x3", "[qjs'", "v&^52", "ramise UX-i ", "HR\"8k6", "6].?8", "@@@000", "LBh18", "dGX}\"$", "]EYF3", "A arquitetura que voc", "blCc@P", "mH/^|", "Perjungimas: / Postoobe \\setupcomplete.cmd ", ";w+!Ad", "i.'NL<", "#0}#~", "Phx A", "1G,V7Un", "*}HPST", ">BA~}#,Z", ".a! /,", "&/0#b", "~AKJ?", "JS)&L", "0k0!nW0~0Y0", "FzWHn", "n especificada durante el proceso de instalaci", ">h];/", "la na povremene mre", "J{YF\\", "tYGN", "o: / installfrom ", "NoeR1", "V\\!e\"", "g!SX=", "v-mP-", "mas at", "CDlpTask::ReportDiagTime", "itie tohto prep", "utfH=", "%r`9iJ;", "Kj*Go[", "vWnSJ", "K\\-`s", "$?phJ", "{$C|X/", "/\"VYa", "Q2B*69", "SetupHost.exe", "Parametrar: Full; None ", "~MW)|p", "op+6?vx", "V7wW7X", "U:sG0;", "w#@fi", ";2;=;k;", "|}r}:I:Y/", "H&KQD", "IUR*yM}@", "U{GqL", "\\&OI(-G+", "K)B4F", "V]?du", "wY$v5", "Q\"+W|", "B}=g1", "TAl},", "Azione: consente di inserire il file setupcomplete.cmd dal percorso specificato. Setupcomplete.cmd ", "X3bw@", "q)G@mY", "High Contrast White", "u]OO_Hw", "xz9`l", "Ru7VS", "!(Fl0", "ed-BDf4W+", "O$FN&zCd\"", "sr@#SL.", "xh=]~", ">", "UhcER", "-0KY6E=", "'d%JN", "<^f^A", "|-i(m!", "-ulC[1s", "N0L0J", "riist, taask", "F5%e,", "yb}pYBo", "F1a6p[", "H]diK", ".Ew=W", "4EVNFT", "p=A.Q", "Fq5@!", "tke arvesse, et arvutil ja/v", "n (conocido como", "SetupDUUpdateFiles: Target directory [%s] does not exist.", "@rRu2$", "rkssti til en specific.wim ", "_n0'Y'", "c47>~", ")c&{V!", "2!3[3", "4II?!", "rZ`92", "&pvR", "n1) ](", "dD{qvq", "toru sa nepodarilo ur", "]sI>c", "v\"Ly2x", "m soubor", "?huyp", "/Wcc", "LS(A/", "A},06", "-pu.^", ";0bF/", "bGupAAO", "W~))h2Jt", ")0Wt1", "-u7O&", "|+|+}", "Y/10z", "/", " dokon", "ritetyn sijainnin kaikista alikansioista. ", " 23?Q", "TNNi=x&", "I97%N", ">&?-?", "bkpPx", "D&vrn5", "Gk\\auH", "Gs_6m", "-vh-396", "vhtBD", "Jhkf&", "~1N;@Z", "h`@^#&", "ges que l", "=^~='", ":C,5.", "bg-BG", "}d;?s>", "o8+I@", "$uQ} ", "CVw\\g", "n de diagn", "memmove", "T;\"]u", "n niiden oletusasetuksia. ", "#zLe#", "sI|KwE", "-oPr4", "K2#Z.", "8&9C9r9", "outil ", "xsBlVr", "$i5In", "TNE|evzAepS,", "]]9F[v", " installer Windows 10 ?", "Mu6r}", "yRbA:", "Ig_+5", "ZYu}z", "lj8#a/3", "Parameters: lokaal bestandspad of", "TGM=*d", "5{rp%,sT", "rM!*Zk", "PhE=._5", "c QB;", "_nXyp", "W-O#38", "ne geri d", "m, kas ir lietot", "Ee2!~", "b_\\, Xw\\", "eW>3V", "s ellen", ":> (py", "", " failu setuprollback.cmd no nor", "&>7S\\", "p_x_w", "Jg|*zh", "?'i{1", "bW$Etj", "@#mFX", "Parametry: All; None ", "/q05:", "F'[nc:&[", "f*[*1", "G+jyzzlf", ")JU~[", "bg!~m", "H\\\\+a", "s,%p4&", "rV[r7", "KNw%j", "v?(7Fn", "cie> ", "k2W j", "Sedkdc", "_JZzd", "Zgodno", "dZUr%", "CDlpManager::GetDwordPropertyByIndex", "O| lo", "P%&Bt=0@`", "Sm_SHGl", "rL1L1", "Y[[[!%", ":pDtS", "V5sY5", "!\\Y#<<", ":b4c8", "QEQbl\"i", " program.", "hKw7~", "l1}Nq", "tja a telep", "installation de Windows 10 ne prend pas de param", "o Defini", "a[]eY", "N_`1:", "bWIbP", "E@_\"@ ", "zda Windows", "&ROs5", "bbtS T", "q!252E", "CDlpManager::DeleteQuadwordProperty", "mpligt ", " |kwf", ":ha2=", "UM&,g$qc", "}p-?v", "Het kan ook voorkomen dat een implementatie-engineer de logboekgegevens en andere diagnostische gegevens van de test-pc", "jf-r$", "afnzH", "O*]1Kf", ";K]Nh", "ja atra", ";F23!", "y|$p3", "ILV']AV'}/Y", ";LcO6!", " ruleaz", "^mn\\w[", "*ly>zaJ", "ppp@@@@@@@@@ppp", "@CA}z", "b?0Bt", ": / DynamicUpdate ", "IbG~s", "qw-Yx", "3.3]3", "ha-Latn-NG", " v zdrojovom prie", "\\w'pNr", "A]G;F:", "hKopJ", "v&n0U", "Xk'iK", ">t<{U", "93%C?", "U0bZCM5", "k{gWO?Iq", "]zWBZ", "4bRE.kEw", "2C[?[", "o/C_g", "^'|S8|", "a~y%o", "?G&Ho", "iU'nw", "Hrjhy$9=T", "IVRr<", ";=>c>m>$?W?c?", "!eeDY", ":U:KG", "W=3h^", "VVok8", "ivatelsk", "]9Z~>", "!}7XM", "<0<5<3>?>", "\\W$4Nj", "zA(,", "mV)/4", "qTr M!", "P#]OR&1", ",oaxy7", "S_,OHP-", "a$Vw6", "van keres. ", "y91,8", "installation h", "vNS:\\F", "6T SZ7c", "zN,ld", "Q{5_DpV:D", "v02\\xvJA", "Ej$ew", "0;0B0Z0", "f>6\\|", "vD*LM*", "UTM@?W", "S5K7y", "Akcia: Ak je prep", "pule viima. Kui aga s", "9n1kU", "9oEe{w", "2~qGEYpg", "ivitage arvuti ja proovige Windows 10 installiprogramm uuesti k", "|${[do", "??1)-", ">P[dr", ".<`sJ", "GJ-Z,x", "*o~H30L", "U4u[Q", "s vietas apak", "Z U&Ex", "Translation", ";Z~fS", "lJ2y<", "ChA=T", "=EWgt", "`gmGK", "D4[>`", "+~0F|0", "&!>ln1", ">r84H", " None ", "yGw]`{+7", "$qR8)", "&RFD^Z", "m!|H=", "vDYYY", "c(P0_", "e;3\"El", "#.r;$?", "|WC=H", "%OHV3", "[(dIV1Z", ":\\.Rw`", "D|2D:", "'ybPL", "e'Esx+", " tvarkykli", "G=qk;", "kpRrJq/)", " name=\"windows.storage.dll\"", "lus un citu diagnostikas inform", "ivitada.qInstalliprogrammi k", "wfB@H", "c'_Q[", "Switch : / DynamicUpdate ", "Szu,3", "0{nv1", "WB^x{h", ">c4&k", "pA^+'", "&Nqxvk", "T*Zn\"", "nrX!3!", "FM0M8", " wersj", "!!.>n", " >z(kt", "|G$=F", "=(h,i", "M$yq\\", "5aa_c", "BkVmF", "UohOMz3", "G8cj6g", "Pavyzdys: setup.exe / auto upgrade / migratealldrivers none", "UT]Oy", "E:XMA", ">(?0?S?d?~?", "G~;_?", "ipHTR", "R o\"E", "ZYB/7[", "a=|02", "%`kR|", "?Do1=", "GetModuleHandleExW", "Stikalo: / Telemetry ", "o?U3M", "0A$$?0", "orO&Y", "}qY`8", "5x'muqF|", ",V'y+", "=Q,+9", "jbOWE", " parancs arra utas", "RrB4*", "%S0Ee}O", "0xG79", "Y&y#*L", "l$:xL", "~wZ`D1", "rDc7{f", "<{rTbm", "j?|QS", "J%(WZev_", "^l^'7>", "2^[Q<", "\\\\Kup", "j=5Rm", "d4b0zH", "9bp% ", "v1us/,", "tt arkitektur.0Det gick inte att starta installationsprogrammetsDet gick inte att starta installationsprogrammet. St", "4>[jq", "AY1IU\"", "xF)n`", "m yerden devam et", ":A:\\:", "E`BYE", "K+PW ", "Allalaadimine", "B+4j9", "psmF\\", "M.gK9", "Akcia: Ur", "J:lc?", "6'2lz", "5J9o[", "PLePn", "9hI7b ", "l|6a2", "DCj]5+", "{AYaH", "D+DPj", "XN6_Vi", "(2()E", "*,Rl}", "Kc'i5", "0+TmY", "ee[4m", "|V$+*", "!&#@!", "{/ab/", "n^{o5", "0f0D0~0Y0", "!3DIB[", "p_CXoTh", "", "n54!Q", "XB#QJ", "T%{bR", "Zbov1;D", "tU+cR", "xHCr>", "Huz7n", "o. Feche a ferramenta, reinicie o computador e tente executar a ferramenta novamente.cPrecisamos de pelo menos 350 MB de espa", "i0pwhc,uq", "T3\\N{vZ", "u$p:0", "(#1jA", "QN6<+", "~';%zG\\", "gVHm@", "6#O0s3", "n eri", "P>*c*", "r[(neV", "*.7_u", "(>>&@", "C8;#-9X", ",,SKQ", "site, ", "lW1QT", ",RXIaE", "bB27\"", ")ob^I", "tirmek i", "B]eTD", "C4K4U4[4f4m4r4x4~4", "F&O55", "x:Okq", "Ae&qEd", "G.e7OV", "tg-Cyrl", "b}E|N", "]xz=M", "Switch : / showoobe ", "Ds", ",\"g?;", "V/@OtF", "`op<8", "2 XPY", "[wW~[tw#R", "nja prvega zagona presko", "QZbXwx", "ra installationsprogrammet. Frig", "'YZ}]B ", "k?aOi]", "sjlw8", "mica ativada, recolha de telemetria e carregamento autom", "igus ja sellele v", "f5 X", "RT=n@bR", "V)R(V", "Exemplu: setup.exe / auto upgrade / Telemetry enable", "O!-X|", "QQSVW3", ":E mv", "-CWzm", "@.&R5nX`", "$,5&^", "zOEsl", "o quer que apare", "bQg)/", "Q~>?Y", "SetupHost result value: [0x%X]", "iV4k#", "(U^UUqj", "installation la cl", " ", "fz9'o'", "LP.CAB", "D{8{z", "n:8/1", "e se a", "tter alle fundne driver.inf-filer p", "LqS:5", "%wOtF", " name=\"mfc42loc.dll\"", "&`f,or", "#g1qL9", "m49&/", "jlt sikertelen telep", "r / migratealldrivers er angivet til None, vil installationsprogrammet derimod ikke migrere nogen drivere som en del af installationen. ", "Z 1R1", "!a/Ukr", "qwA*Y_", "*6h\"Tm", "^&38P", "s\"!EU", "\"6dS>", ": specific.wim ", "64s^p", "Nous avons d", "7.7G7", "h^$Oc", "Phx/A", "n2CD\\", "8?9U9b9", "\"miUx", "nCxsO+", ";j7\\n", "q$1\"a", "K)T3j2", "ZXXEU", "D}SO0", "bb6KI", "e|/[x", "[iN2#", "pv{/+", "&Jmp.n", "n ohjaimia osana asennusta. ", "orchestrer l", "{TN_bi_", "c_Xuo", "t&/>@{'y1", "l:Kq|)", "$6vr3tY", "ij 0N`", "abL-S", "0PQco*", "jumi dodieties uz Windows Update.", "D$Tfff", "]1y1", "U+la!P", "o0R+cBZ", "lda: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "rq;yc", "G#x1{ ", "/)f@u", "hren von Setup. Geben Sie Speicherplatz frei, und wiederholen Sie den Vorgang.", "QjhR@", "pKoT}%", "[3)RgbS", "-%F-)", "(XXY:z", "RedrawWindow", "a5+i/", "6sp", "es padr", "n='<*r", "@k5sye", ": / pkey ", "nost migrace> ", "l4/mL;", "s.JY{L", "i'}S}", "]J9+o", "Vorbereitung l", "c9yV-`", "8-9G9O9U9b9|9", "#}Ldn", "4:;*K", "LZ> ~'", "+8kY`", "`}|3g", "[A:4:", "HIJ", "oG6\\m", "nso-ZA", "fR\"0)", "U1lU}", "($$B>", ";i;|Ggw", "U/I5k", "DG^I'", "Djl4)", "acdXm7K4Bue", "8>MDl", "J|#&F", "zf=?N|", "x34,#B+^D", "/~[8o", "(CAl({", "xlT4;", ".?AVCButtonEx@UX@Common@ConX@@", "K S+t", "THG-R", "0V1[1", ")$KhA", "eIVe^&", "D$L9A", "0C0C04B0", "TraceData failed: Error = [0x%X]", "#x+[8w|", " je spusten", "3h%PzRc(", "!CdD;w", "rc755", "i4s'`", "gidotA Configura", "#e7yL", "dXtwb", "}WQgS", "k{%]F", "i5%(u", "$9 ]O", "yoBJc", "h'&2Al", "6].OzM", "^lm>(\\", "Pripravuje sa %d%%", "1wuPps3", "e2Gi:", "7yw0:", "wi8eu", "9LUa}>", ":gI'k", "j82|cfa,r", ":<=.T<", "E70-l", "X4VPadZ", "qEwMXR", "S9$H?7", "^_#2~", ".<'&H", "U>@@vn", "r installationen. Den h", "#=#D=", "Noteic", "ZMUP>5.", " komprimovan", "enb86qLi", "$W5&o", "QbmMk", ")b%Kw", "u2dt`", "|L^8T", "+Dk<1", "Vz\\2xJ", " name=\"msls31.dll\"", "czeniu instalacji, ale przed pierwszym zalogowaniem u", "bF=c\"bs", "JmffI", "%EKl?T", "l_Om$", "(7uLF_", "-%FAl", "Vl;;&u&#", "7\\ju_", "-?u#tKs", "L9xIs", "%_za7 ", "YN+gce", "F\\[uZ", "hVQyE", "a\\Y,9", "+\"fop4>", "=g_Y2=", "J-<][", "rQ1'K", "SUKbP", "i(X$H3", ";0'1('", ":=}ct%", "^_%Nj", "o'1:Dz7", "mC[4;", "DHZ*-P", "DV#Ksww_", "n de UX (experiencia de usuario), incluida la restauraci", "C_L&3", "(F\"A>", "Nu~^Y", "%(VJ=", "UHwF\\", "Nf6Y.", "ges, ha a friss", "qu?Dh", "Ojj\\GQ", "X:\\6D", "!qO5oi/%\"", "PJD9h", "'q*j?2 7", "G,uY:!^", "7-es]F", "&$@f/", "Akcija : daje navedeni klju", "'JgL{", "D=vW'+&\"", " instalace. ", "```@@@@@@", "2;s=;;", "5u*VE,G", "installation Windows 10 red", "X'Bk-", ";5i>l", ")nT7\"", "estiver", "yoj@j", "\"mIUi[", "Instalar", "^G!od", "YaVNK", "jmSV)", "&#D0A", "x\\?Cu", "Srs`p", "S:]'t", "j]G=Yb", "jAk,\"0G", "x5].X", "E#ue/", "fr-CI", "ciju saist", "k[~$$", "CSetupLangIniLoader::Initialize: Language %s is not supported on this OS", "u|Plf", "QNN[)9mmga.0", "!'Nu{4", "tverksproblem kan ha uppst", "Kj/-m", "G$mzD", "o migrar", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "X>!?{", "zNlII", "iA{MP", "\"CaDB", "}1;i3", "kXng+", "@i~_|2", "M70sY", "4\"4C4L4q4.656u6|6", "Iqy%^", "Setup.exe instala o actualiza Windows. Los siguientes argumentos de la l", ".;+U`O*pY_d", "S\"OiU", "8gV?\\", ":kk~}Z", "=o{f#[", "|?BTt", "S#q<[", "s>!%b", "DBoG;", " Hu}n", "M`Ba1", "\"X I", "#Rys:k", "O=hS't9", "gez. Ugyanazokkal a jogosults", "QSVWQQ", "+3'j4", "|pcU<", "%6@#", "]h^`J", "mSMxD", "\"3c[G", "b$O7[5", "<\"BDR", "6L/YMo\"", "P]%I0", "kS%", "4vUA8Wu", "3f[|8))Bo", "Bd'QwV", "]*m8d+hK", "V.%,q", "=O=p=}=", "tA?:)", "k`PTQC", "V5~)4", "zv;!V", "C,=]$", "4,40444L4\\4`4d4|4", "]UL,c@", "sH<&_", "outil.|Nous avons besoin d", "CSetupLangIniLoader::Initialize: Language Pack Root = %s", "^1hy ", ">qe~~", "pStopSetupPlatformETWSession: Failure while querying all traces. Error: 0x%08X", "{^GVi", "?L)1z", "hf;bH0D_", "!`T9Xx", "U=H=^=L", "lkeen mutta ennen ensimm", "|B>/_", "5WdI)", "m-)\\j/", "-BTf/u", ">j|~S", "X)L0K", "ll=5/D", "Arhitektura, ki ste jo izbrali, se ne ujema z va", "6/'2h,", "b6.]}", "RpTgb[D", "9F*}4b;", "hdetietov", "Parametri: All; None ", "6eNg}", "Conmutador: / installfrom ", "ib olla pooleli. Lisateabe saamiseks avage rakenduses S", "!RNvp", "69viStK+`", " katalog", "2MY1$", "~~slI_", "O1A1'", "_.3;r", "F%$btO", "\\nuXB.", "ru.4Pri sp", "hO,CY", "O3%h'@", "yw~>F", "xNat%", "m$k&r", "oA>m!", "AD2vD", "Zs6Y[L", "klemez. ", "Juriidika", " instalarea se produce dintr-o loca", "EZlPF0", ":clu$", "LS)G,|c", "$RZsXZ{", "xG| >", "w? 9d", " sakl", "CDlpTask::GetCurrentAction", "9E tD", "GetSystemDefaultUILanguage", "Zfm@&8m", "Soporte t", "Zu{)*M", "TbJpyO", "prava.IInstala", "4Hdbe", "qRu[|&&", "w|$E{<", "<$.5I", "'tuBk", "]7vtL", ">'>24\"~6", "Q2%l\"", "D$$PQ", "10E0`0", "WWEy!n:", "!\"JRA", "D_!m ", "P*d*?", "hmGZ= ", "Gy?7~", "Conmutador: / copylogs ", "}PO|n", ": / auto <", "x[VVv", "", "I)v0#", "lv-LV", "uCbGU", "gs8{}A", "Q$?~/", "Status", "T@2w@", "lyc7,V", "b'Pu -`", "cii Nastavenie.", "Q~O\\r", "&_t\"_", "Operazioni preliminari in corso", "|FRy1V>f", "ndre funktionsm", "y!br~", "IhmwN", "a_om],", "(&H2$", "]w@w&", "r-~q%", "v6&BX", "marrer votre ordinateur et essayer d", "enie chce, aby w przypadku niepowodzenia by", "y-0:#P", "dL[{:", "\\=+?B", "$2;:&", "X[/\"f", "K){Y)", "=gt43", "GR Ro)y", "installation met ", "_gov{~~Q", " RLy;", "45p;6", " ist ein benutzerdefiniertes Skript, mit dem Tasks ausgef", "Q_5Q3", "F[_M7", " de produit> ", "C44&NarV", "I`s,u]:", "cii vykonaj", "nega mesta, in najbr", "d3~)@5:2", "O", "pBxIxZxTxP", "3-4G4", "hzd/L~", "y[amf", "IW-L'ok", "7p+zK", "LgGtu", "PP?~r", "~V:<^|W", "Lou%K", ".rdata", "3J4Z4k4p4v4", "505I5O5|5", ">7jwt*", " aktualizace, vyj", "lBLJ=(ni", "w\\Xrt", " Soc<", "H\\gue<\\Z", "i*lSL", "D_j}2", "bQl<{a", "dy^c>T", "Yu Gothic UI", "PrzygotowywanieDInstalator nie mo", "'m5j|", "Installationsquellmedien", "DeleteFileEx: hardlink given to us is: %s", "9?=YII", "M_&Jt", ">We;W%", "Stikalo: / installfrom ", "BaL4*", "h{LB\"f", "/ifx#H$", "}jx{F", " !(%04", "YQ/eQ-", "StateMatch: SetupHostResult found : 0x%X", "_6gg`", "(Heq1T:,", "l'+{x", "pD#@4", "ppp@@@000", "Parametry : klucz produktu 5x5 ", "J8PWu*", "Continu", "t valmiiksi. Kun tietokone k", "x{dU?", "d9zXM", "h;ZM#", "vw>{%", "ljande standardkonfigurationer: Godk", "x:6PU", "#J1Y]K", "3:XRP6", "CDlpTask::GetIndex", "M*{\"d", "[C^hN", "Kreni ispo", "@^z(n+'", "{3vd@", "Yu+Ft',", "Full, o usu", " name=\"gdi32full.dll\"", "B)vtr%", "9@i+S.Z", "Ofcp#<", "cuter l", "0j}|NNqVv", "RtlFreeHeap", "utavat XML-versiooni ei leitud-Meediumi koondamisel k", "sRz/%", "s de completar la instalaci", "RfT{'", "\"WNj@|", " ", ":'Fpj", "_4*rCr", "*WVb&-", "a}J\\F", ".Mp5jg", "&3-eHu", "t[VW3", "J1~WS", "V>g#J", "@z`O*", "dp3Pi", "jFS>v", "\"Ge#^", "Parametrai : All; None ", "/,tpm", "Rn Dq", "N-'):se", "cijas failus direktorij", "FUj?m", "oyYT*", "k,5&UKx", ")HuQi", "A=|g!", "bLxHX", "o pode iniciar o Install.exe", "r}KkI", "0L0B0", "i1h3oL", "l0B=2", "vVnUKs", "CompareFileVersions: Couldn't get last modification time of [%s] and/or [%s]. GLE = %u", "itumist saab muuta j", "'2vl;", "Technik wykonuj", "*ouYu", "48Ox0[", "^z@zD", "dZfeQV", "~IuV(", "x`X:K", "\"TCl@", "RF;y ", "}dn?!", "2,2I2`2", "4$`'Xa", "jg=_>", "900/W", "^,i=E", "Windows 10 Setup doesn", "U%Se9", "/{TNq*K", ":pB~|@", "aNC#E", "7z\"^dh", "7A7H7X7v7", "wm)0a", "YIpnu", "B@x'F", ":UQ@'U", "8QLX9", "l 3di$", "Schalter: / copylogs ", "veleteket (friss", "B%#Jg,", "%7xXj", "rnek: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "n recopilar", "}yK*|e", "ZSI[m", "'zCz1", "Radnja: Quiet zastavica spre", "Exemple : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "E2iE}", "adanie, s", "U|h&Y", "[im+Uo", "y>eM-Z", "jl, amely a telep", "29vp-", "Ir]H*)", "*_<", ";**F# EP", ";kOA)", "9RQ\"#S", "pDz,ag", "?amKm", "Kv.z5b", "?aW9vZB", "YcCef", "cDMEv%", "tenje prema scenariju ", "", "XKzpi", "!GTvj;", "Z&~HX", " OOBE) etapi. J", "{3L,*", ":6:!", "lohy. K jeho spu", "s usar la versi", "Ph\\K@", "d%e_e", "mhdt?m", "ste gang pc", "OeH79\"", "HPOX >", "0Wwf~", "d!o@C", " protokoly", "9*jqT", "P9:1^", "uc{J\\k", "ajo uporabni", "?W!S#*d", "$TKxa", "787E7q7", "H/l:?6", "ds5de", "&.Q1N", "n;wIW", "Installazione di Windows 10", "/ PBRUpdate is ingesteld op Enable, wordt de PBR-partitie gemaakt of bijgewerkt. Als / PBRUpdate is ingesteld op Disable, wordt de PBR-partitie niet gemaakt of bijgewerkt", "-R`6%", "*e_%d", "CS|=_=", "Lrj!>", "(v]NW", ";dOrW", "Eyb2<", "`<(K@", "\\JbjB", "P't4-", ": acest comutator ar trebui utilizat doar la testare ", "#HC.4", "m3mzd-=b", "a-e{+", "7eL~0", "SYq:)", "Ib~", "*9'F]", "oB-:#", "`qz^T", "}o]>\"", "amo XML versiju9Veicot datu nes", "ho riadka", "y}VkA&9G", " : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "W]mVf", "Ye.L\"", "iT3O]", "(d8FQ", "N!AP=", "S=/7\\", "q}UI ", "kR8bKT)", "i@H9\\>", " vai t", "C@ftN", "9MBn.", "z olduktan ve bilgisayar ", "u?pc3", "&Nazad", "\"z|./\\", "1ZAo3", "#$Qx)", "xBz_O", "=I1 B", "{lC", "eP'?G", "wX#-6a&", "C-,@c", "qx>MW", "9A`nv", "vXJ|W", "tres : Full ; None ", "A{5KH", "(7", "metro : / migratealldrivers G>P>", ".+t.vA", "j]Xc,u", "x7G iu", "rMU`r", "V*9fV", "&NZ39<", "Ku+o _", "TZml6", "0~0_0o0", "#f;%iCi", "Jp03u", "d5W~ ", "o : Fornece a chave de produto especificada ", "d2D9ol", "0DEhW", "GH'?1", "NCncP\"", "_vIGI", ":H=$Rz", "windlp.state-old.xml", "H\"_Dy{;%", "@!L??", "p]GukY", "E!vyR*", "(yTmR", "jZXM&", "bYV", "&s]c_", "s", "CoO)_", "dE8%w", "=BM_u", "D$,_^[3", "^d|N.", "6k^U\\k", "|b91P", "xo<5B", "R/3y9", "K;$wN", "979r9", "\"*N#:", "Anahtar: / showoobe ", "[Vqf!", "`kGct", "DI'p+", "en Sie das Tool, starten Sie den PC neu, und f", "\"=23p", "tg$+O", "209%e", "G]N?\"", "gl&%[", "|A.Q+zk", "D(&LH", "ts'vsW", "eO/l|/", "-J84WrP'L:[", "xzk|5", "xi,Sn", "k~4+Ss", "x@#P}", "h3kA~", "5L?_U7", "%Gp6u", "c2bREY", "r2rkvq", "Ha%\"C", "QQONkB", "-!hx%", ".Cqes", "8+8@8F8a8g8x8", "^o[T^4", "8lHBbR", "inierius gali rinkti ", "XPh\"i", "_b}XY", "ehI\"L0APB", "&[Z.\"1", "ZCB=T", "A telep", "?hL|U", "kaz setup.exe /?.", "57]>zV", "h|\"^a", "V};jJ)", "\\R./W", "TI7r@", "CWgPLx", "1Mc$j", "Y0z{)", "~K9N ", "N@Txv", "nfU= ", "3", "ZgQqP", "6'\\vh", "bhjUn", "%\\fRo", "hN3", "ysbJ&", "`I'fP", "MSj:d", "ht!/ ", "StRlv\"", "KERNEL32.dll", ", telemetrian ker", "PBb#p", ";wwgw", "o: especifica se a instala", "Uhn[o", "xg=Nn", ".!0*Y", "klad: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "gs*p5K]e5", "DlpTask: Transferring Files...", "Y lWIj", "/F~'z", "lTX$k", "jS8sa", "n de las actualizaciones din", "b)Si-Y,`", "=7>W>|>", "X7hDp", "z@|TlE", "Preparaci", "pZ.Hi", "7U.Aa", "lRA{'", "!^1GX-", "ahG0N", "Provjera kompatibilnosti", "IKtR3", "CopyFileExW", "lyk\\E", "4f|]R", "#C4 G%X", "\\(l=ye", "!R(JI!`x", "nika na dysk twardy", "mPg$V,_r", "u94St", ";7z_V", "PS%vc", "|c_L~;", "as datorus no sist", "2Z]AjB8", "<%s>", "VWXE7", " umiestnenie na in", "//va|", "wx7ed{", "-{r:2r", "k=IYC", " ", "\">AO|", "tor nebude migrova", " specific.wim ", "8vN~lN.", "]LAH\"", "Exempel: setup.exe / auto upgrade / quiet", "e tam y", "XU/] D", "s argument", "b", ":gwU&", "g8%:K", "[z.b(-", "D)j;h9#", "$7xKo", "=jF}FB}~", "p>EI?", "\\V4F-", "b' Bn", "t#.Oz|H", "J-\"E]~", "eli pa, da kon", "Exemplu: setup.exe / auto upgrade / copylogs \\PartajarePersonal", "Y}7bWr", "uje po ne", "`*DhnJ", "CoM-66R", "Valmistellaan asennusta ", ",5rG_", "vw_#.r", "te instalarea Windows 10", "M>B~1", "JyS4%PM", "_uT^'T", "]`Z-5@", "o. Se voc", "q}x2F:", "exploitation de bas niveau, le programme d", "!rl/=", "3azO%", "anas programma rekurs", "(t;)UT", "0!7(m", "UTF-8", "qU'\\l", "vGW~x0", "!N:4A", " deja.gAceast", "|l yV", "Azione: in caso di errore, il programma di installazione copier", "gVl!(;", " Microsoft Corporation. Med enerett.", "uVgYw", "qx2xW", "#}>.}", "w.Qv+g", "cution.", "pqS,*", "u2U}C", "5&6.666>6F6", "vG{8P`", "IDHG*", "T~~VW", "gUs(\"-[7", "/nnJ9]x", "7!F3-", "k*P?m", "f5%Z7", "8H9z9", "1kf0c,", "Accept", "sv-SE", "Bz:O?", "=,=D=\\=x=", "[Z_tYY", "ln.j}(", "YI^\"/", "G)k7l", "q6xny", "4_$CH", "z_&#ja", "e system jest instalowany z lokalizacji sieciowej, dlatego mog", "|ixb/B,", "=!Hy(\"", "Z(^-h", "jlB2tS", "mha>u{", "E]\\@oN", "M\\l.G", "Jv=<}", "CtT+Q", "ad: setup.exe / auto upgrade DynamicUpdate disable", "jHx-U", "kb#y9", "uktyx", "gQeDp/", "8$808P8\\8|8", ">3RZW", "p6V~R", "4MVFs", "E]SJ_", "l1ex)ve", "kV;K5", "Z|Y'=y", "Vol&tooien", ")3?w1", "E[Ymv", "uh*5S", "88m.|", "sBk=n", "sHZX?", "BPw", "*-'QVQ9", "%}e26", " dYQw", "J~kna*G", "}5?\">H", "T$(+T$ +D$", ";aeJg", "-besturingssysteem", "%E\"2Q", "@apmY", " name=\"wow64cpu.dll\"", ")N 4m{u", "/am2U_", "cijas (atjaunin", " ", " consigliabile usare questa opzione solo per scopi di testing e in ambienti di testing. Non usarla in produzione. ", "'%I;D", "IsValidLocale", "bY-u[", "XM]nG", "4TzB~", "8r[|x", "&25#p", "essayez l", "'3y7]", "]_wZ7", "Ejemplo: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "dg.mr", "]{xTE", "lo do instalacije koja je nai", "jet. Pr", "Z(t`U", "mu Windows 10 neakceptuje argumenty pr", "8GcNMv)", " pentru instalare / files ", "<&}~J", "r+\"u2", "*rbw/", "t`#``", "%#{~c", "in yerel doya yolu veya a", "6n- ?", "Z>T?zK", "sfh<}", "o$|)?", "kenlerini almaz. Komut ", "wY!!&f^", "aCStc", "*7$r&9", "^Z;hu", "JQibr", "j\\Xf+DO", "]W6]D\"", "{?e-h", "q*MyU{e%", "r kommandot k", "\"d-i3*", "4GbqKI", " executado com os mesmos privil", "4o|L?", "#mIR|", "Mh!dA", "xj[\"$", "RYD;4", "|>>qp\"6W", "F~nS}l", "z tAU", "P}_g?", "r1N%.", "!3Dm0", "YNV[I", "{0pzl", "\\*].>bV", "QuadwordProperty", "I`;wf", "Gdp~d", ": / auto A4", ",S4+YF", "?}czj", "%zJ:]", "N/_HL(", "6`Gz.", "pw\\-F", "leri ge", "2|m\"4m", "LockResource", "hMsZx^r", "mCCoh", "d/\\hD", "0?Y$A0", "VNCo`^", "x9L'..i", "$D", "I48mx1O", "'&%6$&", "_except_handler4_common", "ze:.d", "eq+~Y", "-s#-s", "u(UIw%", "lPAJW;", ":1[]3", "2_~oU", "E(]rw", "/Eula", "ke All, a telep", "`Ff2p:", "R-\\^g", "edpexG", "^5]qA", "`}qMO", "~otw|", "TM.Us5T", "_)Q+y", "':aKJi", "a:VJiJ", "HpY|Nk{}", "vFI{\\", "mg-", "sV;t!", "nEr)\\", "d#xL*", "tH?mK4", "_}*05", "Commutateur : / pkey Cancel request returned 0x%X", "kIz3g", "gof&x", "C/piIj", "velet: Ha a / migratealldrivers ", "_`W,%Zb", "?y<,8$0", "p?0Ys", "B6'@(", "d5KmW", "BYa_Ey)", "@JEVW}", "Compatibilitate", "=|~dR", "\\a@mU#", ":Am9*", "j---.7", "GE!DC9 (", "';ug=,", "sr-SP-Latn", "Reporne", "7-8M8Z8", "_OgXX=", "]b{9[", "|/>6_}", "rba, ", "kalun 64-bittist", "3,H#J", "aY`::", "5EI:J*I", "6@I$R", "ud`(?", "Zh%zv", "cznik / showoobe ma ustawiony parametr None, tryb OOBE jest pomijany, a sk", "GW?Kp", "<)>0>>>E>o>u>", "sekormA telep", "G*{^x", " basert bruk", "?K?b?", "C-n!2", "+0Q(jGs7=>", "Dgg%g", "Ta)p(", "UZB[6", "|[|=w", "h!)D_", "PNy2D", "xcFb3", ">TU)M", "\"a1fS", "9H:S:o:~:", "D8$/?+", "14^;R", "mJEH]S{", "VI|Ev", ",yQVy", "T]4Jq", "Rd)[_T*", "skcgCbh", "/Prompt Defer %s", "PXniG", "6/Qh&", ">-?\\?", "gers wird Windows 10 Setup automatisch neu gestartet.;Die erforderliche XML-Version konnte nicht gefunden werden.8Fehler beim Bereitstellen der Medien auf der Festplatte.pSetup konnte nicht korrekt gestartet werden. Starten Sie den PC neu, und f", "(:U=j", ">_5@f", "l)G2K", "cessitant l", "Q?u3{", "r7Gis", "^+CoI", "{S)VP", "ekLB&", "nBHQ=", "|,lk^", ".`xDS", "Hive file %s is in use; will attempt retries to ensure it is unloaded.", ",`Q\"9", "0^\\m3", "xN(k2", "G:*cL", " registros compactados para o local especificado. Observe que o", "3}Xh?", "s vai izveidos PBR nodal", "[\\6^]", "N;/yOW", "TEMri", "FgD ", "|mE9:zf", "metro : / noreboot ", "pe$byi", "wpz7t", "Sw9=O", "M2E)C", "bUn],", "M*2}'", "-THnW", "O9*jD", "T0}Mv", " ^8&s", "\"(6O]na", "C\\=U3", ")`}Le5)", "kC+-7_", "e#9S&", "%Ke.0", ">QI21", "K^]Vj", "Kompatibilitet", " ?uD6KC", "0AImfP", "3 383d3", "a9GX(", "Parameters : Local file path or network path to a specific.wim ", "Pavyzdys: setup.exe / auto upgrade / PBRupdate disable", " versijos naujinim", "MZ[L0xW", "27~@oEW", "wT2mV", "36d.B", "+-b'S", "w..89", " definido como Full, o utilizador final tem de preencher interativamente o OOBE. Quando / showoobe ", "9lOHTyF", "c=j-O", "U&*8Z", "T?P\\Y)v", "s{4zK", "o`kFB", "-aGY\\", "Durch ", " starszej wersji interfejsu u", "yll(|", "Q^>$_", "&Annuller", "", "b\"8Lg3", "6)f\"K", "bQ?'R", "ppp@@@", " None migreras inte drivrutiner som del av installationen. ", "gi[ON3", ";5/4/k", "Dg5cOOt", "=0fsr`", "n XML requeridaAError de almacenamiento intermedio de los medios en el disco duro", "sH7]z", "7r4k&#yp", "28h\"O", "DOWF\\u", "9iwDY", "U3vWE", "j6jg%3", "kok-IN", ":!;(;E;L;", "^C}==?", "DOCTYPE", "GNz^&", "5{ Gu", "x??65", "RlxoJ", "'3VI^", "%\\z(]Gqb", "'.?.w", ".Pr19V", "-vg3t", "'Installatie van Windows 10 voorbereiden", "\"s[]YS", "Switch: / auto ", "|dpEVp", "s#xE??", "0LkhNc", "WZco_7", "? ?$?(?,?0?4?H?L?P?T?X?l?p?t?x?|?", "fj_z0", "oen.>", " activit", "=R_TF", "AKUtM", "metros : Full; None ", "p%P>]", ">v*^p", "?B$/u", "U>(\"(xV", ":E<'0vYq", "FDICopy", ":,C+?", "QTeUK", "16[Wz", "E$>s)\\", "yF~#Q", "'];n% ", "0$010U0h0", "Beispiel: setup.exe / auto upgrade / migratealldrivers none", "ZOko2", "y~R", "}Xr7I", " *R#.", "ik installifailid j", "L.b6T", "!_Aj!\"", "SetupHost result missing... remapping [0x%x] to MOSETUP_E_COMPAT_TERMINATE.", "sakor. Z", "M9V~o*R", "%cJMgQ", "zvvs(", "VbVh<", "n$iDDz", "c\"y(-", "en-ZW", "OAXD0", "+3\\-Z", ":)zE}", "C^d32J", "9.boxu", "}DKj9\"", "^lw{K|", ".%UQp", "SetupPrep.exe", "{3}2Z", "Tnv2@'", "k@'D!2", "s telemetrijas apkopo", "%+5[U", "it1C*", "9LDNe%0", "(IIIZ2", "v486iy", "MQ.W-Pi", "A'Wjg'", "w^{XX", "c64zyVa", "htng2", "fs?z+", "pzu$X", "Te^nW", "jien k", "K~;QT~", "LxpD]", ">K=@c", "r til OOBE: ", "+divl", "Box Magic...", ">QY8O:", ")wBKO}", ",`\"' \"03vB", "t match your PC. For example, if your PC is running the 64-bit version of Windows, you need to use the 64-bit version of the tool. Try running the tool again and make sure you select the correct architecture.\"There was a problem starting SetupiThere was a problem starting Setup. Close the tool, restart your PC, and then try running the tool again.UWe need at least 350 MB of space to run setup. Free up some space and then try again.jIf you install this version of Windows 10, you won't be able to go back to %1!s!. Do you want to continue?", "O_?{N4", "Z1Ei3V'(", "{9'PI", "2QC<^", "Tidf3", "T$S4e", " informace najdete u polo", "Q5W=S", "Microsoft JhengHei", "&#eC4", "Transfer thread has exited.", "yt/#Os", "2k(>$", "mu na po", "None, a instala", "Ir`Db", "4=$!t.Z8u", "AJ4#RO", "cOW<&~", ",k2_-", "pr,t`", "Service Pack 3 ", ">%>3>:>G>N>V>]>", "mx/2'\"", "mw_|c", "L3_ON", "feYYH", "cs-CZ", "(|T,&", "[$IZI(", "6k5c[", "J>>VK", "/Z,=!V", "U#[j(", "&Otka", "ljivost", "SY8 G", ">&/sI", "D+1/]", "~8{rW", "&_*k4n", "velet: A telep", "[]3ol&;", "[<;4\\s", "(KkhS", "h_~VW", "qLHBK", ";i%<^2(", "ania instalacji systemu Windows s", "4ck,1", "(`o:;;", "7jrmr", "Anahtar: / copylogs ", "bbwh\\", "d{r~\\", "x%2p;e!", "N9Y-N", "\\wW$C", "utilisation", "EAt*(*o", "\\yH,d", "jHj,`", "S736@", "e. Veuillez red", "q2^ ", "ci pr", "_%1yT", "PIg]P", "BuN+f", "~GRrn", "CreateProcessWithTokenInSession failed! Error = 0x%X", "X>Mec", "XAJ(w", "lonej lokalizacji. Zostan", " vai UNC t", "+FEG!ZP", "L2z{", "#9@VR", "rG8?m", "({;k3", "2(2H2x2", ".?AVCNoTrackObject@@", "ncC&(", "[BqVN", "<6y4xk", "charger", "OUCyx", "Eksempel: setup.exe / auto upgrade / showoobe full", "ZyipS", "FLm)Lm", "#1.IW", "!U>9B", "=+x{q", "CreateTask: Error serializing state! [0x%x]", ".M@$W3", "Exempel: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "n haz", "OHV^'V", "`tm['O`", ", ak u", "pppPPP", "9[577", "]n\\7b", "6TgE[0zjn", "i9]]{", "lmVs-", "OZV}7Q", "(JHj9", "GetCurrentThreadId", "5$G/]", "h8\\Lgn4", ";!<\\<", "jJW{c", "Lt.N_/", " possibile usare gli argomenti della riga di comando seguenti per modificare il comportamento dell'installazione di Windows.", "wlAY?", "}9v6v", "g>\\setupcomplete.cmd ", "Cz|@;", "HR|cOba", "aF;`&)", "Z#{EQ", "XIl@F", "4W~NCv", "_Bf|v", "xZRvA", "ELEMENT", "lmayacak. Bilgisayar daha sonra yeniden ba", "*px\\LX", "Wnf;}s", "OHqy;Y", "f5_+DD8S", "-&&;`", "-m=oF", "XxN+M", ".?AVCCmdTarget@@", "BUCzI", "q]G~E", "y%Sx]", "v}6kw", " %E)M", "dd OOBE: ", "QRW$j#", "4KQF/", " _1YF", "+*ELE", "&Next", "h[)O^D", "Koit(", "t:ol[O", "|NiF0", "jumu. ", "RS%pz{", "#!:G1", ".[V6zk", "5U7w;h", "8Q`=AmO\"", "Fhon9", "0;~u0", "avons pas pu d", "j=^9*", "@m5Cif", "xc/}~", "dw9;X", "Cr<[2", "(kT5j", "CktkU", "7PV^6~By", "aF@T0y", "Yw7m}", " nenhum driver como parte da instala", "'`U@)n", "S-|dj", "V+--)1>{", "&napoi", ".inf ", "-jd+bj", "ov pre pr", "vk_k{", "2[2s2", "fil5+", "YtXIU}", "Fs(_U", "1bK=0a", "\"sJMF:", "\\X_R>", "6#626b6", "rminos de licencia, habilitaci", "<0}O+", "Exemplo: setup.exe / auto upgrade DynamicUpdate disable", "=Qm0^#) ", "%`']&", "@|;|P", "ranka", "vcJ0A", "n,4~0eJ", "OF ?7", "r~amP", "E|Pp{p", "]NR{b", " 2gHz", "Eg\\tB#LfT", "$vreY", ".?AUIUnknown@@", ":g*[G", "%s: Clearing PreDownload mode...", "N*USz", "! ", "343c3", "<`|lZs4", "zYd^y", "sr-Cyrl-BA", "r)YSkK", "C33mT", "Tuj'8", "rUfvb", "zC3H^", "A]a@z", "*yMnGE", ",w|0 ", "9:,|O", "h)%z<-", "R2nt\\*", "ddaB0?|", " program", "D$$Pj", "gZvL#^", "yD>4G", "N*S<^", "),BGO", "68W_{h", "`!66v", "Voorbeeld: setup.exe / auto upgrade / showoobe full", "&-S5;eJZ", "kazov", "4c|cu", "Yn^Jx", "[pam}\\bT!", ": / Postrollback ", "e se ", "Jw~1e", "T#;;9", "r] Qt", " stand", "QF=JL", ": quiet ", "!8b8#", "$%3w ", "oa{3|", "}kG8U", "F*WJW", "gB7]:", "BB_Kg", "rankio versij", "=-qQ6:", "`3Q.g", "6rD 8", "#Are you sure that you want to quit?", "A9dd'", " technik zodpovedn", "4G^#o", " do wersji %1!s!. Czy chcesz kontynuowa", "v^j7I", "Yi4(k", "0MX,<", "FormatMessageW", "-MExqG", "`E={J", "jExjmN", "ox:]?", "8)E6(,", "GetModuleHandleW", "}8i*Z", "5;\"Yg+", "S8@&,", "\"):0DL", "%)\"m/", "Lt[H1", "gy>|+?", "JJJ{7", ")EVmE", "[\"?MW", "IawVl)", "bK5dO", "!yGP2", "|@xLH|d\\", "_E!1B!1", "2HYJde", "ntxyy", ";9e=(", "XV^}?_", "jc}g%", "`Vh^$", " oper", "vF?w?", ".IbK?", "``~.f?", "hVhOK", "zJ[=0XZ", "Exemple : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "Handling: Automatisere installasjon med overf", "SiteLink%Keresse fel a k", "~.le3", "Vy", ";|VY:", "*s;4+>", "FileDescription", "CK0w8", "%qwOP", "f9XBt", "Djn;@}2", "3`C,2", "&Dokon", "Nz((l", "0,000H0L0T0X0l0p0t0", "+dZ:>.", "eb`*ieuloZ", "QhD/A", " sen j", "*SgnFu", " niveau avec un m", "9/G>1", ".Og7R", "installation ne mettra pas ", "EyVEy", "Df,'>", "Setup.exe installe ou met ", " is done as a defence-in-depth approach to closing a known UAC", "A\"rI:\"l", "cD,9N", "0S0h0L0", "=gbg8", "eo6Jq", "=Y,5:@", "*{<^tS", "l-E}o", "switch mag alleen worden gebruikt bij testen en in een testomgeving. Gebruik de switch nooit in een werkomgeving. ", "Km.)b", "!w>R*", " ", "c$[+-", "lama bilgilerini toplamak isteyebilir.", "unar dospe do OOBE : ", "v[:m)", "Wp1%-f", " u[VM", "Y'(E)", "/Console %s", "D^,>|", "MOCQHr,g", "+> ^r", "Zb-5x~>", "C _A_", "\\Za7Dr", "yylhL", "\"OlU[", "{R|}w{k(", "Akcija : Zastavica ti", "\\;;)a", "*#Kp ", "j04X@b", "f4y,U", "N#>g!D0", "]21_^", " eJ(}", "*d=yM2", "CDlpTask::ExecuteTransfer", "n: cuando / Telemetry se establezca en Enable, la instalaci", "m3_/>", "EPrX6=/", "Buh_[S", "SOGXK", "8*ECq@", ":=:h:", "]R{Uw", "Akcija : navodi ho", "xX<*6", "Z23*?", "GlobalLock", "sq}$e", "*-1%V~", "F'cq;", "^qp@yPZu", "Parameter: / showoobe ", "`)4Z9l", "_P&!<3W", "gF/gF", "25L76", "&Indietro", "GetAce", "Iwz}2", "7`2:s", ";Ljd&P", "gZ>4D", "09cShW", "('t#/a", "{ ,*r", "NdjYN", "I}?3i", "tA)e83", " overf", "jv&{+", ":Dm?4", "aJwUfq", "riet atpaka", "D$@ )@", "y\"NjZ", "=cGJfF", "t;:'[{", "FXSZ ", "``<_f|", "N{l#WP$", "UninstallActive", "R+ *j", "k~O\\w", ")ODV>B", "Q#f:*", "595S5`5", "TaskCount", "?V++f", "jwBzye", "4~X\"+q^B:?", "#^?.y", "ssig, Windows-Willkommensseite wird ", "NtW,M", "uJVlG[", "0$PDg", "yor+Kurulum Install.exe program", "$;yMt?0", "33#A#", "fTwTK", "ba{KN", "j&", "X`bavl", "PFQE^U", "O~-cO", ",QR7M", "XC7", "h,V&]", "]ibw'", "/+vo[Q^gy", "B#[F", "^:US+gn", "&_.8r?", "c=fY*Y", "d_`bs9X", "Parametrit: Upgrade; DataOnly; Clean ", "cie vyvolal skript setuprollback.cmd: ", "2R$zgg", "bory do adres", "un 64-bit s", "ux0,|E", "jCR1a", "PPPPV", "wzki+1", "G~o l", "|#Fy!", "Veiksmas: pateikia s", "7AK?d", "Kk?1u", "K!-d9=", "J?*<|", "-q(3.M`3", "..CZu", "mcugg", "@o8ag0", "1k&seI", "@23\\]m", "p65G#N", "<37t+)", "s[%,\\", "|>3h\\", "nWJ |", "|~r1`", "'C+Scg", "OBK;8", "M(zX'", "~M)_g]S", "7T~F\\-", "Zb}mmD", "c%gHE~v)j", "%7#P^3=", "ajte ponovno.eAko instalirate ovu verziju sustava Windows 10, ne", "SgqW0f0O0`0U0D0:", "f,r:?", "5gKBQR", "~@&~t]", ">J>d>q>", " : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "Commutateur: / migratealldrivers O", "9D}Bi", "aly?%", "412M]I", "o|VMM", "tgWHy", "u& t>S", "nyt asennusohjelman paikallisesta hakemistosta, kopioi kaikki asennustiedostot hakemistoon uudelleen ja k", "@uhOF", ">uw?R", "wwwwwwwwwwwwwwwwp", "/PreDownload %s", "liti: / copylogs ", "0d1v1", "6H7O7", "SJ{h_", "64]ui", "(DWet", "0-Nk0i0n0", "ghB$Z*7<", "|q}gQ", "V;4^w", "tllN$", "v1\"UY", "'OOA?", "torul", "0'040R0s0", "~P/82", "Lys,E", "7mK-6", "cznie wykonali czynno", "jot,*_", ",]5,2", "~x*ZW", "dwxtm\\k", "Y+0Y[", "bs-Cyrl-BA", "z7M&h", "lda: setup.exe / auto clean / installfrom d : \\saj", "2k#zj", "-P\"@G%-", "ad: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "ene datoteke. Ova komanda se pokre", "A`7$@", "/v_O7k", "velet: Ha a telep", "j[]0p", "@ U:|", "tC7vn", "%s, DLPLOG: [0x%X] [%s] [%s]", " da pr", "8q:/T", "tzm-Latn-DZ", "S3SW4", "tenia zmien pou", "y4/.j#", "OTAhr", "|6(O0", "8!M.0", "^_}}>", "Akcja: Przekazuje okre", ",E-1e", "tf8]x", "8m\\2n", "OHC^p[", "^g}ej", "4ZjBC", "~A15p", "BQhb%", "t.2>e,", "suviibal oma installikandja juurkaustas \"setup.exe /?\".", "k\\y-N", "=xJxj&", "P$bL)/", "-Dy7#", "@oruv", "pXa@(", "Xii$a", "j.U+{", "M}!\"L", "\\'iY6", "a>p\\^b", ")bNdi", "v*4wEq", "?7}E+X}", " la partizione PBR. Al contrario, se / PBRUpdate ", " kopiere til plasseringer som krever brukertillatelser ", "GQq1I", "/XTtN", "0%3>=", "05lKX", "w~~xp", "rVY`*", "o<(Vxx", "E.#8i", " %1!s!(", "blV|D", "0~0Y0", "m\"^QXdo", "@~yTV;", "m&}_K", "m8Z$k", "U-jU+]", "#rJ:!H(", "utim, kada je / Telemetry postavljena na ", "g+Qb7", "e}jS;", "e5Lme", "ptG!Dl", "'QJ`'~,4", " Microsoft Corporation. Tous droits r", "[^s.x", "]H)B6WE", "P4)ufP", "Nous n", "appeller le script setuprollback.cmd apr", "Qux^yZg", "TJ)GhG6z", "<\"T5S", ">\"1Fj4", "2[|#G^", "NMRk0", "Pvh4Q", "matStart", "Ow2-~1", "bZ]@nF", "p.\"={", "Eljjb", "0=0l0", "-AbiOwn", "chte die PCs einer Abteilung ", "2.7e;", "\\6/)A?", "rer installationsprogrammet ikke installationsrelateret telemetri. ", "c@J;1*", " los registros comprimidos en la ubicaci", ":&*ui", "1y6;p", "EGLhv", "Z[5;(%W", "?M!hQ", "ar-TN", "XLe programme d", " cu privilegii de sistem. ", "nl-NL", "X>T=B", "YtE-h", "aW=<^", "q?c7+", "ti vagy friss", "{PWlUu", "h3!^!F", "cznik: / quiet ", "=Z2~~", "YI3FS0G", "soben", "Js80[E", "L`f65", "1koYj", "s$)7%", "SYSTEM\\CurrentControlSet\\Control\\MiniNt", "Qh4/A", "Actie: wanneer / migratealldrivers is ingesteld op", "nd / Telemetry este setat la Enable, instalarea va colecta ", "o2)8#", "K.wd=", "Fuc-w", "Xa`'k", "d~o^4", "rnek : setup.exe / auto upgrade / Telemetry enable", "X96^*", "&NB%%A_", "InitializeSecurityDescriptor", "t\\GAx", "&lZheg", ";.{HUw<", "n5/2j", "5Z+a]x", "{4YRp|<", "6;k0hz9", "121=1]1r1", "Xe-r@J", "W\\43v", "?7YyV", "a y carga voluntaria, se saltar", "Ir6RP", "]8Nm~", "Rkokk", "FiHY;Q^X", "p^!Pr", ",gS_k0B}", "3Ayb/", "V\\i5.", "=@~Kl:<]", "{?~]>7D", "%65S]", "pL/\"%", "O-MK|", "Ejemplo: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "Valitsin: / copylogs ", "5$505<5H5T5`5l5x5", "inde, y", "^OZ@e", "ba None, OOBE tiek izlaista, un komponentiem ir iestat", "L$T_^[3", "$?!Qz", "5cxqv", "D?kn>", "cU/IWr^", "0}{e/}", "]:9mj", "lqFg(Z", "Rollback command returned: [0x%X]", "8rG/~", "I8Cc*|", "T`~", "~!sE|", "n. Asimismo, la instalaci", "rer 64-bit versionen af Windows, skal du bruge 64-bit versionen af v", "fg0M0~0Y0", ">4Hbz", ".a~lH", "L~S)l", "r':{TEH", "l.Xm+", "rgutee ", " grund av saknade installationsfiler. Om du tidigare startade installationsprogrammet fr", "+4J'Qv", "bMF%0", "ke None, a kezd", "E!~!l", ",hQB4r", "wURHhw~;\\", ";8'WQQAK", "@p3>^l|\\B", "R\"%SYT6", "BmiP*Ql+", "u993u5", "[|TI7", "Kontroller kompatibilitet", "dpGYK", " leurs param", "c tai var neb", "e[z{/{", "@:As.", "\"+(6I", " festgelegt ist, versucht Setup, alle Treiber im Rahmen der Installation zu migrieren. Wenn", "Exemple : setup.exe / auto upgrade DynamicUpdate disable", "FSkL0", "y.'[wT", "1lWG8", "ddfUyt<=&+", "x-Zu^", "6;7.NZ", "_vsnwprintf", "p0m(K", " den har kanskje ikke tillatelse til ", "Pko_@}", "InstallMode", " Fdu*", "{/,++", "m'53A", "Exemplu: setup.exe / auto upgrade", "7bgm[t", "vede XML-version blev ikke fundet6Fejl under midlertidig lagring af mediet p", "cja d", ")'WN5", "nZyp'|]w?", "bxjq~", "I]G8I\"", "2XIUv", "%s;%s", "zvem setupcomplete.cmd ", "4.5k5", "Found ESD target file: [%s]", "N8qja", "Azione: specifica se il programma di installazione eseguir", "HutZ|*", "AFEKB", " gjennom opplevelsen ved f", "PostMessageW", "RtlExpandEnvironmentStrings", "hGZ1;", "8Bw1I", "Ix'o\"mbQ\\", "lOr9N", "j{^a\"", "&lkgz", "tFriss", "\"}J#-fW", "<^72t-", "avooy<", "i&Yu!k", "g!m2G)", "F&5rP", "VYm|g", "=@.%a", "V\\}~@", "k/P", "T`=p+P", "edchoz", "v5.F-", "Setup gesammelt und hochgeladen. Wenn ", "Hhd_L", ".9/QX#i/", "r{a9\"", "B%?Ep$t", "yg$dj", "1L.C6", "jumu mekl", "1brp>aE", "0y:.m", "IG6PPP", "yT.\\R", ",>+vm", "ovom adres", "}D`Tv", "n de t", "A1W+;", "c\\#s/\\", "Ofsi?", "installation, mais avant la premi", "zt>dv", ": / PBRUpdate ", ";1~E&", "o9;L}", "{G07%", "@WT}n", "\\>Lgh", "$Oqvi", " zadan", "6l]!y", "+R(:K", "CDlpManager::DeleteStringPropertyByIndex", "M>x1; ", "i64o[", "k_uN'ecjT", "m?1v_", "#D{,\\", "Y fLW|", "ba: uzst", "fZZv5j", "quc-Latn-GT", "IXy!7", "}x#(Z", "Exemplo: setup.exe / auto upgrade", "VDR9G", "fS|Oq", "h}>y\\", "Toiminto: kun valitsimen / Telemetry asetus on Enable, asennusohjelma ker", "`Ev@>", "CmdLine contains setupplatform.exe Waiting for system-context rollback to start...", ",h//[", "T4W:}J", ";p5nP", "210303182921Z0t1", "Kompatibilita", "`!26~>=", ":>lnaXm", "dk$3R", "\\u@Mf", "DJ)HN8", "kudXX0", "oM@Wq", "5;OB^", "hZO<5=", "sPc;d", "JA*Tgr", "+AU=L", "Mvy^B", "nI><3", "M8jyr4", "?V`^U", "{o?hi", "+:EOr", "5#!%G&", ": / showoobe ", "wUp7u", "AIl8\"", "n!rry", "`UWK&yR", "[F_>|", "N}9?q", "rlerini ", "+/ ONU", "7Y'Q)*UC", "*H+,i=U", "&6&o{", "KCu|.", "&/y,k+k1R", "7+5#Z", "Pcw{N", "o copiar", "GetProcAddress", "l]4&_", "Switch : / copylogs ", "Exemple : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "iM?_N", "@4PgXZ", ".ngr4)", ",{KM@", "p1L+cX", "n PBR. Por el contrario, cuando / PBRUpdate se establezca en Disable, la instalaci", "n de la instalaci", "u9rJ>", "Xlwo\\", "N/<>`.", "t match your PC", "rca telemetria legat", "r/\\$2T", "CDialogEx", "%We6F", "o8* /", "X~L?N'=", "V;Dp;", "=cLf !#", "}gySxu", "|IFYl", "sV~jCc", "tijek", "mc!79n", "Prepare thread has exited.", "5?#~8", "Switch: / PBRUpdate ", "\\x'J9", ")?{:^", "FtiK8v", "W93uH3", ",gyC2T", "tirmesi s", "B!&=Y", "]FZqe", "/Update %s", "smUp|", "Nie mo", "h%G<>!F", "_*k/6B", "+Srcm", "@wRx2B", "DV1-RM", "bf,cU$V", "r parametern kr", "n puuttuvien asennustiedostojen vuoksi. Jos olet aiemmin k", "S;8Zn", "su datoram. Piem", "-E`TE", "ZDl'3}F", "q7%X}", "!N6#BJQ]r", "?DWc3c", "CDlpTask::ExecuteActions", "h+jiP", "me8oM", "JVVVS", "(QLsz", "!gPdpg", "Wz*?>", "IuGz", "D7GN8", "5:/q4", "Mh?}8", "installation collecte et charge la t", "oeFe-", "@3= Wsh", "ZAt#R+", " 0O|D", "8*d/d?", "NOTATION", ": / DynamicUpdate <", "|L>-_", "|B_>6", "NT,0D", "^MM7ZMI", "xShr?M", "@i/l0", "dw$n<", "C:x3|", ";rIb.", "yHJK{V", " harddisken", "M!B?;", "\"}YC*", "Tl(hKI[", "=6l.J", "1\"J+ ", "swm'U", "ea intermitent", "Schalter: / migratealldrivers ", "<{IbA. ", " preru", "ZZy=T~'", "(_)#U", "l4&Z3", "c>;#_", "\\J1`w`", "28WN z", "7MWy u", " felhaszn", "Expanding Setup Dynamic Update files: [%s] -> [%s]...", "q'(AMS", "rs i systemets kontext s", "Yd%KL", "n3xx4r", "W89V;", "fTg7-5-]", "y::a9", "'P/[8h", "XZj2Z", " per nakt", "Eksempel: setup.exe / auto clean / installfrom d : \\minWim\\tilpassetwim.wim", "naamiline v", "p7w[>.", "*ynsdn", "2fbbF", "{YS\"OEe7", "avanja instalacije, ali prije prve korisni", "%s[*]", "o#M_T}", "PPPppp", "{>@]W", "ki interfejs instalacije pojavi, ali ", "OC6 @", "0@5$@0", "qGg6@", "w<}mj9A", "@-v+$eW\\", "Finished waiting for Rollback!", "~#;*%", "}|rl~4", "csu fp", "-0{@k", "M}CmJs", "v~f?GZ#.", "Switch: / Postrollback ", "aqV\\A", "S9u/6", "e+kW'", "J* !6", "L?u:N1", "_^[+P", "Normal", "o do Windows n", "cowi r", "anas programma nevar palaist mantoto uzst", "JBI*s", "eno okru", " ignorada, PBR ser", "(Phe^", "-?YW~0?", "|YWDR", "h'Thw", "H+ ?#|", "SMUei", "VfU,I", "HF5#`", "5J2%U9", ":);9;H;Y;^;d;l;};", "VSx[4", "7!757Z7a7g7l7w7", "A(sDZ=", "[^B?=z", "WWWWWWWPWWWV", "Sources", "e se nastaviti. ", "zi<47[", "4JJJ&''", "O?T>L)", "*K)#\\", "L`,70", "J>8~+r", "m(ah*", "#`4r`", "ZFYhw", "%s: Remapping [0x%X] to [0x%X] in a non-UUP scenario", "RLmv ", "#PZjp", "G0G*o5&", "RG)&B", "KONzr?j", "u arhitekturu.2Pojavio se problem prilikom pokretanja instalacije|Pojavio se problem prilikom pokretanja instalacije. Zatvorite alat, ponovno pokrenite PC i poku", "r{{{zzzww", "H$YA$]", "Byh:HAA", "+?VwN", ">=Y:V", "R1BxuA", ".e p(", "ep5gY>q>M", "u4x/DP", "s%TW93", ".CRT$XIA", "Zt](T", "ktd(a#", "tIVS3", " parametr Enable, tak se p", "+~Tkc1E", " atjaunin", "\\5 e\\W", "L}:x#[", "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.", "1pwL,I", " jsaoB", "~@on?", "S/KKP", "|gd%T", "wsKC_!", "iUl%91(", "es-PY", "A3F8O", "=Ru+7", "/jlkc", "0:M;f", "020J0e0{0", "LO@vS", "7V6\\0'", "C", "QO%~5", "Gnf)=", "G-$Rd", "GetFileTime", "]$w@[m", "lda: setup.exe / auto upgrade / quiet", "is per", "0}\"du", "5vFh/n:\"H", "QZ", ": / Postoobe 1", "az-Latn", "fTitI?i", "LC_0W", "H4)&_O", "Cw.xm}", "DK;wq<", "30?ue", "#s,-b", " -u^C5", "Continue without SetupHost logging.", "94bk'", "WTSQueryUserToken", "***xLII", "9%C2\"c", "O\"#R@", "CreateDlpFile: Source = [%s], Target = [%s]", " vietinio katalogo, dar kart", "n no reiniciar", "!|OR~", "zrAez", "1#121[1g1q1", "Ejemplo: setup.exe / auto upgrade / migratealldrivers none", "wpDK10A", "&Ut;+", "}{}jL", "]Y(67s", "ja. Poskusite znova zagnati namestitveni program.", "1 ku", "-YjX$", "ch prostrediach. Nem", "i. Dup", "r / Telemetry er satt til Enable, samler installasjonsprogrammet inn og laster opp telemetridata som genereres av installasjonen. N", "Fnapy", "&=\"%Q", "da je u tijeku a", "7_7n7", "Ejemplo: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "E&'xj", "Oo)Zh", "16$Zt", "0Ti-5", "AT}1:Qz", "kR?Kd", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\Temporary Setup Files", "UpVid$", "c.4c[?y\"", "999Y9u9", "Ms\\f[", "PhTK@", ",?&?#o", "!q?yO", "&>q,?d", "V}`6u", "T4{V.", "RBYJ{", ">V'i.bW", "EN#6b", "o de rede intermitente. Tente efetuar a configura", "NiK;LG", "mi instalace. Zav", "DirectoryHiveUnloader::ProcessValue", "31_+p", "z6\"gz", "ana/Windows 10 uzst", "d/Jn`", "{D,vk", "Akcia: Pr", "GX[Gc", "Qd3\"=", "X`xyh", "#Wph?", "/Pm(I", "mZd`C", "Ejemplo: setup.exe / auto upgrade / showoobe full", "VR D:<", "I'QymSO!", "48:PS", "I&%ib", "Nw[=ZA", "`*&:jN)", "(6B!J", "Pan [", "t SSSj", "[KC5j/T", ")'ZQq", "s meghi", ">=nhX3`", ":U8E8_", "dU:b>", "b]KGr", "BTuEy", "BVhspT", "j5fz@", "oSP_k^", "a)t*K", "mKf_u", "af-ZA", "%IY u", "[`%% n", "DRwwm", "ieDU0", "cute la version 64 bits de Windows, vous devez utiliser la version 64 bits de l", "g>b,Xa:C{", "Paera", "/bg9H", "8V7*Qu", "SPCleanupInstallationDrive: Failure while building path to safe OS mount directory. Error: 0x%08X", "oP6Y-", "J/A=f", "'K*+F=", ":p)%+", "#O&2$", "WDFR]@", "c%K86", "ZrU`e", "]{xSU", "s de un error en la instalaci", ";>;;;", "~3:>L", "Wc@z\"dXr?", "c)@1j", "tS8-[f-", "7'(_OB", "{.jH u", "ve`.z", "Pf+'zjY", "191q>", ")HY+=E+", "aju neuspe", "!w-q%+9", "EN46a", "P:@Yo", "W{z7_", "1y8]N", "VtVil", "*8wST", "r}.:o", "zz`w)", "!{3N#o", "vr~fm", "installation ne peut pas lancer le syst", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "kUQY{", "qKNx)ns", " G*HNT", "?nvg>", "041404B0", "Comparing file modification times:", "ho umiestnenia po", "$$`sx,", "/@8$A0", "iwKiCG", "OrZ G", "0E)M6", ">(>4>@>L>X>d>p>|>", " asennuksen siirtovaihtoehtoa. Tietov", " \"OOBE\"). ", "rskendus v", "9[:b:n:", "A*URmt", "espace et r", "_k%=frI", "enju. ", "<.=d=z=", ".BKn{", "z@x~<", "-hBL ", "^g=ak", "m:{-W", "#ceb3&1", "uDFo[", "lF}u(", "tu pilnu jaunin", ".rsrc$01", ",&xbp;", "ix=uT", "r fra en netv", "#! NT", "aj#|Nd", "^<:g|", "Check for FU Reserve tag on directory: [%s]", "Error waiting for terminated process to exit!", "Rfb?$", "qT?D{", "?YVS$", "6'7:7U7", "^\"\"_)", "fr-CH", "nE-:YW", "q>^F7", "Windows vNext", "HsV =LH", "X~9Yf", "'4V Z", "`c9sv!", "lXt3xN", "ip-3e", "{csEN", "86zsD", "0=1M1R1X1f1v1{1", "^3G4eG", "#< M'", "bm{`{", "Xzi79", "q~xXv", "#Cd5T-dO", "_gR];", "ap{LJ", "'n_4bo", "}Y&j_6i_p", "WXV^-", "g{fdLeu", "F`'x.", "A[OmQ", "797D7e7", "Y!S;u", "I=-M?", "wc$BD", "t.;_W~Y", "9_,-^,", ".Zi)]", "3z^$vx", "fxr]`", "_Gv(8", "3ND9,#", ">\"G 1", "f43J&", ";$f9}", "YFynR", "Z<&N\",,w", "soVm{", "\",;:S", " celle du PC. Par exemple, si votre PC ex", "Example : setup.exe / auto upgrade / PBRupdate disable", "jKB_|`", "es-CU", "$rfqWq", "iEAKm", "sQ4+5", "pV_ ", "$ZJl9r", "UA\\W(=", "eCFB>", "!bN}*_", "nvv)-", "I{%[z(", "][HTA", "P-\"YP^", "TSWJ#", "GC_.5", "X}~8ZY", "ocJ%v", "i a instrumentului. ", "V_fg.", "ap?4`xE", "~h}LpN", "rs, men innan den f", "uW0f0D0", "n8}-)v", "FDICreate", ">tl\\z", "#?uYQ", "?Q#tx", " Windows 10?", " setupplatform.dll", "HJQj`", "K\"cI\\\"", "].8>l", "t#dbY", "/yx?}", "OE,JX", "4%Z Z", " cesta nebo s", "!r!JZ", "CUpdateScenarioCtrl::ShouldPreserveWorkingDir", "htTM /", "(j;-Z", "VmL:`c", "^0=)M", "a>[DJ", "kta.(Nevar", "J,^Cn!", "5jhY~<", "HObQd\"", "eNMY\"", "SG\"^k", "Fy;EY(e", "ZpF6E", "emplacement sp", "04_QV@", "w`_Q8C}", "L`iL,", "zgS/!s", "b.lTL", "9xP Z", "^OLL1aZ", "C\\z}/", "File [%s] does not exist for comparison", "W)WBJ", "$eP%4-", "TS03N", "ZpQY~,d(", "90Pkd", "yx^ln", "Prepara", "uz-Cyrl", " 2012 Microsoft Corporation. All Rights Reserved.SetupRegularVersion 1.06http://www.microsoft.com/typography/fonts/You may use this font as permitted by the EULA for the product in which this font is included to display and print content. You may only (i) embed this font in content as permitted by the embedding restrictions included in this font; and (ii) temporarily download this font to a printer or other output device to help print content.", "cG9d%", "qYY~,M", "Iq{P<", "1@{~7", "fYu2,", "LCG:~", "0ub{9", "Windows 8", "ide: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "ZQE>w", "jlokat ", "Microsoft JhengHei Bold", "-fgj3\\", "bS63t", "'{$)v", "SIGYD", "O$Tx/", "i''`V", "bQ%2L%", "(a.m\\", "8\"pr(", ">])4q5-", "A7\"q$", "3}hW=", "vatelia v", "Zxj|2~", "%*,,a", "ymr}:I:", "x1iYk", "3j4p4S5", "X$%c", "$sQf4V`", "Preparazione", "\\setupcomplete.cmd ", "P!@-Mv", "L$ ;C8", "+;ya?", "5,Pzpxi", "i?hY3z", "OI,Hu", "g;w'L", "ciu. Pou", "7H\"bd", "velet: Ha a / PBRUpdate ", "}A[SH", "X}>'b", "^E7;n", "oeI41", "6FUQQ6G]G", "I[1R#", "4{bnG", "/Install", " los controladores y estos no formar", "9>I^N", "Juridisk", "{S;*T", "K{&J<(", "G?Xc)", "hJ8Q3", "}+1zo", " #'xO", "]A*V\"", "p@S{A", ", o vartotojai dalyvaus tik OOBE etape: ", "Kurulum haz", "ed5w[", "o. No entanto, quando / Telemetry estiver definido como Disable, a instala", "W;v3=\"", "%OTRy", "*whga", "2Y*3@", "LDLwrE", "zV]gr", "G6(t%", "040604B0", "KDA'dS<", "o do Windows 10", "SEZ~MQ", "StateMatch: Attempting to get InstallMode from registry...", "3^N`te", "Dy m}", "<%<9gf'", "}yL[0", "[Rg |", "s?t>8", "[}U7f", ":{+gG", "`C\"LjS", "BJrtg8", "8@o\"|", "|LbK+&", "mtJ/m", "d4O[L", "5-545:5?5J5T5g5", "n9j&;A", "#9^|t", "'%D.?", "cie. ", "GmaS^", "4?O3d", "D]%-Hu", "\\#/Hl5R", "*>XlU", "lCom~", "/irP2", "W'g{Q", "c:9F\"", "s'|/m4", "\\gyrQ", "Z?*w'p", "^ ", "liti: / pkey 7S", "YGCd\\", "}fT{H", "j}N%+", "l~{an", "|h~1#[E", "n copiar", "cGII!x", "K~F{(p.", "Commutateur : / migratealldrivers eT", "Oh^a=", "0x0n0", "f#4uf", "}XJqf", ".wDA(", "|D%5M", "-`n>x5", "tor, aby po zlyhan", "Exiting early!", "M(E5s", "(ijb\"> E", "676J6^6q6", "oZ4.:", "oRMEq", "F<^iA", "Y1Q,Q", "Oj\\_b", "=\"=X=x=", "?J5Rh", "t'=H(", "cie z testovac", "b_(}", "k(dqOlC ", "\\\\i;3]", "Schalter: / quiet ", "n de los medios o archivos de instalaci", "V:U#Y", "j1pnm", "da, vai uzst", "%s: Setup mode is install - assume we are not resuming.", "Po@f&", "14t>mch;", "#jEUVc", "*b|WM", "W{_~zw", ".X$^P", "GetSystemTimeAsFileTime", "'= z$", "f!r=\\67", "Y-Z x", "NxZDEs", "avoir s", ";L?u5", "!9Tb2", ",l?q0", "/Quiet %s", ".eF\"HB", "%5os&", "]0]kK<", "O$d&3", "8#lRk", "n de PBR . ", "S!g<|N", "4IKXY\\+", "h80AC", "%UHI'", "=Wybrana architektura nie jest zgodna z architektur", "GL>m(", "U~)}v~K\"T", "},gw7", "vIj 5", "ytkownicy ko", "idla. Naopak, ak je prep", " registos comprimidos para a localiza", "]#R>&", "CopySid", "-(k$/x", "RZOE=", ">jt~\\", "F~+'V$", "Cp#kF", "Y5DH3", " la bonne architecture.6Un probl", "sp_8sG", "|/vo0", "_XC/6", ".x*a\"S", "ZKYw{", "kwMS6", "SetFileTime", "VUWUW", "Ij%5;", "9A;H;", "Configura", "g#M7O", "i+rIz}m", "c!(r4", "HUOMAUTUS: t", "u^[Nf", "YwJ[{", "hQG'iK", "f\"W!+", "&R[)T", " Instalatora systemu Windows z powodu braku plik", "+xNF_/1", "B!]W", "p_|A~2@", "#LH8G*x", "A\\|qr", "GKK%=", "ytkownika no", "Vs5e\\", ")3!w!", "[\"q1#?n", "2?2U2b2", "'oecy", "-+q&|m`", "kGg[l", "n de la UX ", "OOBE (Out Of Box Experience) ", "!?zF|", "N\\6!E", "teva lucruri", "Scenarijumi pagr", ";53st)F", " Windows vNext", "q,JRn9", "G^T]s", "setuprolback.cmd", "+<,mx#", "HIPy<", "TRANSPORT", "mu Windows sa ned", "iau paleidote s", "0aFs`", "8c\\6n", "+veP@[", "3F:[U", ".p4q?", "KU8.iBLW", "9-R'ou*$", "{+u}:", "L\\kAAy", "B~BY\"", "StopTraceW", "QctG{~4", "SX]_aQ", "Lg ;M@c", "*?Fw~ih", "[W]qt[l", "(kn0|", ")JtVS", "Q18'|z", "Exemple : setup.exe / auto upgrade", "P9&p5", "gt die Datei ", "W,VKJ", "All, probeert Setup om alle stuurprogramma", "R.1,=", "-a0nW.", "mZPL^", "[/XN{", "9\"lyg", "6T7;8U8", "]XEZ:", "T&;'??", " falta de arquivos de instala", "5zGu6a", "{)pu>('o\"", "yXfsj", "FRs2?", "asno prekinitev delovanja omre", " nem friss", "R>)Dj--", "8OTHml", "5)N~.", "S,R5?", "FGQeY", "Usa el otro disco de instalaci", "d~>-K", "}}\\TU", "nO)*(f", "Ae{[>", "B\\\";Jc7", "S%pQ ", "+]x/>", "Sistem de operare Microsoft", "_ZlFTZl", ",_Vy=e", "HJ`g[", "Q6Tq0", "=K :n1", "_RA\"r", "~jD|f", "UnPK5", "Lu\"`.", "`6\\5R|", "z4[entJ+", "Setup.exe, Windows y", ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@", "!cd-YG", "l*yLh", "2'>>~Q", "~HC}:", "676N6", "`O\\/3", "ana, uporabnik pa se ", "Bl2Zj", "GB6z5", "/aAgp", "Global\\Microsoft.Windows.Setup", "H5(#z", " jako %sbitov", " loadFrom=\"%systemroot%\\system32\\msvcp_win.dll\"", "'Za}Q$", "n de red y que puede sufrir interrupciones de red intermitentes. Vuelve a ejecutar el programa de instalaci", "F8*f4", "RitJkj", ":kINe,", "B4`:s", "Ya7Nh", "U\\Xdpt", "1 J&D;", ",@wS4o", "-ei}-", "=q%Z93<", "2={\\&", "LsdWm93", "SetupHost result missing... remapping [0x%x] to MOSETUP_E_PROCESS_CRASHED.", "4wjrW}", "ar desde o in", "?=$O\\J", "7R+3?0", ";9;?;T;Z;_;k;", "Q@,3R", "=5=f=", "-B}f!", "ini ve aral", "Wy+Hs", "Q_UW]R", "'4o0!", "m>)] ", "nyen. Az al", "!<7Cd#", "o@NhW", "qFH^IUK", "n de nuevo desde", "yj|GZ", "Valitsin: / quiet ", "o~Fdo3", ".$_Xl", "~w*Mue", "o|X,o.", "&NrNn", "e$vQ,", "Dejanje: z izbrano selitvijo avtomatizirate namestitev. Zasloni z uporabni", "v@9g?", "e zagnati, ", "kVe1U", "5W_ou", ".br^ cy", "g(lh6", " |kl-", "R]4TU", "_jBf|~", "25]NH}", "_Q#'@e", "L)nGT", "f<],P", "V\\$(n", "z\"{WYG8%", "u](tu", "\"\").I*", "*bZB=", "MgcGk", "b d'<0", ",@88LIh", "gXuDZ_", "Rd(Pb", "~)layR", "[!W|I5", "rqTymH", ".Uv><", "H'XGn6", "sv/$a", "ajte ponovno pokrenuti program za instalaciju sustava Windows 10.", "Commutateur: / copylogs ", "\\efbu", ":$:<:_:m:", " parametrai. ", "t no lok", "6>z|+", "9_9o9t9z9", "Parametri: percorsi di file locali e percorsi di rete UNC ", "ipravuje se instalace Windows 10.", "BvvTiu", "i^5O~", "00Hq-", "https://go.microsoft.com/fwlink/?LinkId=530046", "jI/W$", "}9&wk", "h>wVfc", "^49&Vj}", "_,)+}", "HKh*\"", "o: o sinalizador de silencioso", ")F*%:o", "Parametreler : Bir specific.wim i", "v%QGY", "5_9WD", ", krajnji korisnik mora interaktivno da dovr", "Nastavi od mesta gde sam stao", "@${S#", "hN*wNS", "s uma falha na instala", "HQ(`!", "\"gj;1", ":%t6z", "}2z+L", "6\\[R1", "Lb8\\r", "yuO/E)", "Av&bryt", "WRjUZ", " yerle", "m,8[R", "Rgd", "3FfcU", "L:O1#R_", "6\"68V%", " sluttbrukeren fullf", "@>A@M", "L9afd8u;d", ")@2-F", "r'y@p(", "j0W0 ", "hy-AM", "|pf|p*_", "?*^y4", "zZBMV", "%^Kmt", "x_| >", "@C-.X!a", "\\!:[_", "!;?Y_s", "F.gv9F", "/2LflK", "7\\{ju", "o legada1A Configura", "X'}Hs", "s atjaunin", "eD=;6", "]\\5)S*", "\\/Z ", "DrZh$Yv", "U3zB(;", "v;^?Y", "N+'x&", "m9\\AE", "#f!f#", "lOSp#]x", "ncC87]", "i din nou instalarea dintr-o fereastr", "?i[pz^q", "Error lowering priority for Azure Host scenario, Error = 0x%X", "IYObY", "7poQ]", "!4z8i", "@j3Q8", "rio e volte a iniciar a Configura", "*ha>\"P", "V:S]]m", "Radnja: Ako je / PBRUpdate postavljen na ", "c=qcy4", "2tjZX", "Instalator systemu Windows 10", "q]MJp", "'0fB=", "53-M3", "~2n\"!&;", "U'VYV", "?eY>9", "G&M<>", "GWindows ", "Primer: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "/C~ZT{", "U_GEW", "'tRb4@", "liti: / showoobe ", ": :(:4:T:\\:d:p:", "B7\"y8,R", "oXV>Gx", "I:,O+", "ProgressHandlerAction: Skipping progress for uninitialized action [%d].", "dkD$X#", ">zD{3m", "environnement de test. Il ne doit pas ", "0W0D0g0Y0K0?", "Va+&o.", "o novamente a partir de uma janela da Linha de Comandos", "M&:ND@y", "N;>?r", " lanc", "kUI7!", "F-H#P", "o especificada. ", "chargement et installation des mises ", "2mF}Sc", "}Cm|W", " sijainnista l", "\"Zyc,", "^bC[$", "VqZq7", "8 8$8(8,8084888<8@8P8X8\\8t8", "rUninstallSourceVersion", "8`'2 ", "{*'={2", "S \"]J", "5*g~/", "F(;vE", "ql+ZJ", ".text$x", ",|hN.N;", "4+4a4k4", "$lV(H", "K^rEy", "L7IK?", "HMRVT", "hc4a1rw", "Ym&!ju|", "l5O%|", "yw!oYG", "JvT@-", "hNC L", "DeletePath: [%s] doesn't exist as a directory; nothing to delete.", "7!+m|", "w!wa A", "9XDY:", "r-k3:Fx#Iu", "eka|9", "1ruWUOQ", "*Pm~'", "4$%9]\"G", "< J^d", "hXO[]", "!c?_6_", "*NsBW", "7JCs#", "ji1qy", "Example : setup.exe / auto upgrade / showoobe full", "/zxT~.", "rberedelser", "83{]E", "CSKR_", "[v|S^", "w-5^m", "shez ", "khhAx'.pj", "W\\W)?", "Switch: / migratealldrivers ", "3IZm0", "rio local, copie todos os arquivos de instala", "!>;{z", "VarFileInfo", "(lXEh", "u\\\\BP", " t6Zi", "SkhoS", "r1vq-", "Dd=s^", "A[C4`j", "*j,Ze4", "#O1a1tyq", "zt'z?}", "ver installasjonsprogrammet ", "IDATx", " vhodn", "L ", "ca-ES-valencia", "s seguro de que quieres salir?&", ")dA{1", "re installasjonsprogrammet. Frigj", ":h5z[K", "Tm7]U:$", "_\"9y\"", "pK +-", "sobu migr", "hAm>DO", "+2[GU.H", "DP*hp", "`*IBu", "cJZ:x", "8D7'U", "TgSwv@", "eF kq", "v2.>f3", "GBk@7", "B~s>w", "%mN@V", "j1[-C", "`()*|$", "x\"E:+", "3#3B3H3", "]@\\e#", "{R+U_", "{t9]Z", " loadFrom=\"%systemroot%\\system32\\cabinet.dll\"", "&\"Tn+Bkx", "Na primer: setup.exe / auto upgrade / PBRupdate disable", ")&*2:", "_exit", ")`a?4g", "pIaI:", "=K^N_", "sFL{Q", "y5u}0", "Use o outro disco de instala", "kHej0", " 350 MB voln", "riista 64-bitist versiooni. Proovige t", "O>%v{", "jR^]'", "Beispiel: setup.exe / auto upgrade / Telemetry enable", "5k[!^", "lne. ", "f}vpN9", ": setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "lckyO^", "}.AjaS", " necessario per l'aggiornamento con un supporto per contratti multilicenza o un supporto che contiene un file pid.txt nella cartella Sources. ", "042604B0", "PjK;Hv_", "'R\"@Jg.%", "s.yOzK", "r Windows 10 igen.", "%s: Found previously stored file hash.", "@b-'a", "h'01|;&!", "!$bo+", "v~a@o", "hFIL2", "$i6R[\\", "IT++Gd", "GsK[r", "lQ^F`", ">P7vz", "programok", "ias teises kaip vartotojas arba procesas, kuris paleido s", "8Qu=]", "b>3#Y", ": / installdrivers Xv5K", "en-HK", "7.p\\}", ")4)xE", "V;g*z~!", "=\"=7=?=I=Y=b=}=", "pppppp", "_L-kK-oE", "a 8Hf", "S}w@k~", "];G[;", "6WQTu", "&esNnU", "S$FLY", "fh#|", "S&nr-7e", "::Bf8", "?=,[%9", "F5\"UM8", "s informaci", "?;2Z'MY?2:t", "~:U>+", "8Qs!Q.", "q+q(J", "kVlvp", " celle de votre PC. Par exemple, si votre PC ex", "ca?-c$gn", "_a8#2", " versiune de Windows 10, nu ve", ", e5i", ":v op", "q,fiHjDr", "WZ|QV^", "l45^A#", "E-[8.", "yg;#m", "daQ]1", "(Y+<=x", "klK_:", "jDm$A", "Gp)u", " ;QhB", "o computador automaticamente", "Xw'.r", "_M#?", "=Windows 10 ", "G)(NRH", "TqD4_", "pC\\w@,o", "+.}b()", "dia/arquivos de origem ", "D<'|a", " 9^=M", "YekZ]", " la cr", "D65TB", ">0c9g", " povolenia pou", "diLPO", "wD.xzn>", "iuW\"B", "K(}(c({<", " do um", "\\$y2Px", "x~TFQ", "Vs]XIz", "fr-HT", "n!|/n,~", "dia na pevnom disku", "tN~:2", "iqLcmz", "s5sYx>", "ejpX8", ",jc?N\"w", "INkgsd", "cpAl{j", "WT|T-y", "au moins 350 Mo d", "]Zt%u", "sIR}\"p", "e)7;I", "Parametrit: paikallinen tiedostopolku tai UNC-verkkopolku kansioon, joka sis", "Pasirengti diegti ", "nhxq/", "_/@*6", "ave. Zaprite orodje, znova za", "\\n>Oq", "E[R4D", "6'zO0", "&_>2_~", "ic;ka", "vvO{ 4F", "kt3Installasjonsprogrammet kan ikke starte Install.exe", "i>}ZI", "AI[etv", "042504B0", "\\Vw|n", "EfSd9N", "GetTraceLoggerHandle", ",FnG=", "`#@hp", "v|?3j]", "yZxT\"|", "eF3B~", "2*P7p", "Priprema", "@+l[A~", "sa, dinamikus friss", "jlhL<", "(bd0+eUPo", " : / quiet ", ")cGd}", "JuQek", "ebujeme aspo", "jr6,R", "szF7=/5", "9i!/[", "Washington1", ".,Jc2", "3Bh>H6/q", "qKE<8", "1pF-)", "o Din", "<65p 9", "' d[H", "|_:qK2", "8fYheq", "", "ZB}!B", "G[Tq/i!", "h3Te3", "E}8 D", "6+6Z6t6", "iC'z1", "O.y+1)Ie", "?NL$L", "|C1vGq", "4vW2v", "~p)]y", ":NA58", "\\uW@\"n", "\"{}'}?", "N x~L", "ci w trybie OOBE. Aby wykona", "67&y^", "i-1L#", "0#/k@", "?0Ste pripraven", "d\\Og0M0", "Azione: se l'opzione / PBRUpdate ", "#8Qfc", "cF7 r", "GH=/[", "]{?af", "](?\"m", "uM;tM", "e informacija.", "GZ_-6", "O1[0fZ", "vNF\\O", "786Y`", "26Pjs", "MDinK", "<]JxJ", "k,IA,R'", "*P_,@", "4(5^5", "HujqD", "$sC`J", "installation avec un choix de migration pour l", "lteni az Install.exe f", "!lux.", "o tentar", "gDWM0O|!", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "m?OH7", "Stikalo: / showoobe ", "$UcHHZ", "%wfEo", "0,`o?", "1K\\bD", "#_&_#", "Priprema instalacije ", "FE4dc58M'", "RW0_0", "Cleaning install folder...", "hZD~m", "u\\Ba6", ":7,CnM", "enje zasnovano na scenariju ", "J0?PuK", "<7/|ou7x", "OTrK|4", "fnCsl", "2?nVm", "System operacyjny Microsoft", "\\JWwAm", "w1O:L", "nomeado setuprollback.cmd ", "Ejemplo: setup.exe / auto upgrade / noreboot", "Q%lXC", "Gh={:", "4{Kce", "Eao]syF", "y#I+N", "ev}D:7", "Ex(lA", "cia aktualiz", "urirati ili kreirati PBR particiju. Nasuprot tome, ako je / PBRUpdate postavljen na ", "RtlRaiseStatus", "0?k$A0", "hL4.!", ";?s%^g8e", "n Configuraci", "zy))=", "h03fT", "Por ejemplo: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd", "6cba*", "9 9^9j9", "H.&_G", "qd=#VC", "Notiek %d%% sagatavo", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", ".{-/yWT-", "0[dbT", "ne poti UNC ", "Kp@~g}", " 6OLN&", "ba: k", "+;N#y", "FDlQG", ">Qf^b5", "?E7$$", "`ow>'iW", "Zu_y~", "OHb}l", "!KMq0'", "Z([ks", "m pou", "Mz:`sw", "PostThreadMessageW", "n6gO#", "SearchPathW", " vai jaunina sist", "vS5W}", "3x!|3}", "K>DKfi%E", "CAzureScenarioCtrl::ShouldPreserveWorkingDir", "ol9h|-", "P?icGx", "-_[zd", "&R.Am", "!-jnx-Ky", "%h49B", "cT%is", "^Wu5V", "+`ZP&", "(K+inN1c", "xmG&F", " kompatibilitu", "bZoWL", "++6<^+'", "@fZT ", ":lR;t", " dh-{", "iO'4a6", "{4dO%", "q~ak~", "\\Mr%%", "=#=P=[=", "d1k U", "tre lanc", "nama ortamlar", "888I(", "kla vietas notiek un, iesp", "velet: ", "2(3@3", "xX%*z", "muWU?", "3;;?//*ZZ", "EJ\"rh", "J.*v6", "K9fZy", "mQ|N6", "p=,:I", "d =6Dnl", "xn]OI", "l5F48", " izdelka. Tega parametra ni treba uporabiti, ", "NcQxE", "Me-Y8", "G37F,4", " in esecuzione da un percorso di rete e potrebbe essersi verificata un'interruzione di rete intermittente. Riprova a eseguire l'installazione.", ">hixF", "PghF[", "5b#|$", "1&r|p", "m Microsoft", "#y", "rddisken{Installationsprogrammet startades inte korrekt. Starta om datorn och k", ">T#xD", "<|cCmd", "E\\-oq", "TRmpfw1", "mu, nemus", "`\"4)!B", "QuWE ", " instal", "PPPPh", "FoFyo", "Commutateur: / pkey \"?P ", "%c}[+", "H+w@.", "a@xt5", "|G~ ?", "}W\"7,", "';r5j", ")-Ti-", "<81>Q>^>", "{h4U\\", "g/|[C1", " possibile usare la riga di comando seguente per orchestrare l'aggiornamento completo a Windows vNext, richiedendo l'input dell'utente solo quando si raggiunge la fase della Configurazione guidata: ", "{/8/Q", "B]^2tZwVDsS", "%m cn", "[Hs'%", "g ", "]QHE]", "hM-=G", "n conocida como OOBE). La siguiente l", "Locale", "a`bp^", "c#GGz", "\"YFG5(|", "K)Q;*", "zcx@i", "urirati ili instalirati PBR particiju. Isto tako, kada je / PBRUpdate postaljen kao onemogu", "-h|\\g", "$Cm@U", "H{7w3", " 5s$4Sb", "(C^9,", "^WAj!", "YtQ]#]", "4p0/}P", "Setup.exe instaleaz", "i|+i6", "Ca>>V", "GjG`|", "=)rnR", "3*%,V(", "CWebScenarioCtrl::PopulateWorkingDir", "CDlpTask::Suspend", "/G1\\n", "stemi penceresinden Kurulum", "37& n", "n de 64 bits de Windows, deber", "Ladda ned", "1.Scy", "YqL`V", ",7G^8", "p[0iF", "5Q+ok@", "gVVMvE", ")!WCGiL.\\}", "vzJ$2", "P/Ew?", "CSetupLangIniLoader::Initialize: Set default UI language = %s.", "@UR2.", "2 2%202A2U2g2n2t2y2", "^7FoJ+", "z|)#i", "k?k/o", "2_I^S", "@v[mp", "UfN#v", "|Ra#tR", "v[kP@Lo", " grunn av manglende installasjonsfiler. Hvis du tidligere har startet installasjonsprogrammet fra en lokal mappe, kopierer du alle installasjonsfilene til mappen igjen og starter installasjonsprogrammet p", "2Gk5&Z", "e&3q3xh", "KM(gO", " je me suis arr", "6B7rM", "q?I&+q", "F0C;X", "enje, preuzimanje i instaliranje a", "Z}Z3V&,8/", "WYB84", "couvert que l", "/PyaF^", "'_;@o\\", "s\"/hr", "P+j*g", "Wq{o\"", "nOonx", "#ZD\"EZ", "-|GPM8O", "uHNMe", "PvR+G", "?5va\\", "1(*4>N", "P##%[", "1hy=e", "[du#k", "ce zdrojov", "terek: All; None ", "*G)Bk", "A5l", "ntTK`", " proizvoda pogramu za instalaciji. Ovaj parametar nije potreban kada se nadogra", "?3+6q", "Klargj", "p}GQ}_", "\"S^\\9xZ", "*8+*q", "rstegangsoplevelsen) manuelt. F", "Qg!SYyF", "Gni'4Q", "ux*b}", "d7N)+7$", "iPH|Hx", "r-u(n", "xi\"q].", "g!|D3", "?/ab[", "/h^&a", "/o#8oLr_", "I3{9QN", "anas instance. Iesp", ".?AVCPackageScenarioCtrl@@", "[_0W|9y", "?fF+Lt/", "$` SE", "wf$,ED", "Please visit: %1!s!", "rile implicite. ", "%s3|]", "8 Ld4", "quz-BO", "do arquivo local ou caminho da rede UNC para uma pasta que contenha arquivos .inf ", "zRGqTX", "-\\c?)", "mQ$u$", "Wj[kY", "2 2$2(2,202D2H2`2d2|2", "bS04Nv", "[c_`fW", "ryVk9", "zGtDb", "Z`q]F", "imalus. Juurutusinsener soovib koguda t", "?^9XR", "K$J5t", "5T[4.", "ibxRL", ",?6T#O%", "rT]kJ", "Q1(0 ", "@Oj5p", "Jjpe+K", "p69Gq", "klerseniz %1!s! s", "Bg9n:", "]gr5E", "m#TP[", "/\"n;c", "J,x]j", "-Ea", ".Py<4", "BCTD'", "83p9up@", "LI.wU", "\\aWa\"", "R-h>(", "enjer za implementaciju mo", "Fkd8;", "t;4O$", "j+Xf;", "uYDF'", "dm#*V:", "%%}CW", "!*i/-s", "]mAUww", "r det udf", "rs: setup.exe / auto upgrade / migratealldrivers none", "V eFv", ">=&ZZ", "%u`1{t", "l'Z^OI", ">+z/=", "ICRx:", "&oV+|", "N?.4Bk9=", "nd-)\\", "uY[RSR", "}#:[_", "5aC1@7", "SG?g?", "OqawyD", "`>w&.", "5'6b6", "res som en del av installasjonen. ", "lC(o;", "^H|<2", "enoj lokaciji u toku procesa instalacije. Instalacija povratno pretra", "MhF+<", "\".uYw", "sfu_\\&", "l\"uO2o'", "VK~b6", ") HM'", "}zg{6j", "C@(zB", "q/2XR!", ",n/}1", "6c'4V", "C,CU;", "mu souboru .wim ", "Xw\"h6W", "n especificada. Setuprolback.cmd es un script personalizado que realiza tareas si se produce un error de instalaci", "0g0q0", "\"@qCY", "gE=~}@", "CrX'9_", "Ath_[S", "si migrova", "o40sU", "", "f\\:x,h", "__CxxFrameHandler3", "z+feE", "$;Ao7;", "8M^T_-", "eOCX_", "&Tagasi", "Akcija : Program za instalaciju ne", "d#gut", "$^[{)", "diegti ", "Akcia: Po", "n volum sau cu suportul fizic care con", "7sB5I", "1`w>L", " festgelegt ist, werden von Setup keine installationsbezogenen Telemetriedaten gesammelt und hochgeladen. ", "A[t5Q", ":8;E;L;", "e do datoteke sa imenom setupcomplete.cmd ", " parametri ei ole tarpeellinen, kun p", "#06rA", "1(0&0", "8Pq;`Xj", "5bE`k", "(d/^B", "??v7t", "WcXoU", "NtSetInformationProcess", "a)%4\",", "~h9NI", "vaM!c", "P:pqq", "3U[oP", "4WBI5", "{Zfs01", "tre en cours. Pour plus d", " pid.txt", "X6R6Z6V6", "qUl7Nl", "\\2QW>", "?$?0?+", " jour). ", "Esimerkki: setup.exe / auto upgrade / postrollback \\OmaJaettuResurssi\\komentosarjat\\setuprollback.cmd", "Commutateur: / Telemetry bi", "YnI0d", "F3-o:", "Ex/Cn", "NW0~0Y0K0?", ",Ezf,", "k$,Q&I", "j|&JK-", "z5:NU", "G:~`J", "m'^NmR", "*IYJp", "Administrator zamierza w ci", "6HEtH", "iZx=+=", "4FUmT.)_", "Instalaci", "}K)-p", "iaM}v", "bCIq8", ":']un", "?wM^2u", ">(*,IG", "Nsldl", "yrO/2", "&O<~$q", "Marking directory as Hard Reserve: [%s]...", "ea la un fi", "UajLy", "MU]0,", "9eP09", "u!;< ", "bcknx", "lineen sijainnin", "hlasu so zhroma", "a+$1x", "rF-tXZ", "~EIv(fK", "MTO\\%", ").2/Zh`)", "Ns@5lu", "u@_Ft", "crans de progression s", "377i`", "EIzsRK", "$+Q*m<", "Ty n.Ktd", "1?/a|", "2s_iB", "y go u", "swHMG", "RG.2S/", "GX{r|", "+Z/6Z", "!qus0", "INHMQ", "uL=Ie", "zJbK:", "K@UT]tHS", "alGuh,", "3HNdZ", "i%pX5`", "f[;H(", "h78uvC", "+ MXN8", ",(5YRV", "9b]M>", "tricos associados ", "Support", "gVQq4", "UWU|7", "{Nh,k", "GL\\|T", "$Pd@{5", ",8pf~", "Parametri : Enable; Disable ", "21383_3", "!J6wNU", "]4^^Z", " 000", "=C4h A", "Hj-ijP", "|i/taJ", "~4~vl", "CdP:k", "r installationen. Medieinstallationsgr", "F2vCcPL", "FARV)T*/", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "(mBbhR", ":(J+y", "IMPLIED", "tn8^\\t", "b<0&~", "n: automatizar la instalaci", "RtlReAllocateHeap", "uc#z,", "J?L {", "`Z`q=<", "OovK<", "ritettyyn tiedostopolkuun k", "9S8&v", "fG:]@", "utare, desc", "~?fhd", "4 Gy]CAfiP", "cm`!WNb=|", "+EzE.5!", "B!S39`", "^q~Oc", "CDlpTask::ResetActionProgress", "tD{%h", "gbs+^", "#xrkw", "(d@^Kn7", "r mer information.", "E^xQ-", "xEE_!", "q@X5,", "ik draiverid. Kui aga s", "n desde un directorio local, copia todos los archivos de instalaci", "@Y*;M", "4>f$i", ":qX.D", "Zk-Zh", "e$XadP", "r / migratealldrivers ", ":'vVpB", "N\"2;@", "_x{kQ", "PLoe,'", "]a>}cC", "sr-Latn-ME", "h?2g,YC", "CBootScenarioCtrl::Initialize", "ldasc", "F'saR", "nce g", "CLAe=", "-Tn[s", "```ppp", "lH7yiBR", "?kZfO", "X=Y|+0", "\\XDN\"", "(#q8%", "ZnB}97", "|0rBO", "o de upload, OOBE ser", "Transferir", "S;~Y0X", "ruoti", "3#4T4", "J'hbk", "U`/eN}'", "K9^rk*M", "*>UU=J7", "7 VZX3", "vneniami ako pou", "o_)F3", "reeI%", "b;ymu", "yq:*~&", "Exemplu: setup.exe / auto upgrade DynamicUpdate disable", "SetBkMode", "A~=NiH", "6.|xd", "SUcOm", "r8d8k'", "ogHZ'", "['hb?", "8GKje", "F;?I*m", "Parameter: 5x5-Product Key ", "Vi gj", "klad: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers", "ifru proizvoda za instalaciju. Ovaj parametar nije neophodan prilikom nadogradnje pomo", "rii. Din contr", "VxzS>|", "=]>g>", "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x", "VJciA?", "oikeudet ja p", "|Lbkr", "]Zkf`p", "+oa-F_O", "B'9}7", "vr0zE", "u-#.m", " |vHQ", "?;C:0", "n que se especific", "zda, Windows 10 Kurulumu otomatik olarak yeniden ba", "dVo~5", " ja edistymisn", "Alternativt kan en tekniker, der udf", "wIhG6", "M6(<1", "DlpMgrInit: WorkingPath = [%s], Disposition = [%s], Flags = [0x%X], Diagnostics = [%s], StockRegistrar = [%s], UserRegistrar = [%s]", "Eksempel: setup.exe / auto upgrade DynamicUpdate deaktiver", "I^&o607@j", "z^t |", "HfnD^Y", "ATVnc", "m\\[P-", "xBOEZ", "3W(5'A", "GcnU]Vg", "EA_LFh", "38fc'Rc6", "K5sW}", "4[6=3s ", "s^,~o", "ko su", "~q;)n", "2zQOg2>8", "ii-CN", "~8XrX", "PCLx$r[GM", "e sva postavljanja UX-a, uklju", "728K8", "^0&006--H0", "CDlpTask::GetName", "ro-RO", ",RZ#~", "CDlpTask::ProgressHandlerTransfer", "cie pre in", "RT(LE", "S6\\-a'", "u&f98t", "&vsCG", "k=T\"/", "s'rq;", "!9_}q#", "-D_Z!x1", "Kez*I", ">El$z", "D8vB", "4\"TYF", "<(Ek4", "r;*|Y^", "U)]$v", "sX#G!", "81IL&S", "<0=E;", "7 7-7U7s7", "yS\\iw", "2ZO{\"", " 350 MB miesta. Uvo", "VH\\Z87", "a\\liN", "R)3yBE", "fhR.G", "|i5K;C", "vAc6[", "ie din re", "'&[6J8", "R,g95", "ghYom", "o$$L_L^", "_{od|u", "njo namestitvenega programa, vklju", "/N[E<", "000@@@@@@@@@ ", "%EFGc", "0A0|0", "q[nch", "8psb&", "{}Wm\\;", "w%6``", "&Xmu)", "j*lM1", "Parameters: Local file paths and UNC network paths ", "oLd)U", "{?pr}", "s4}^C", "78'EqN\"qN", "Euh_YS", "=NZ=t", "QZbo|", "PKu&j", "n`U_9", "(Qc~*g", "WUb=y;Nk", "[9(Si\\", "ACTION", "WdsGenericSetupLogInit", "r mediet skulle f", "]BH-XQ", "$}#mB/", "5ZQf&$", "Lu}OyZ|", ">\"?,?Q?q?", "v%;G{g)%", "~lP!BH", "Ty3M'", "TE|(n`", "6Ct\"m", "n behelyezte, a Windows 10 telep", "Qh9+C", "X8N[X", "{]seD7D", "Y|c33f", ". Nen", ",=6,Z", "o automatizadas. Esta", "Installeren", "}_pEw=", ".Uzst", "sny{D", "n\"DC&", ";dZq[r,", "mI`E{:b", "c\\&S@", "Yl;L*", "3\\,1~3", "^>z__F", "rtoto palai", "ivitet", "2R2w2", "|Ra#A]J", "ThOoM", "o: / DynamicUpdate b//", "\\-(JF&uJzr", "A(]SS", "Hive %s is loaded under %s", "k)o^5o", ";p(,]b", " 8=Q?}", "9sXhOF(U", "vDSMU;", "A}9{d[e", "cznik: / PBRUpdate ", "\\4A{^", ">#>4>:>H>X>^>l>q>{>", "w. Natomiast gdy prze", "N<_?H", "nek el", "ep_hl~", "reR6O", "EyT&Z", "^_x)f[", "k;)Y'", " asennuksen k", "]z~Y$a0", " ir tinklo prieig", "]Do1P", "\"?Tgi", "gqM\"1", "*$iGPA", "[=kT$G", "|aoZRq&D", "pMR[m", "BBD@;", "st9:][", "rate de seleccionar la arquitectura correcta.(Error al iniciar Programa de instalaci", "sA>R^", "\\>f:y", "4@?Iv", "pV.j0", "s]L{c", "{wrz:[", "un emplacement r", ">vB.+", "uvuu2H!", "&(%90", "+hXM*A", "{tBVh:5", "80P0w0", "9H4>a", "Ie$^|", ">A|Fh", "#+-jY", "hHr:*", "I9/.]", "x=0Zo", "qQi5o", "IjPys", "4Q/M4(", "OUZyI", ".a^z@>", "du XML.?Chyba p", "u(d?%", "CK(s`", "!k=qM_", "%C$$j}", "-# <&", "gQOgp", "em}cs", "Stikalo: / PBRUpdate ", "b!zDpd", "KtI~^", "wxYe.", "_G?5}", "~Z/io", "inku, ktor", "fZU?w*W", "yTdR!o", "WwM", "Wj9SK", "o(>27X", "((gBfm", "+'pwl", "TXn&g", "$c+Um", "%<6J9&u!{", "*JKYr", "|b1:o", "blHa(", "Dr^l3", "&+EyJ", "|VH9j", "%^\"-4H", "Ep\\YR", ">@ko(u", "z?y@}\"", "e10e2", ";n5@@X", "1'V`/", "%s: Remapping [0x%X] to [0x%X] to facilitate retries", "d\\\\Yo", "Kana$:", "*IpxM", "T qU(", "D>uQb", "~|;mV$5", ".`F*%BM+", "74-AN", "h ^fN", "8+F!ZE", "Switch : / noreboot ", "gB.OM", "7RXN%", "bAM2/`", " repetidamente en todas las subcarpetas de la ubicaci", "ei+;\\", "=}!\\Ex", "rd: Anger s", "sASw\"8", "o, mas antes", "FO/[O", "$#IF2", "CxgkH", "@.rsrc", "dj+;&", "xW`'\"", "oNNrp", "Nu+Sn@", ":iZV^", "XJ3i%", "thW]$", "|H>'_", "dR(Oa%HZ*", "]~nNC", "iTQzl", "gnx0ex", "NtShutdownSystem", "y.cNk", "fZX=M", "nZr1C", "Preparando-se2A Instala", "i", "hu60?", "7XB", ",o3k`4]", "cuter le programme d", "o do Windows 10/A Instala", "SH\"L*", "jI|qo", "TjJ$;9", "/yptD", "}f6Ev", "_RWC?", "(\\]nH", "Ut?(8", "EYs!7", "Vill du avsluta?", "Gebruik de andere installatieschijf waarop %s-bits staat vermeld. Wanneer u deze plaatst, wordt Windows 10 Setup automatisch opnieuw gestart.'De vereiste XML-versie is niet gevonden6Fout bij het faseren van het medium op de harde schijfhSetup is niet correct gestart. Start uw pc opnieuw op en probeer Windows 10 Setup opnieuw uit te voeren.", "Fyz57D", "Perjungimas: / quiet ", "liittym", "&A2Hi{FN", "klp5<", "3,3D3\\3t3", "lv~u.&", "D^6A(l}4s", "tY9w$tT", "sult telep", "}nKj1o2j", "d?RBG\\", "u5{xq", "{fcIr", "%\"~:6>80w8", "n de telemetr", "tres : N / A ", " establecido en Full, el usuario final deber", "$T^wxZ", "![2OQ", "$m)SN", "t@)>V", "ZDPFL*", "-x@Y9", "5YV|7", "g>S[=", " bir betiktir.Kurulumu ba", "pvWxRo", "ekilde, / migratealldrivers Hi", "G:][7", "LyG={2", "0fv24Gmh", "vojiet vietu un p", "lvm{Tys'", "2EWDh'", "I@\\9;", "M-R=K", ";.8+'\\PEb", "U2/%K", "[:Q\"-", "{g~Zj", "P\"Mxh:P", "]nMu!", "S:j|6", "/Taq]", "]9\\%\\", "ad: setup.exe / auto upgrade / quiet", "'Wr/K", "!1,C+", "Zqzww", "n llevar", "zSdu:n)", "U37Rx1-", "\\7aI^jo", "(4og7", "NJ?e$", "Scenariu de utilizare ", "Z/#Sn", "Juridisch", "@M!W0", "5GCVo", "<&E;5", "fF6qBQ", "Action : Automate install with migration choice for the installation. The media setup UI and progress screens are shown by default, but are automated.This switch also assumes the following default configurations : EULA acceptance, Dynamic Update is enabled, telemetry collection and upload opt - in, OOBE will be skipped, PBR will be updated or created. ", "6um(f", "z';#7", "}8@%[", "\"V&aP", ": / showoobe ", ". SetupComplete.cmd est un script personnalis", "(_Oh'x", "7!r+}w", "Eksempel: setup.exe / auto upgrade / copylogs \\MinRessurs\\UpgradeLogs", "ob?t:D", ".~YsU", "t{!H@h7", " del sistema operativo di livello inferiore. Il programma di installazione continuer", "4^N@f", "<;~zh$", "3AkQ.", "rMq?z", "b5,jL,[", "An admin wants to upgrade the departments PCs from Windows 7 Enterprise overnight. She does not want the set-up user interface to appear but she does want the end users to manually go through the Out of box experience (known as OOBE) experience. The following command line can be used to orchestrate the full upgrade to Windows vNext, requiring user input only once the machine reaches OOBE : ", " ECD\\", "c'`n0", "Nck(W", "u&mG,", "X6w~I>", "qnN*+3r", "\\j7HU", "g7H%t", " ", "01{6N=", "]'.aY", "zh-TW", "ti to noklus", "V|lA2", "}c$*i", "g'$\"", "|?xj?F", "V>f", ":Aq`$", "o10AO", "KFmbV", "W4x-}", "4<*?u$", "M?g,-", "=QPCrO", "-P|`}p", "T#.Zw", ")e[/Xpt", "s\\ R>", "_5w:8", "L.c5-I", "6IQyv", "#s*\"~", "rnyezetekben szabad haszn", "^K+_", "j*'}s", "Xcd-d", "uQ=|}d", "7O9+>", "9[rBNn", "rI1qE", "|7]i/", "cQ:yD", "L,wtpT", "2kyvQ", "zp'/x", "YD~LX", "Commutateur: / DynamicUpdate z", "j|D4\\k", "QCJ6q4", "AllocateAndInitializeSid", "lVndVi", "rQ Lm", "]!fH)", "ar-BH", "sZB7C", "_ZF6?", "8)8g8", "\\reZ_", "ber Nacht von Windows 7 Enterprise upgraden. Die Setup-Benutzeroberfl", "lmamal", "bFd6=", "rste brukerp", "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x", "]Cun6", "AKokeile suorittaa asennusohjelma uudelleen komentokehoteikkunasta", "Fvs$D", "Txq>4", "_3", "R'X| ", "h]g!s", " oldalt: %1!s!", "?|awu", "fw'VK", "Beispiel: setup.exe / auto upgrade / noreboot", "KoVfh", "WPdXD", "Xs?SM~", "cej informacji.", "InitCommonControlsEx", "J`EO5", "", "tter in den startas installationsprogrammet f", "0L0Kb", "RxW%Xq", "c{B-V", "H0Mp3", "ti vagy nem hozza l", ">sR;_", "'$>+>F>V>n>u>", "`^|\" ", "m3e}0", " oli ongelma. Sulje ty", ".*Z$W", "ina uzst", "6a-Y76", "3!>7k\\", "l&0F`", "l*}0_", "GKv@.", "uCFRPs", "N`o~ri8", ">!,?o", "kx\\q?", "j\"P)}!", "8=@u+", "+,HB", "@?e\"@", "E/d\\z", "%s: Setting PreDownload mode...", "klad: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "nnande av licensvillkor, dynamisk uppdatering ", "s<:MbG", "Voorbereiden", "it-CH", "HZm_h9", "=x31fN\\", "LmONm&b0", "pCm}M", "fr-LU", "(aV`.", "$i@i0", "^ds*;u", "H2F'J", ")OkO[", "FcZ(E", "@*Fb&", "*==}zz", "gZ#n_", "+9h~Bkl", "c/}n1t", "Forbereder installasjon ", "!}\\r%2", "aGb$em", "x,@TpL", "FA}xd", "o, inclusive UX de revers", "es-ES", "3!GU!V", "~p.,v", "Programmu Windows uzst", "jxNK[", "yF83z", "Vc=_N", "FindResourceExW", "+|O\\8", "m\\inb", "^i`]i", "nea de comandos. En un s", "~D{}=", "al,2*", "Iug2w", "PhX5A", " chce p", "3\"323B3R3b3r3", "?#?2?C?I?W?g?m?", "3\\>Cl", "xima vez que se reinicie el PC, la instalaci", "Xfq3zJJ]", "hrt. ", "sC?_Q", "CDlpManager::AsyncSerializeDisable", "nd / showoobe este setat la None, OOBE este ignorat ", "Dy*f2", "ide: setup.exe / auto upgrade / noreboot", "sWx!Z", "r att k", "$#;,&C", "qmn1<", "n est", "lKY9V", "o definidos", "A\\xGN", "j5wYq", "6=1M!Y", "SdxX&", "P=W5P", "ErGy?", "oU3>t7", "Sigurno ", "?w>zl", "'iM7=ek", "7dC~.", "YMuAL;jK}", "rovanie do umiestnen", "sitsi l", "6$7K7p7", ";I{4e&", ": / Telemetry ", ">D`,=", "qIt;l", "+\\)5:I", "K: K/", "elle peut avoir donn", "Nothing to preserve.", "7+z@W", "XhoaMO(", "9D{^Aj", "045p?", "FFa9 ", "squeda, descarga y actualizaciones de instalaci", "stroj, restartujte po", "Action: When / Telemetry is set to Enable, set-up will collect and upload telemetry generated by the installation. However, when / Telemetry is set to Disable, set-up will not collect and upload installation - related telemetry. ", "Pm,00", "GkG!=", "W=7m|", "u%O*4", "priebeh", "PmhAl^l", "uriranje zna", "9Ow7@", ", kter", "pfd\\81", "5,K/f", "Stiahnu", "N?dqU", "=^n5K", "r|T)|o", "Qm}DL", "J-3%1", "CreateEnvironmentBlock", "**o~3", "wqJ)EUw", "", "@68%F9>", " ei tule k", ".7z\"=", "s,W3z", "~BQ; ", "hE|By:}", "YOR`#~", "E66|{", "lda: setup.exe / auto upgrade DynamicUpdate disable", "V*+1JOe", "b`f_X", "KFJ|$^", "&5Ebx", "/eSq%", ".$m$~uYW", "}$0Cj", "\\^*]S", "Ixj$l", ":#o3_", "+#%7~4W", "-2S4T4", "737Q7_7f7", "a pu d", "I_\"]H", "R'5H#", "0FO/f", "vAEi]", "x{0/H", "35JR;", "'e1gc", "Rh'R\"", ";Uo/;U", ":R?}$y", "IOWEY", "Hn zR", ";NQw-", "\\v}_l", "9 KQf", ":R_&W", " |++'", "0Tp)", "U[`\\Eq", "Veiksmas: kai / showoobe nustatytas kaip Visi", "t=Wj,j", " : Upgrade; DataOnly; Clean ", "374t4=5s5", "OR}(i}", "hoc[w&", "X7PG@", "eOFv:", "8%8G8U8n8", "Radnja: Ako je / migratealldrivers postavljen na ", " ]3 O", "^4W]CQD", "o&OO5", "vo\"?Z", "B_1>6E;", " L+q 1", ";\\sCU", "loh opera", "rlopp", "r / showoobe m", "~rc$f", "`@}C=", "D~3pS[", "WinDLP System Reboot", "HczqbgK", "hG# M", "(Inb3fd", "#EJAL", "Eg1", "P!g\\>", ": ;L3E3P3W3_3o3", "ne-NP", "Pavyzdys: setup.exe / auto upgrade / noreboot", "U--xh", "]jf6My", "n. Diski takt", "XcR.=", "FN2*Sp", "uA\\eu.", "inclusion de la collection de t", "T_K/wW", "@r=^7v$", ".grK7", "]>c-N", "biri olarak ayarlan", " iba pri testovan", "i=HhO", "dA7cV", "_s0Tx7", "YX", "Process termination failed! Error = 0x%X", "*N2_&", "FGK3t", "ESD target file: [%s]", ".}T8z", "C]a-4", ", ale pot", "ProductName", "[OX;t", "18^B\"", ". Soubor setupcomplete.cmd je upraviteln", "snve3", "54e>a", "j3-&Jx", "(^\\Qc\\", "1k2:4y4", ";$':]", "a)JEr/", "|WEF ", "~g x0Y", "Microsoft YaHei UI", "BR)g,4", "zc}I}", "22n(g", "!MaRL", "nfHn!K", "mku(=", ": 5x5 ", "vV?7o", "`b2(s", "GKoooX", ";_&KJ33", "Setup.exe instala o actualiza Windows. Para modificar el comportamiento de la instalaci", "Oi?$%", "\\W;\"d", "OJ^?U", "_r0+X$\\", "`[*]vt", "s}g/0", "C* krK", "DFY ", "$`yw+", "dW>v2", "UrnT=)!", "q((^vA", "z8dX^:", "T:{zE", "/CorrelationVector", "bIu~r", "kOB5Ik", " a megadott helyen l", "e pokrenuti naslije", "lnemu s", "v$kb\"", "?wB[#W", "5X6D7K7[7b7q7x7'8.8N8", "ivitys saattaa olla k", "PYlC^s", "^^t{_]", "|$|`>fy", "^rZ r", " / showoobe ", "!*`HBT", "r=C}U", "Parametre: Upgrade; DataOnly; Clean ", "^L3UV", ";wX>#", "ndT.S", "c^1(840", ";3sfff", "|2F7NG}", "d Product Key, 5 x 5 ", "k igen.cOm du installerar den h", "p.n6F", "}~.n|", "RK0M[n", "1!1R1", ",M.mX$", "f5*&@", "[`Un$", " skript, kter", "+O2OP", "4z0{52j>", "Dniql", "#&0I~", "<[]n<", "y_N*F ", "%()S{xw", "PZA[H", "ndning ", "Wyptm", "R5?u#", "@sN/!", "e-Y_r", "U]d@,\"", "?,6F5Z5r", "pQF]5", "K[^w2N", "zz+Y]", "}hfY`", "X/4 6I2", "VP=P>", "TMQ<{", ")+Lv$", "ite uporabni", "i=bkG", "'`+;/", "r / PBRUpdate er angivet til Enable, vil installationsprogrammet opdatere eller oprette PBR-partitionen. Omvendt n", "Te+|d", "Esimerkki: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "d6xweT", "}UrR:SS", "metro deve ser usado apenas durante testes e em ambientes de teste. N", "SvU8]5", "%s: PreDownload mode value found.", "6,mXGF", "UoP_V", "+(Xof", "@6\\D\\", "{XLIt", "0*g#4", "S7@tVI", "G$Tnm@", "r{c[C", "^,q6l", "QfQ?Od", "/ auto ", "n, belirtilen dosya yoluna a", "qLK[b", "o para executar a configura", "HvAd>", "}7!Z`", "XSdi[", "Windows 10 telep", "<}@y5", "*wP]G", " verificato un problema durante l'avvio dell'installazione", "i(\\HR", "~:\"0]", "7M<.qjc", "Z", "XLjE?|", "es-DO", " Microsoft Corporation. Alle Rechte vorbehalten.", "prfdA", "$;DY@g", " nem gy", ":kU \"", "VVDv'", "finis ", " alebo pou", "enite ukaz ", "D?9IwN", "H)d-$", "_(M*%", "VVT\\Ex7", "YA@kM:", "p!Ej\"", ")Nzu~]A", "dfEe.e", "VR3njQ", "n]?Ze", "`~awr", "$G(yKW", "77&PE$", "mt^XU", "}eGN^N", "Ajuda", "Como alternativa, un ingeniero de implementaci", "E6|?#K!", "~aXrP", "Ve'Rk&", "%&y.\"y&", "=FxT^", "yZyde", "97u$VV", "l ;-;", "~`ID%U", "7xk]=|", "Rd)bO", "!9x+`", "PuB'$", "0? $A0", "4+5h5", "4i:xWw", "tte hele opgraderingen til Windows vNext og kr", ")*WG$", "PUBLIC", "pE]VK", "eDF:/Os", "*]X,NB=", "_kX$Y", "$[1(B", "HeapSize", "bY5RV", "=65N:", "2>2V2e2l2", " Microsoft Corporation. V", "2zBga", "&r+Z|Kv", "k 7M_", "Setup360Files", "4$4:4D4X4f4v4", "Notiek gatavo", "&E3 an{BS[", "Qq)bl", "2+*de", " uz mapi, kur", "5P6W6^7e7", "Installi", "uV\\Lb{,", "en-CA", "0IwlsJ&", "x^0G}", "Oig9y", "'NBOz", "j>d,8]", "]}tTE", ", namestitveni program bele", "h5Jh1", "1 sU s", "1wa+7vU", "b=i=h", "=qQ'XB", "DIB-Ca", "B+4>J", "MVXMWd:", "{/UU;XI", "jxw(Kg.$b", "lI&7l", "5NX=V", "6(wz@", "TerminateProcess", "G^#h :", "^ctcoz", "'\\_a~", "yEV[=", "visiacu s in", "CDlpManager::GetStringProperty", "_\\, X<.", "qMT'A", "H!d2#", "\\JuZqI", "-Qu_4", "{4(m(", "iiiPTX", "x=..>", "TFYgu", "5alUg W", "a?0EY", "hwQf.", "8vJ]6<", "P5c~ ", "anas programmai uzdot iesaist", "Comutator: / Telemetry ", "Example : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim", "OjVqD", "Wait for Rollback mutex returned: [0x%X]", "R`*nD", "BRj/<#", "@xxV:", "7,7<7L7\\7`7h7|7", "^:h(B", ")F+&)R", "3qFnB", "7%4{H-", "g;ZSnVjb", "+(:f-K", "p6}i!", "Setup.exe installs or upgrades Windows. The following command line arguments can be used to modify the behavior of Windows installation*Asennus ei tunnista k", "n loca", "rs med samma privilegier som anv", "LSVWh", "eli prikupiti zapisnike i druge dijagnosti", "KI~G2", "RqaKF", "9vBOs&,", " ::pN", ">NqKt", "-TXz%HY", "4a1hz", "af$;,", "Ur7Fh\\", "EoM8]_", "bbY~|", "5Eu{)K^", "L]O{GT", "Z\\E'~", "cznik: / Telemetry ", "lgPwJ", "].gU+o", "3K5\\Y[k/`", "Action : Lorsque / migratealldrivers est d", "O|IMW", "RichEdit20W", "vI_K5rD", "?", "G:g7[", "Finished waiting for SetupCln!", "c?YB-", "Cxf_{", "Parametrai : Enable; Disable ", "LSVW3", "NM'Bx", "}e'K)", "gn-PY", "On(w!", "Switch: / showoobe ", "Un(qXJ", "he korra (kui seade j", "8@v5%", "z=;9%", ",NfpR?~", "3EG3d/_g", "9Ay v", "576=7", "Suderinamumas", "V4#}2Mf", "A\"k{,", "o continuar", "Msju_xs", "6X6_6}6", "?]C,~Y", "9 9,989D9P9\\9h9t9", "vXHjK>_", "iL&\\j", "ZC/Am", "Se\\Ls", "6l>|^", "#{Dl1", " siirt", ";H7wv", "kleme taraf", "BEZ{S5|ak", "um]:*", "PPP@@@@@@@@@@@@@@@PPP", "K)|_cqL", " enthalten ist, ist dieser Parameter nicht erforderlich. ", ",`?) ", "rgujuurdep", "ytkownika Instalatora, ale tak, aby u", "lati forgat", ";)HeN", "a|0BI", "21#y#>5I", "xz+yz", "M4N%4", "w~naCQ", "AG2lO", "_Nysy", "`vispL", "E6}Vb-", "rtuseks on seatud None, ei migreeri installiprogramm installimise k", "K[teKG", "Pvr&g", "e\"0CF", " executado com privil", "1:yRd", ";aj8!gd", "Z(T*f0lzjG", " loadFrom=\"%systemroot%\\system32\\userenv.dll\"", "*>>|f", ";ueuee", "#?tcc", "vAx=~B", ".LkYb", "9kT*l", "U2}T*", "interface utilisateur et les ", "e/%Q)", "M\"quk", "cuVHIs", ";,ifO<", "$#H]#", "9!:c:", "anas programma nevar noteikt UI valodu", ": / Postrollback ", "vXHuo", "\"-)$,", "F_itw", "[J]2S", "2YcdEGE", "X}Y:d", "F8(y\\", ",$rsh", ".Y@Bi", "e-xUG", "EG8mO", " 53+q", "Y#**da", "D{+F8", "BOnrJ", " taky p", "4hEK+:", "rcKwK", "\\yGLF}q", "_64bS", ")OC7S", "-]8Mx", "=?[bMt", "Fk?~^", "o:|)S", "t?uW>F", "8!9:9", "Action : automatise l", "2-Yo8", "XfB3#", "3iNv8`2", ";xs=rC", "! P[f", "q$224.", "let nyelv", "|yd@:", "_uUEw", "+!w0y", "<7R77", "t`3+v", " la partici", "SLj&%JS", "a;b|7", "9t$ u39t$", "1}Lol", "O8G,9", ")o iU", "IXG^Z-c", "o local para a instala", "#0|$F", "^P)k?", "u1kms", " operaciones de actualizaci", " skript na vykonanie ", "#>$~[", "n se suponen las siguientes configuraciones predeterminadas: aceptaci", "JLEh{", "59E#.N", " i dati di telemetria generati dall'installazione. Se / Telemetry ", "Exempel: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "micas (b", "ru mimariyi se", "l0J`A", "li|hv", "CDlpFile::GetProgress", " ,#ur", "woY,^", " soubory do adres", "{YBJG", "ym1;[", "{QagZ", "emts, ka sp", "e,/%+", "EKm-hon", "wfv", "$[\\T!", "![<;n", "%j-K7D", "20201008142756Z", "H^Cz|", "Ejemplo: setup.exe / auto upgrade / Telemetry enable", ".<\\tB", " nepiecie", " tai luo pikapalautusosiota ", "loh po dokon", "{6Kyf", "8&8,8H8c8s8y8", "Bh_-S", "%K4sv4q1I", "rder efter att installationen slutf", "Q9BV3", "\"E@VNm", "In\"n&", " g5pW", "y,[a", "sYqa80", "Z&c-%", "q#D/L", "ADfur_ ", "'k8S&g", "ZbnH{", "9E*V-", "XOSQ#T(", "iN:I^", ";>k\\?", "]kEA|", "CKd]ixT", "?N]M~K^&", "T%22/Qc", ">WeY##", "iKPJX", "N%gf/1", "3[K[?", "uHJjz", ")oW1h", "~rxWN", ":A:O:X:n:|:", "YqS'p", "L/!?m", "I_RpcMapWin32Status", "Parameters: Local file path or UNC network path to a folder that contains .inf files ", "Parametry: M", "nt a merevlemez-meghajt", "cie, ale e", "& nID>cCl[", ")JLgt", "M,", "terek: 5x5 term", "lle samasse kausta ja k", "6.Kde", "rG_jW", "dkZ]]", "&&sSk", "\"G_#)", "mg_WP", "?4)bP", "@-(@E", ":ex'U", "!wbdj", "s visus draiveru .inf failus, kas atrodami nor", "My\\)c", "b-&w_I", "9Qn\"#6e", "%&,Y7", "\\&&Wi?", "2DeZJ", "mOko7", "v^'a:;", "jJiyjy", "0%TIC", "Ec?)^", "888D8d8l8x8", "t4}qo", "C|&:Ig", "ActionId", "ESq@&", "enete ra", "j0}!N", "QcGjZ", "m", "rs`5E", "V$^dN", "ho programu pot", ">?&:Q", "U}y3Ph", "w---e", "jo laikinai nutraukti tinklo ry", "\"8|S#", "mvY>\\", "b7qQq", " na v", "iadne ovl", "]jC+]$", "Ji&xj", "Usmaa", "kXRs$", ")5l&]", "Xw/K}", " o creer", ")a]A?", "(E7>$", "O-;*!", "0\\`DY", "5e--94\"", ",ieR5", "ADO[T", "dV![?", "Ix;Xe", "(=zv8", "6v*Ar{yO", "Pa_UG", "mA45.", "F\"E|7", "|$(Y3", "H^,\\XU", "4MZ(m", "'^CU@", "z del medio de instalaci", "w{[MV", "UNPqAx\"@", "5T#sy", "081604B0", "fr-FR", "N\"x68.", "0;wGn", "N&hq-2", "wU.CY", "Malgun Gothic Bold", "o (conhecida pela sigla OOBE). A linha de comando seguinte pode ser usada para organizar toda a atualiza", "UjY-D", "x8O[J", ".tls$", "fDyuq", "P>F8ip", "#ZGC/", "!$ v3", "}l? J", "Primer: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "#G8\"I", "Mj;B(kj(v", "L<5dEF", "~(2,R3|A", "ZC?6'", "{hRO2", "LoadResource", "z^RoX#", "-)]Gh", "QEiLg", "`.6|E}", "{v.jJ", "dkFuu", "Installasjonsprogrammet starter ikke slik det skal. Start PCen p", "d Product Key> ", "/JYpm", "k2u|+", "'Forbereder installationen af Windows 10", "/|BGZ", "v\\7n3", "[CxTCx", "K3_6ln", "{97x*", "", "rH~]]uk*V", "\"%s\" %s", "installation ne peut pas d", "borov. Ak ste predt", "Continuar a partir do ponto em fiquei", "Q*z@O", "Php+A", "ki unos potreban tek kad ra", "B<\\xr", "r{H.~", "4PFOW", "3)_>u", "SVjrfV", "HJgADx", "KsijQ", "0.~pE", "Q00Cy", ".?AV?$CAutoWdsLibFree@PAG@RAII@@", "L30'Z|", "7on^a", "si utak ", "Bryter: / Postrollback ", "v-Stj", " loadFrom=\"%systemroot%\\system32\\combase.dll\"", "S&NXp", ">zjgW", "u2R{1O", "=kl\\W", "VWPj)Z", "~YW>E6", ";0;l;", "Y?l7+", "Na primer: setup.exe / auto upgrade / showoobe potpuno", "^-0TI", "[yBiz", ".qYv6", "a&lej", "q|D8Y", "kIyGF", "Wpufo", "@QVrq", "um85Nk", "]oNJdFF", "M*\\ K", "'K7Yf", "l2a!X", "~/Y00", "#@0UB", "),]sM", "K)-#n", "$:YB`7v", "4c#vS", "]%`4>", "#BAw\\ ", "K.?G+", "~W_H9", "DP(zy", "j6!f5'", "DyL\"gd", "K1u5F{", "buj ponownie przeprowadzi", "_vZkz", "T'|Y+", "070Q0o0", "+#JfF", " skriptu setuprollback.cmd: ", ",^$[3", "wo^:P", "7-Sgp|.o", " ", "]vWTI", "yZ,`p;", "stama k", "vob:0o", "JtT[wBOi;", "6b", "'T4*`", "01{R1O", "*6ZTlRTl0", "ZZ~[]", ">!ZZm", "is-IS", "zom<9", " installasjonsmediet.", "/h44B", ">B>u>", "Ph0|@", "!BL$B", "3D(Cr4Hz", " ppp", "gen. Det h", "wwUv!", "c6ELO/", "Toiming: installiprogramm sisestab installiprotsessi k", "}%~Qu<}n", "&b4p\"6f", "L2Bz8", "wI>Ww", "dha!b", "$Qh,S", "fh2=X", "anas programma neatjaunin", "p_0PLfc", "#D;&xK", "qp%vR~", "onF-A", "I(\"S#", ".5~76", "Q~*iT", "-)Vgg", "3?E'", "LU{b0", ",K~)A2", "R--0eWK", "tbTy|", "9AP,u", "x,L3 ", "SdBt%", "ewF#F", "9!r]lJ", "d'ik%}", "LZLFxKO", "ri). ", "4/-L6M", ">\\{?!", "w=s=Z", "ned ettevalmistused", "qQ-MUv", "Failed to clean MoSetup Volatile key, Error: [0x%X]", "UL%0.;", "LX1/N$h", "Parametreler : Yerel a", "ytkownika dopiero po pierwszym uruchomieniu (w trybie OOBE), nale", "'?", "&Anterior", "\\JurnaleUpgrade", "\")2WO", "wz~69}", "^E09x|j", "rii, dar ", "g|eLF", "F]zLKD", "cHIIIYY", "3r*`r", "EtM=s", "CDlpTask::GetWorkingPath", "mqL]~", "bbbc#", ",[oIiu", "1Tc@!", "EnterCriticalSection", "o3SECU/0", "r>~+3]", "+R]7Lj}5", "EEtnN", "2dfBU'", "Du5f!4", "Valitsin: / installdrivers ", "UeK|JM", "Nbiik", "'LlRs", "zlJhVY", "3M'jz", "rs: setup.exe / auto clean / installfrom d : \\mans_Wim\\piel", "Tat20", "rQ`l_", "7<@%n", "nd@%A", "(+}Uc", "hxN?5=", "lT_.Z7", "Koristite drugi instalacioni disk na kojem pi", "oWw: ", "L'K~\\", "tNi8KX", "nEe{9", "QO;.A1{m", "|f 1m)bQT", "r das %s-Bit-Betriebssystem. Beim Einlegen des Datentr", "fGm@#", "x_r1|", ")yIas", "FdNYn\"9", "\\##$'", ">r#!U", "Detectamos que la instalaci", "q$gN<", "030l0", "llyel ", "i46EV:", "HV(km", "5X|ZpW", "WIMInitFileIOCallbacks", "BoxMovePath: Target path exists [%s].", "B&)y}9", "ZlsOlAd", "fw)*n", "^dz(>+x.{7", ").44w", "lna po", "szleg g", ")^;j{", "d$B7h", "I!cak!y", "lq>81", "$L\\%E", "HAB% ", "]UOjI", "Installasjonsprogram for Windows 10", ";>=W^", "jao-4I7", "Hq@_GZ", "Wf0\\vr", "|v&QP", " ho pou", "X3Z%p", "{5yv_o", "gKV2m", "_hG d", "tUrR4qb", "Igv!$0", "@Cenh", "E.%TI.", "ende brudd i nettverkstilkoblingen. Pr", ",=Ig 9", "j}CE}", "v)jWoV", "Windows 10 Installation'Windows 10 Installation k", "/!$7{,", "o\\#,n", "`\"hg{l", "righet kan saknas att kopiera till s", "<3 ", "*g_F.", "}\"shO", "8=j*qZ", "LegalCopyright", "5(5C5z5", "? e-*", "04to!z", "pqxQF5", "x(<),9g", "Parametreler : N / A ", ":q%**=", " BD@B", "IiB&e", "#aOm[", ",3'K`", "j([nv", "=T9:0EO%", "X;3Q,J6", "hpY*0", "E=(i=", "Switch: / pkey ", "S34(l", "Y^6M-", "\",'L'", ";Q}},F", "Parameters: Local file path or UNC network path to a file named setupcomplete.cmd ", "{G0B$", "/SuspendId", "a)FKP", "ib'/)", "|pHYhL+F2", "vS.QS_", "_%i8Z", "5_!NuP", "d#v1b", "' Dyee", "m~\"~l<\\", "-B&kdw", "^#eUJ", "L!knt", "j2#}}", "n: cuando / PBRUpdate", "oC.G$", "eJ+e'", "I0;&&bd2", "1A_M@_M^EB\"", "sH0SF", "\"xI9|", "r\\4H]", "6~e!UTN/W8", "Jm+&%M", "Found ESD file: [%s] [%s]", "LU}Bi", "Voorbeeld: setup.exe / auto upgrade / quiet", "=pJ5C^", "0i6;:", "a,rD~", "H2G >", "q \\Se", "U6AqCe", "lRt`Y@", "*y9;v:", "CUO^#", "t&,H+", ",b?uv", "g`YL=", "BI-$K", " ", "J-lCjU", "o}}0!", "~0\\bW", ">sE\\,", "PvN)k", "HW:\"u", "C,-/5", "@(;Umy4", "ivatele se vy", "dn_nJ", "X[0\\H", "&010n0", "gND6G", "(h;;=|4", "w44p!", "G1^!C", "*]%I\\", "ur(rr&", " None, ", "Z+~W,", "2)nS0", ": / Postoobe \\setupcomplete.cmd ", ".:W~0[", "Q)(,~8C", ":1ZHv", "4f);z)", "(yuA'f", "\\`QttX", "bi valmistarkvara kohandamise (Out of box experience ", ". Tento p", "installation ne le red", "e a je", "B\"R7p*q", "pLTIJRjoZ", "5ex~I", "1~V5J", "uIAn{g", "`=Q7D", "v=>SY", "marrez le PC, puis r", "Try\\Q", "0+0V0h0z0", "(lq$v", " ics2,", "6L_3-", "CoCreateInstance", "~U1B@", ". Jei anks", "8QxH0\\", "7pGT/9", "LAg`Q", "A$'AJ%S", "+_,\\5", "%s: Box file hash matches.", "Legal_Policy_Statement", "nkt*?!", "!BHZ[", "(KR2<", "loy^>.p-", "PhP%A", "p>H}L", "{f%{f&", "WGNwe", "M6[e:", ": setup.exe / auto upgrade / PBRupdate disable", "(8^\"4", "7i\"N\\oo", "fl K*5", "T/BMc8", "v88F}V", "rnek : setup.exe / auto upgrade / showoobe tam", "Example: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd", "IW`Fu:@", "_9aw[", "metros : 5 x 5 clave de producto", "8d2Vc'L", ".MKFr", "RjEdB", "xQeDn", "fxm\"S", "!;jbA", "=1u+O", "N*'?0z", "T#/f@", "Oa\\;z", "S}mh7", "*l6%%", "%>cNz", "tVh8X", "+YYn*", ">H>O>k?", "m:KoZ", "O{gx_B", "CheckTokenMembership", "nhR\\zZFZB", "A\":2ap", "C^6*8", "4m:sg", "NVersuchen Sie, Setup erneut von einem Eingabeaufforderungsfenster auszuf", "7Z>@B1", ");!e\"", "rs: setup.exe / auto upgrade / postoobe c : \\skripts\\setupcomplete.cmd", "OD^t=2F", "Parameters : Local file paths and UNC network paths ", "/|]K\"", "1#uWw", "N#k-$", "#W_g%", "Qy4?L", "q-ZXM", "pxD%i", "T_T*d", "7#)i7", "jOm&g5", "ki program. ", "qnV{pS", ": / DynamicUpdate ", "n7v6T", "hh>z&", "kuo4q", " *XY(", "@$.0a;tN", "BuildInfo: [%s]", ">{tRZ", "B27%a", "z2H54", "8sd^_", "v}DU<", ",hZH6s", "zhVdk", "mB0`T", "(??UI", "[Xg27", "prava", "_F|ZzR", " ", "_tp8~", ">Wa8pM", "~:Pwc", "kla piek", "V-Fnr", "'I,Y-0/", "q%^nj", "I7(' ", "|$HSQ", "evdyY:", "khT}d", "t\":.#ul", "Ns;$=", "JLk96P", "[W0~0Y0", "\"x*O;", "E4.G>t~$", "yoJCE", "F}V~oe", "L$$_^[3", "000M0T0Z0_0j0t0", "MU2I$", "ide: setup.exe / auto upgrade / PBRupdate disable", "ve detected that the install is occurring from a network location and may have hit an intermittent network interruption. Please try setup again", "xJK/N", "U_8M@", "{B6>u", "uT$jQ", "=Hqw=", "@8go4", "SetFileAttributesW", "co-FR", "n de 64 bits de Windows, debes usar la versi", "uB=^8", "EOJmr", "1nfar", "[8^Z9", "n / files.", "bL7_4", "O'y|Z", "uvvf:", "xl`Bvprs", "U:$U=J", ")ns{_L", "7^]=O4U", "Pravne napomene", "o : Automatiza a instala", "k&nsi", "lus. ", " oblas", "E#~Av", "4QF!:S", "#lwfzx", "`~+yO", "FU.q)p", "X}I3U", " a Windows-telep", "[jKB}", "il a termin", "^2B:a", "Anahtar: / Postrollback ", " til Windows Update i appen Indstillinger for at f", "Eun\"?", "installation va tenter de faire migrer tous les pilotes dans le cadre de l", "VW-FZ>|>", "y|pW~'", "V#etwd", "a2iw!", "zy/VeQ", "7.8 K", "Windows 10:n asennus", "_* /w", ",64", "\"LNmF", "CyJg`", "V!lX@", "dbmw.", "o0'f}", "Task->Deserialize(): SourceUrl = [%s], DestPath = [%s]", " Windows 10?%", "anas proces", "eeei.", "rankos UI ir eigos ekranai rodomi pagal numatytuosius nustatymus, bet yra automatizuoti. ", "pBlB}", "|Z%=b", "V',y?", "jt}1z", "Zf8l&", "A+VTH", "_79gn", "wa!\\#P", "8)~FG", "/L]m{", "d7mYC", "CW m;", "Install.exe", "wp4Op", "A8M]*", "\"vu8R;", "uNEh)?O", "s6+t=", "n!r9V", ":*nh*D", "%(_R8", ";i`eQ", "'vqW;]", "9TWI|", "E];o?Am", "n de Windows 10>El programa de instalaci", "nN0v3", "FY`OC", "J)YcCb", "0NA$H", ",AL^ x", "Setup voorbereiden ", "Bbk/,", "ratud asukohast faili setuprollback.cmd. Setuprolback.cmd on kohandatud skript toimingute tegemiseks p", "-p?YE", "7=!\\_Qz", "CBnume", "echny soubory ovlada", "zvom setupcomplete.cmd ", "@3P*!\"", "JRw1M", "9Hm6)*", "CBootScenarioCtrl::PopulateWorkingDir", "j;XVo", "0jri9K", "sjMe=W", "!Ymvb", "l^.h_{", "o: quando / showoobe estiver configurado para", "hG,x<", "kb1|qd", "mL&g ", "[s$AjA", "&> %`", "__set_app_type", "jlokat a megadott helyre. Ehhez a sz", "m+KX}", "pea0o", "Bei$w", "@@@```", "$zIKS", "0?c$@0", "~=9bK", "P}5j6Gh", "^']?[", "jV`Y7", "gYX9V", "lImB0", "N]c}-4y", "Z}43b", "Na primer: setup.exe / auto upgrade / copylogs \\Mojedeljenje\\Evidencijenadogradnje", "n especificada. Setuprolback.cmd es un script personalizado para realizar las tareas despu", "[j1]}7", "Ou%8j7", "QP{6P7", "Y_&}5T", "F*nEFX", "+!#CtE+y", "GetModuleFileNameW", "zB%}R", "DYmQF", "$In", "/>oj.", "M&za27", "finie ", "_J=S1a", "exr?!", "*^Yhj", "Q`fJ)", "|'H\"T-", "4.7h1 'G-)", " nast", "SetupHostResult", "re verkt", "NvN5-6Q", "$|cGS", "`v:Y=g", "1|IaZxL", "d,CAo", "[teGS", "3*Nq6M", "0?&$@0", "bUP'I1b", "VerifyVersionInfoW", "~v ?e", "(>D!d", "cUv(9", "iTdkJ", " (OOBE) ", "A\"(_' ", "kk[xmeeC", "9 ~8|", "d^ ", "surea abil saab juhtida kogu ", "pHKXI7", "] 5~?", "ICu~MY", "Azione: se l'opzione / showoobe ", "r kopierar eller laddar installationsprogrammet upp komprimerade loggar till angiven s", "8H|2$", "ica je najmanj Windows XP s servisnim paketom SP3.", "Y[|`a2", "=2=K=R=X=]=h=r=", "2oEyC", "^5(*g]", "OfvQB", "ite, da v primeru neuspele namestitve za", " en ejecuci", "z. _l", "k+o%?a", "WeN\\OW", "GzzzhhhWW", "VG>d>n>", "v}$=m", "I9zWk@", "0)R(uq}", "G2bga", "7:<&:", " (47K1r", "1usv1", "\\c;ru", "ile de nivel inferior ale sistemului de operare. La urm", "v3zq!", "buj jeszcze raz uruchomi", "Voorbeeld: setup.exe / auto upgrade / noreboot", "syX&m", "FE.n6brq", "v1_;D", "se,~~", "FFD1@", "hERRq", "0F~s$", "np@IIn", "me, elle peut ne pas ", "b|q! j", "|Pyoj", "B!NkB", " All, ", "finie sur d", "altinio laikmenos viet", "[|!0,", "G@i!(9B", "DU4P5", "]h}W.", "sZVyD_>-w", "o com a designa", "W]^Koc", "k(mS(m", "wAOq%", "jimas taip pat apima ", " J'?8?", "WYUF ", "o / files ", ";-;8;Z;", "#@IDp", "c4n~}H#", "MwJ;g'", "->mCa", "*u2GJ", "d21O+", "T=Cy&", "0@e$@0", "9O:x:", "uzkd)M", "MD;=i%", "7'_(4", "Bb4pw)", "l98D)", "AzHC\")J", "\"~Ir#", "AoaQ[E", ".U_%F ", "K\"T 0", "PPQhp", "9+P5o", "q|2,v#", "k*7oj", "\"3^FF(", ")|jeuo", "'0i3Q", "ARABIC", "kaz sa sp", "-j,*x", "Commutateur: / auto ", "\\Y??R", "rj}2p", "{\\#L]", "jI~WuUr", "bi/`Ls", " wdscore.dll", "`G4zH", "Zqu_$b", "(nRF&", "Kz<*<%4f", "::3u~", "DfOmr", "jw2+,5", "kipvb", "-67KX:cA", "}OqQ*q", "E%oQG", "LeaveCriticalSection", "Indstillinger: produktn", "D|]g&'T", "Tr/!Rs>", "i1LD;", "tXrJrM", "Vd", "kX*_A", "1!1v1", "?#kO k", " need not contain KnownDlls since those are always loaded", "fn]Fp", "W[9j ", "b<0pQy", "G-']#", "kO]Gxw", "sqkf?y'", "i{g;%", "7\"_t(", "!D20cb", ")W;dB", "hl}G5)", "d($-5", ".E'`Q", "a[;./]", "ms-BN", "laties beigt darbu?,Vai esat gatavs instal", "velet: Ha a / Telemetry ", "ar-IQ", "zp#j_\"wR~", "fy$.f", "PRRRRRRh ", "]om%j", "ppp@@@@@@@@@@@@@@@@@@@@@```", "_9B9c?", "q(a=W", "Actie: hiermee wordt het bestand setupcomplete.cmd 'ge", "Yz+T)", "p+]{5", ":M%I.", ":],/+h.0", "`)}25", "F@bc ", " et les composants sont d", "R]+JE", "!]>$mnG", "xnsEP", "?E=7)>PQ", "$C_^A_", "{\\G{w", "^rqc~%", "sU\\]E", ":AgxT]", "VERSION.dll", "7 >nl", "ho umiestnenia. Po", "'H4Q3", "non-admin", "e pour orchestrer la mise ", "DUDownload\\Cab", "p:M\\p", "Veiksmas: kai / migratealldrivers nustatytas kaip Visi, s", "$,@Vf", ",|Pc,", "lb;p6W", "BEm5^", "B+[9b\\.", "berpr", "ka izku", "rnek : setup.exe / auto upgrade / PBRupdate disable", "mK0qW", "_-(t]X", "7~u_@'", "oID.^", "?we7/_6", " flere oplysninger.", "?goPs", "urt#Z", "*&i_ ", "mas Windows versija netiek atbalst", "oO474", "n7k9:", "2>rO:", "R08Ic0", "]&z7<", "VN~d,?", "h!mJe", "O&|jb", "Setuprolback.cmd ", "fO=G7)V", ".>#Mf", "marrez votre PC, puis r", ":pdK1", "q}3-Oh", "T\"mD`", "{i3I'", "q%y^", ". Setupcomplete.cmd est un script personnalis", "@.q`H", "S.A/L", "c]{kn", "chten Sie den Vorgang fortsetzen?", "=/.=%", "SG2w'", "\"/U#|h*", "1<1\\1", "Uwzh{", "JjU@=", "Wez{_", ";1;8;", "e se automatski ponovo pokrenuti.+Nije mogu", "525?5F5q5x5", "9soMr", "Lhn5f", "Voorbeeld: setup.exe / auto upgrade / migratealldrivers none", "\\1LN2", ">[g^sE$", "em3Ml", "&Pirmyn", "K0Y)uA", "'g=f6", "s{6js", " den angitte plasseringen under installasjonen. Installasjonsprogrammet s", "tAV_xI", "U~7XJ", "rj!OTuK", "Pripravi", "GetLongPathNameW", "/>$$@0", "z[DC_0", "C'(|c", "*`>+Z", "#A.0T&", "o para o diret", "l{jdM", "?&?6?i?", " WindowsL", "]H>:'N", " (tu`", "%s: Failed to Detect Resume Mode. Assuming not in Resume mode. Error = 0x%X", "m]#uq", "|Q\"Ij", "'WR{1", "B[ C{y", "yzrox", ")?#$f", "-%Y*m", "hwV\"_", "uje da nakon pogre", "RxiMV5", "\\", "+ma=m", "T_(=q", "Parameter: NV ", "V%pA=", "Oi.2r", "/$I[GUr", "E!\"bB(", "?&<{_C<7~", "\\UjP`u=", "[lgZZ", "e prona", "x`]wZ", "bas. ", "-Q+NDjm", "MN)wI", ":F'T?", "qa[W2Bcu", "4Rv_", "7sg_{V$", "4o]`.", "j&=_3", "Dvh3N", "{W8i}}S>", "/Q2Sh", "n medii de testare. Nu ar trebui utilizat ", "U:tCl", "L;#KTP", "CSetupLangIniLoader::Initialize: Failed to get the language information: index = %d.", "In3KR", "B1g)un", "] B5!", "G8u%j", "kler veya y", "kdhd~d", "e{#>:", "8dZ0+Y", "1j\"]G", "R#F|<", ";!C@{", "3$333D3W3g3w3", "}3/eR", "ed:!]H", "7t3/7", "_ y+P", "I4?(EiVo", "rexcl", "vZ'US", "nda, son kullan", "t Windows uzst", "J/&JP.", "!#ql]j", "D/19k", "{ g]Gfn", ",t5e;kj", "*]7Wd", "%Up/L", "$X[).[", "_bVM3", " : / DynamicUpdate ", "!{#9y", "?;%a'", "Global\\Microsoft.Windows.Setup.Rollback", "ux-F|v", "Y;<+&o", "[B}ZlP^", "W((f<", "I(#``", "P_N6a^", "MY-8-", "X*YWm|", "{3[UR1", "dvj;=", "lFY]R", ",X#nl", "Z+lhe", "gy lehet, hogy nincs enged", "m77eN", "Conmutador: / auto [lO7", "8Z9e9", "za%$-", "vr:Xu", "aygE8", "es). ", "oag++", "LP{)D", "5XW,'", ";:(Hh$", "terek: Enable; Disable ", "JuqSM", "WQ:e\"", "7&GE%", "_!/0B", "}:?nC", "e&1N1", "er. Den b", "JKPyw", ")KRrl", ". Ominaisuusp", "^B*UL", "b*%]L", "system32\\cabinet.dll", "=^^eI3", "KLX__IY(", "rv%{d|", "G/Utb", "CDlpManager::CreateResponse", "u6:s4", "u0;<$B", "/OR/@#", "@m'94", "$&e -", "api-ms-win-eventing-provider-l1-1-0.dll", "%p+eM", "iqU; ;", "=CJZ%", "7an<6I", "x\\(s'", "_|s?|O", "KU_|#Q{}=", "&:-0Y", " program se nespustil spr", "ch5&GP", "BGi\"a", "p)lU{", "zVwc5q", "MySMM", "@o,rY[", "oTMx@", "5&_M5", "r>ma+", "j% [/", "mWOuR", "js8PJ", "EzDF.", "2rCoD", "*X]a5coT", "1.`='", "Radnja: Ako je / Telemetry postavljen na ", "{sw{/", "Al!yM\"", "D:~Uc", "^9>mKz", "}+|+}q", "D`N", "-YVy6", "b&&|3**", "v*}$s", "/ PBRUpdate ", "M-u|'", "s du fichier local ou chemin d", "vqC\"SB", "ni, de az els", "|C05i", "Y<,L-", "S:.\\b", "({}~1", "iv zb", " till %1!s!. Vill du forts", ".U)4&|", "&9h@Ec", "RW0f0", "t&rG@", "ier denumit setupcomplete.cmd ", "1Ch_s*", "oE,vc", "\\AF9)", "NAPOMENA: ovo prebacivanje treba da se koristi isklju", "Y0f`]", "|4nfj", "V]z~n<", "WXFannU", "(5z>b", "5j~'(~", "kZI?oH", "ActionName", "}:hTyl}", "qvr;$", "y)]`O", "+4@WbI", "H>}yS", "njecteerd' vanuit de opgegeven locatie. Setuprolback.cmd is een op maat gemaakt script waarmee", "2bVg^", ":#:=:t:", "D^zo82u", "Conmutador: / pkey ", "J.EUlx", "+suac", "9j@#-K", "a?_8Z0", "CUUeYfO", "~Zds{J", "rca telemetria generat", "tjV57%K", "./ELN$^O", "TJF_9", "9[IE%", "sA8CK", "t&H&&", "lgende kommandolinje instruerer installationsprogrammet i at aktivere setuprollback.cmd-scriptet efter en installationsfejl: ", "uUF?R]", "Oc0.M", "Q2,T?F~", "n, pero s", "qaJ", "VL(A^", "tres.", "rm:-I4", "$nOH^L", "Koristite drugi instalacijski disk ozna", "_mIMq", "0OfZ~l", ".lo+@A", "Eksempel: setup.exe / auto upgrade / migratealldrivers none", "nd / migratealldrivers este setat la valoarea None, instalarea nu va migra niciun driver ca parte a instal", "i testov", "D+|U3", "q-;vq<", "Wg7O(FK", "lx\":<", " o^s=", "n insertar", "~5B3L", "z|t1I", "Br8uh", "|~8zcdb", "L}R-i1", "Twvd,H", "`/+=E", "Konfig.", "RtlAdjustPrivilege", "v+YM", "4WZ-m", "4]\"RY\"", ": setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs", "Eyyq4uc", "{%Y+Kv", "installation de Windows 10&Programme d", "b\"\\\\{", "gsta version som kr", "x$`3r", "lU6F<", "V\\I}i", "`BPy^Y~AAn>(7", "'>hHH/H", "uUYA)", "em PC-ju. Primjerice, ako PC koristi 64-bitnu verziju sustava Windows, morate koristiti 64-bitnu verziju alata. Poku", "=I-Kz", "es-UY", "cgpgU", "U1%44", "fnrJ(jV", "p4%uf", "yhms4", "zoB8[DQ1B", "brXo!", "y\\P[i", "Senaryo - Tabanl", "\\'9nn", "N*U`s", "o: automatizar a instala", "fq0X$", "_.uG+", "\"&k=&c", "%qs{b1", "G9o+Z-", "gR5#S", "Z}:H;", "WcQ/&5ll", "im naredbenim retkom instalacijskom se programu nare", "w .inf", "QP4=k", ",0Tz4", "O+`(U?s", "[KwJL", "L$$Qh", "Zc[PS", "}u0,U +", "(#&9CK", "5+At\"c-*", "CSetupLangIniLoader::Initialize: Media number : %d", "M]9lC", "]r0~h2", "; <@nSz4", "hYjl1", "f>cD6", "kega vmesnika", " tilbake til %1!s!. Vil du fortsette?", "9 s|4", " a ser executado.`Esta vers", "lla gr", "```PPP", "S*9fy!", "YbzFEzaK\\ ", "Z`#?-", "C?@:Dz", "5(e8`", "K)+tHY0]", "DcYw,", "O:dF-", "s}8>'p9", "nima requerida es Windows XP con Service Pack 3.", "-Obi>", "ni putovi ", "h8*>e", " el PBR. ", "rksstier ", "Q]6LK", "h,`g0", "erlerine ayarlan", "ndaren loggar in. Den k", "22272<2A2F2K2P2V2", "=1]e_", "M;}C?A", "[@2G~", "tt>)B", "q.il8(", "(OrR$", "MF}I^", "pe%Cr!\"y", "U\\Ubacl", "xKN!}:*", "CDlpManager::SetWorkingPath", "h4rq3", "xazU!", "AI2*d", "6JtN-&", "cie systemu, wi", "$FMy", "gV:(1", "[>WO,", "'zqJk+v1", "Jw5MX", "E}vSQ", "0mQ$*", "u|zFt", "it^km", "A|cpbP", "9rs3r", "7S'(K", "oikeuden tietov", "rNI+7W", "xN>f_m", "')?W-F", "m-z5g", "AqI|H", "$Cnlzh", "ts %s bitu. Kad to ievietosit, Windows 10 uzst", "JL1hR", "R8/jzl", "K08*i", "Q=EoW4", "j33D3", "iQk d", "!oVYB", "Paf+X1", "Parameter: Lokale Dateipfade und UNC-Netzwerkpfade. ", "?5kU_", "jz9]c6", "| 7pPn", "t9[*x", " suorittaa ty", "hbxrP1", ">5Ewj", "]kr0r:w", "q|ve@", "JKiXI", "mA_L.", "8DC9@@", "tZ\"YW6", "l<]`4>r", "Primer: setup.exe / auto upgrade / noreboot", "$hNy+", "uSVQ[s", "5JCst", "4.mfe", "`-,}?", "zftgfe", "6,oXkx`", ".ljMlx", "D)0Ij,", "?b},T", "++oKX", "bsLK4", "+riZ]", ">E>S>\\>a>m>y>", "i aceast", "17Y!(", "zASz'4C!", "PWPPh", "0OI>{@Y", "TpzZ;", "*=]U]U", "PEV$m", "mn-Cyrl", "Na primer: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90", "H9<{`oD", "m`Z?I", "~$/Cp", "r]g76s", " !\"\"\"#$ &&&%%%%%%%", "o5Aou", "ScsHkCf.-c", "BnD-ev", "#ir^T", "LocalFree", "t,jkX", "B>p6x", "tfCIF", "Y<^*spA", "Upa%J", "\\k>7?", "ver interagera n", "/r:Iu", "J~4gaff", "?i3EI", "U-cZt", "HyAqUxk", "OR&S]", "\\\"}*q", "#`HZb_u", "Bo'=7h", "GORV/qP", ",Fujg&u", "].UB[XB", "B", "\\._aEn", "#qbfsG", "OnZT^", "X[x[@", "UM1-'b", "U}y\"?", "setupplatform.exe", "GH9_ t]", "/0XTsh", "'U3HU", "y<6)u4A", "r computeren n", "8$8C8w8", "v&zig", "xs{sk", "9w-=0", " XML6", "u '^XU", "(A5'&", "CVNY=", "ZXv.EG", "mLH3V", "+}O3Dhu", "9>&ipu", " \"setup.exe /?\" ", "-eZe ", "Y-?2X+", "jW!L-", "0L0J0", "0$0B0N0W0`0n0w0", ">_BF`", "vME>2", "kk-KZ", "bor Install.exe", "\\Hx+x:", "3e:N-", ";+;>;E;Q;s;", "^lR'rj", " VV4Z", "Ijj&&n", "s44x$+h", "<\\=c=", "nR\\-n", "xP\"D_/", "metro : / PBRUpdate UVk", "VivWwsmVOjon", "$P}Kn}", " / showoobe", "DrF>E", "gAIZ${", "jzJdF", "uN\"+Z", "j32j\"Tj", ":+yhd%", "tu. Arac", "2$N5\\", ";.|7q", "8Gi*2D", "/2<,|@", "C&~5$", "nUZj8", "3i#53", "{iA)YQi7", "H%+`M", "vt&p2", "R#sDb", "Ybs+3", "andz@", "adowe zastosowania ", "2A+`9T", "kEJL@", "\\SG}5", "9`b$I", "$,54G0+", "5RVCO", "vi9&2", "Windows 10 Kurulumu komut sat", "ke Disable, a telep", "Ic;f>g", "0?ceQW0~0Y0", "yj*f[}", ":,B%>@?", "bg.R*S&-", "Parametere: Lokal bane eller nettverksbane til en specific.wim ", "as-IN", "blhuuY", ", kuruluma, bir y", "v#8kX", ")avx~7", "3'X;f/\"", "=vR%w", "4Wza}", "Gg!]~", "prh{9", "$rZ.'", ">$aW/A", "nH=r{s", "GrJg7", "#ua5[", "Example: setup.exe / auto upgrade / migratealldrivers none", "23383", "x&v-J", ".rdata$zzzdbg", "#s38m/", "nGsV+E", "r@ySt", ":q:{:", "\\ymJ/", ",=u?.=4", "J;?`>", "2t(=SX", "Thz>&", "& *QX", "*E,F;$", "2dHUYh", "#v:|/j'", "~YE&!", "kuZaF", "Bd/Nj1", "|;G\\+", "fAS1-" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "a240c1bc485d3c05bd206ab08cf1d6cd331e1bc13bcbcef79bab614039a28243", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/a240c1bc485d3c05bd206ab08cf1d6cd331e1bc13bcbcef79bab614039a28243", "guest_paths": [ "overlay" ], "size": 7914776, "crc32": "FA9F1F14", "md5": "69dbc57653fcb01314df4ae6925c5436", "sha1": "d7e78e5f03e6037ee196c2aedcf1521214689b6b", "sha256": "a240c1bc485d3c05bd206ab08cf1d6cd331e1bc13bcbcef79bab614039a28243", "sha512": "d9b562224f139fa1ffb186d662c5f0fbe87923dc9d6492c85c176c64c132e6d86e1dc309102d12f7e4dcb92517b6edd26525b60a14913f7c3e9c6fdc77f96a90", "rh_hash": null, "ssdeep": "196608:AH1km/Sf7byFXKEBmih9S5rQ5FNFl001p4Ki:UB/SDbyFBH9eQD/l00/4", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T123863357DF46AF0AC045BB37DB105C20B808BB5968190583E33AB7864DB1DC9F5B6E2E", "sha3_384": "cb06a58031cf175e6fb6fd21003a59beb29b0c4d039a115fa83f6894ba32710a5a4aa0bd19c094fffd1fa771b6ad1d60", "data": null } ], "extracted_files_time": 0.010533708002185449, "password": "" } }, "cape_type_code": 0, "cape_type": "" } }, "dropped": [ { "name": [ "DiagTrackRunner.exe" ], "path": "/opt/CAPEv2/storage/analyses/3/files/488cbc8330952dd13b797bb40e4e30610ed03483c25919c39555f7b334a3c159", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" ], "size": 79040, "crc32": "3FEC6A69", "md5": "76f30a1e149792d2542a253b920cbef6", "sha1": "9040e0873df5cc2a64b850d1b8159b77528ba62c", "sha256": "488cbc8330952dd13b797bb40e4e30610ed03483c25919c39555f7b334a3c159", "sha512": "ec39861a3f39f88aad52975974c988ae76376a09136d95f5d4fedd60ee7ec252736d882cef77298d82d786e0dad13c61148b29d7c5fb7ba7d7c74b05de9d7e84", "rh_hash": null, "ssdeep": "1536:ctlKhKIqVXrOLgef8j1D8KxLQgSSQlsJkGAsC:SlYKrOMso1D8KxLQgSdKJMsC", "type": "PE32 executable (console) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T153737F42AFEC9429F4F35B706A799166643ABDA58B12D4EF7001638D9871BC0CEB1733", "sha3_384": "d59fffda095e37c1ca62e53916873f46d1c987204ce37f37e790286d0df1f06b4b10a685f3de1d04c77ddd062d67c6be", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x000055a0", "ep_bytes": "e833060000e92efeffffcccccccccccc", "peid_signatures": null, "reported_checksum": "0x0002154d", "actual_checksum": "0x0002154d", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "diagtrackrunner.pdb", "imports": { "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x408000", "name": "EventWriteTransfer" }, { "address": "0x408004", "name": "RegCreateKeyExW" }, { "address": "0x408008", "name": "RegDeleteValueW" }, { "address": "0x40800c", "name": "RegGetValueW" }, { "address": "0x408010", "name": "RegCloseKey" }, { "address": "0x408014", "name": "OpenThreadToken" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x40801c", "name": "LoadLibraryExW" }, { "address": "0x408020", "name": "SetEnvironmentVariableW" }, { "address": "0x408024", "name": "GetModuleHandleExW" }, { "address": "0x408028", "name": "OutputDebugStringW" }, { "address": "0x40802c", "name": "GetModuleHandleW" }, { "address": "0x408030", "name": "GetCurrentThread" }, { "address": "0x408034", "name": "FormatMessageW" }, { "address": "0x408038", "name": "RaiseException" }, { "address": "0x40803c", "name": "GetLastError" }, { "address": "0x408040", "name": "SetLastError" }, { "address": "0x408044", "name": "GetProcAddress" }, { "address": "0x408048", "name": "GetModuleFileNameA" }, { "address": "0x40804c", "name": "GetCurrentThreadId" }, { "address": "0x408050", "name": "CloseHandle" }, { "address": "0x408054", "name": "ExpandEnvironmentStringsW" }, { "address": "0x408058", "name": "GetSystemTimeAsFileTime" }, { "address": "0x40805c", "name": "GetCurrentProcessId" }, { "address": "0x408060", "name": "QueryPerformanceCounter" }, { "address": "0x408064", "name": "GetModuleHandleA" }, { "address": "0x408068", "name": "TerminateProcess" }, { "address": "0x40806c", "name": "GetCurrentProcess" }, { "address": "0x408070", "name": "SetUnhandledExceptionFilter" }, { "address": "0x408074", "name": "UnhandledExceptionFilter" }, { "address": "0x408078", "name": "Sleep" }, { "address": "0x40807c", "name": "GetTickCount" } ] }, "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x408094", "name": "__CxxFrameHandler3" }, { "address": "0x408098", "name": "??1exception@@UAE@XZ" }, { "address": "0x40809c", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0x4080a0", "name": "_callnewh" }, { "address": "0x4080a4", "name": "_XcptFilter" }, { "address": "0x4080a8", "name": "__p__commode" }, { "address": "0x4080ac", "name": "_amsg_exit" }, { "address": "0x4080b0", "name": "__wgetmainargs" }, { "address": "0x4080b4", "name": "__set_app_type" }, { "address": "0x4080b8", "name": "exit" }, { "address": "0x4080bc", "name": "_exit" }, { "address": "0x4080c0", "name": "??0exception@@QAE@ABQBDH@Z" }, { "address": "0x4080c4", "name": "__p__fmode" }, { "address": "0x4080c8", "name": "__setusermatherr" }, { "address": "0x4080cc", "name": "_initterm" }, { "address": "0x4080d0", "name": "?terminate@@YAXXZ" }, { "address": "0x4080d4", "name": "_lock" }, { "address": "0x4080d8", "name": "_unlock" }, { "address": "0x4080dc", "name": "__dllonexit" }, { "address": "0x4080e0", "name": "_onexit" }, { "address": "0x4080e4", "name": "??1type_info@@UAE@XZ" }, { "address": "0x4080e8", "name": "_controlfp" }, { "address": "0x4080ec", "name": "_except_handler4_common" }, { "address": "0x4080f0", "name": "??0exception@@QAE@ABQBD@Z" }, { "address": "0x4080f4", "name": "_cexit" }, { "address": "0x4080f8", "name": "memcpy" }, { "address": "0x4080fc", "name": "_CxxThrowException" }, { "address": "0x408100", "name": "_purecall" }, { "address": "0x408104", "name": "_vsnwprintf" }, { "address": "0x408108", "name": "malloc" }, { "address": "0x40810c", "name": "free" }, { "address": "0x408110", "name": "memmove" }, { "address": "0x408114", "name": "_wcsicmp" }, { "address": "0x408118", "name": "??3@YAXPAX@Z" }, { "address": "0x40811c", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0x408120", "name": "memset" } ] }, "USERENV": { "dll": "USERENV.dll", "imports": [ { "address": "0x408084", "name": "ExpandEnvironmentStringsForUserW" } ] }, "diagtrack": { "dll": "diagtrack.dll", "imports": [ { "address": "0x40808c", "name": "RunDll32Main" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0000812c", "size": "0x00000078" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00009000", "size": "0x00008d98" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0000f800", "size": "0x00003cc0" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00012000", "size": "0x000005ac" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x000023c0", "size": "0x00000038" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00002418", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00008000", "size": "0x00000128" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00005530", "size_of_data": "0x00005600", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.12" }, { "name": ".data", "raw_address": "0x00005a00", "virtual_address": "0x00007000", "virtual_size": "0x0000060c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "2.55" }, { "name": ".idata", "raw_address": "0x00005c00", "virtual_address": "0x00008000", "virtual_size": "0x000007ee", "size_of_data": "0x00000800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.24" }, { "name": ".rsrc", "raw_address": "0x00006400", "virtual_address": "0x00009000", "virtual_size": "0x00008d98", "size_of_data": "0x00008e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.75" }, { "name": ".reloc", "raw_address": "0x0000f200", "virtual_address": "0x00012000", "virtual_size": "0x000005ac", "size_of_data": "0x00000600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.31" } ], "overlay": { "offset": "0x0000f800", "size": "0x00003cc0" }, "resources": [ { "name": "MUI", "offset": "0x00011ca8", "size": "0x000000f0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.75" }, { "name": "WEVT_TEMPLATE", "offset": "0x00009500", "size": "0x000087a2", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.76" }, { "name": "RT_VERSION", "offset": "0x00009110", "size": "0x000003f0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.44" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Microsoft Windows Diagnostics Tracking Runner" }, { "name": "FileVersion", "value": "10.0.10586.0 (th2_release.151029-1700)" }, { "name": "InternalName", "value": "diagtrackrunner.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "diagtrackrunner.exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.10586.0" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "9e98f50f78965e161ef2db3a0c43016e", "timestamp": "2015-10-30 02:09:29", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 5 }, "data": null, "strings": [ "address not available", "Microsoft", "address_family_not_supported", ">X>j>", "protocol not supported", "FailFast", "$Microsoft Root Certificate Authority", "UnicodeStringArrayField", "unknown error", "UnhandledExceptionFilter", ".text$yd", "AsimovUploader_NormalUploadSucceeded", "__dllonexit", "Metadata_IsEscalationInProgress", "=,=8=D=Q=n=", "Metadata_TimeSinceOsInstall", "Microsoft Time-Stamp Service", ".CRT$XIAA", "not_a_socket", "EventKey", ".?AVlogic_error@std@@", "MaxCancelReports", "Trigger", ".rdata$zETW0", "5$5,5", "Microsoft Corporation", "EventPersistence", "system", "invalid string position", "Metadata_LastUnlockTime", "DTSQMLogger_UploadScenario", "malloc", ";&ln>", "|hK,_", "DiagTrackTrace", "en-US", ".tq[m", "OriginalFilename", "`Ge`@N", "memmove", "_CxxThrowException", "DiagTrackWP", "L0J0H", "RegGetValueW", "SnapTrace_SnappingScenarioInformation", "WasPreempted", "filename too long", ":.:>:]:g:", "Metadata_LastResumeFromHibernateTime", "read only file system", "@.reloc", ".rdata$zETW1", "t$http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "CurrentReports", "CurrentCancelReports", "ScenarioManager_AcceptScenario", "FixedUnicodeStringArrayField", "_exit", "not_connected", "t$0QP", "=7>g>q>w>", "too_many_files_open", "L$89\\$Ls", "SetLastError", "??0exception@@QAE@ABQBD@Z", ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0", "GetModuleHandleA", "connection_reset", ".00cfg", "_callnewh", "100831221932Z", "FilterType", "__p__commode", "oK0D$\"<", "_lock", "CallContext:[%hs] ", "operation_not_supported", "MatchEngine_ManifestUpdateMaintainScenarioList", "DataType", "Microsoft Code Signing PCA 2010", "9l>p>", "L$ 9\\$4s", "?M?m?", "msvcrt.dll", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "z.9Wv", "9)919P9", "GetCurrentThread", "_controlfp", "7%7-757=7I7R7W7]7g7q7", "#Vx\"&6", "GetCurrentThreadId", "no such file or directory", "4 4$4,4@4H4P4X4\\4`4h4|4", "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0", "a740Q", "ErrorValue", "i\\ta?", "PhP-@", "7Z>@B1", "ComplexData", "network unreachable", "connection_already_in_progress", "identifyingInfo", "FilterRepresentation", "host unreachable", "3$3,343<3D3L3T3\\3<7D7L7T7\\7d7l7t7|7", "no message available", "no child process", "Metadata_LastDeviceArrivalTime", "io error", "??0exception@@QAE@ABQBDH@Z", "D$xSVWj", "!Metadata_IsContinuumSessionActive", "282H2T2t2|2", "__p__fmode", "\"Microsoft Time Source Master Clock0", ";!;';", "ProductVersion", "ScenarioManager_InvalidScenario", ".rdata$sxdata", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "#Metadata_LastApplicationInstallTime", "t$0PQ", "Duration", "message_size", "already connected", "5\"5(51565S5v5", "connection_refused", "nCipher DSE ESN:728D-C45F-F9EB1%0#", "I0G0E", "1'151f1", "BinaryField", "GetSystemTimeAsFileTime", "memset", "connection aborted", "RunDll32Main", "protocol_not_supported", "GetTickCount", ".CRT$XIZ", "operation canceled", "DTSQMLogger_SQMSingleInfoStreamRow", "CompanyName", "4]F*3", "20151030030913.551Z0", "\"Metadata_LastResumeFromStandbyTime", "0@0H0L0l0", "permission_denied", " Metadata_IsKernelDebuggerPresent", "InternalName", "VS_VERSION_INFO", "ProductName", "too many files open", "InputKeyName", "250701214655Z0|1", "DiagTrackDbVersion", "KeyName", "j%XQf", "network down", "no link", ";D$Hr>P", "OutputDebugStringW", "ScenarioId", "DiagtrackStorageRoot", "CHANp", "D$ 9\\$4s", "interrupted", "bad address", "O0M0K", "_except_handler4_common", "Microsoft Windows Diagnostics Tracking Runner", "?&?_?", "070403125309Z", "Message", ".text", "too many symbolic link levels", "WEVT_TEMPLATE", "EscalationWorkItem_ExecutedAction", "Translation", "MatchEngine_ScenarioCompleted", "8$8,848<8D8L8T8\\8d8l8t8|8", "L$89^", "connection_aborted", "identifier removed", "ValueName", "c]?;ET", "Utils_CreateRegistryKeyFailed", "FixedUIntArrayField", "operation would block", "FormatMessageW", "memcpy", "GetModuleHandleW", "not a directory", "MaxReports", "internal\\sdk\\inc\\wil\\result.h", "10.0.10586.0 (th2_release.151029-1700)", "151030030912Z0#", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "??3@YAXPAX@Z", "ScenarioManager_LoadingScenariosStart", "Microsoft Corporation1!0", "win:Verbose", "$Metadata_LastResumeFromHibernateTime", "Metadata_IsContinuumSessionActive", ".?AVlength_error@std@@", "151007181736Z", "UIntArrayCountField", "USERENV.dll", ";?;F;M;T;[;", "no such device or address", "DRfDmR", " http://www.microsoft.com/windows0", "200831222932Z0y1", "2'3.3F3]3g3s3", "QKo>", "??4CShimUInt32UserSetting@@QAEAAV0@$$QAV0@@Z", "229879+4583620", "UnmapViewOfFile", "5$5D5L5T5\\5h5", "HeapSize", "hr != ((HRESULT)0x80020005L)", "7#7*727:7B7N7W7\\7b7l7v7", "9U$u$", "WdsInitializeDataUInt32", "Local\\SM0:%d:%d:%hs", "??4CDiskPartFileSystemUserSetting@@QAEAAV0@$$QAV0@@Z", ">G?Z?s?", ":3;F;", ";,;R;q;", "0U2E3", "IsDebuggerPresent", "ModuleId != 0", "8RSDSu", "1.151S1", "VirtualProtect", "u]j\\R", "wcsstr", "3$444@4H4|4", "; ;<;L;X;`;", "CUserSetting::ReadError", "?get_Error@CShowFlagUserSetting@@UAEJPAJ@Z", "??4?$CShimUserSetting@VCStringUserSetting@@@@QAEAAV0@ABV0@@Z", "Paging exception occurred while processing image file.", "6)6h6", "TerminateProcess", "646<6D6L6T6`6", ".idata$5", "??4CDiskPartFormatUserSetting@@QAEAAV0@$$QAV0@@Z", "4@5V5", "??0COOBEUIWelcomeSetting@@QAE@ABV0@@Z", "??0CDiskPartFileSystemUserSetting@@QAE@$$QAV0@@Z", "?set_String@CSimpleStringUserSetting@@UAEJPBG@Z", "8,878H8N8v9}9", "WinSAT/Metrics", "8a9|9", "_purecall", "040904B0", "Microsoft Time-Stamp Service0", "HeapFree", "??1CDUUIWelcomeSetting@@QAE@XZ", "200304183039Z", "??4COOBEUIFinishSetting@@QAEAAV0@$$QAV0@@Z", "676n607", ".data$r$brc", ">$>,>L>T>\\>x>", "Redmond1", "<:RSDSu", "Msg:[%ws] ", "ole32.dll", "Images", "j\\Yf;", "[multiple files]", "??0COOBEUIWelcomeSetting@@QAE@$$QAV0@@Z", "*.xml", "??0CSimpleStringUserSetting@@QAE@XZ", "??1CUpgradeUserSetting@@QAE@XZ", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "UnregisterClassA", "3E3K3X3c3|3", "??4CShimStringUserSetting@@QAEAAV0@ABV0@@Z", "??4CUpgStoreUserSetting@@QAEAAV0@$$QAV0@@Z", "?4?Z?u?", "An internal error occurred", "=0=<=\\=d=p=", "(((HRESULT)(hrTemp)) >= 0)", "\\StringFileInfo\\%04X%04X\\%ws", ";:@?h?~?", "\\VarFileInfo\\Translation", "??4?$CShimUserSetting@VCStringUserSetting@@@@QAEAAV0@$$QAV0@@Z", "Multiple CvDbg entries in IL-only image.", "WdsPublishImmediateEx", "WdsPackCollection", "wcscspn", "?get_ValidateID@CDiskPartUserSetting@@EAEHXZ", "7,8R8", "LogDiskReasonsForType", "1T1|1", "StringFileInfo", "N0L0J", "r~akow", "8/8Z8c8", "?get_UInt32@CDiskPartUserSetting@@UAEJPAI@Z", "??4CSetupUISummarySetting@@QAEAAV0@ABV0@@Z", "Invalid executable format.", "\\\\.\\PHYSICALDRIVE%d", "3L4R445K6", "\\Framework64\\", "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h", "??4CUpgStoreUserSetting@@QAEAAV0@ABV0@@Z", "??1CComputerNameSetting@@QAE@XZ", "%s failure: ", "L$,!D$", "%u.%u.%u.%u", "7N7Z7", "<-O>_>k>x>", "??0CTimezoneSetting@@QAE@$$QAV0@@Z", "4+464N4Y4^4", "VWjXP", "WaitForSingleObjectEx", "2F5e5", "ra([a-zA-Z0-9])", "vector too long", "??4CTimezoneSetting@@QAEAAV0@ABV0@@Z", "%Microsoft Windows Production PCA 2011", "?UnattendChecked@CUpgradeUserSetting@@SGHXZ", "G;~8r", "0'0-0B0Z0", "=L9o<", "CUInt64UserSetting::Simple_get_UInt64", ".text$x", "SelectedImageArch", "??_7CSimpleUInt32UserSetting@@6B@", "?get_Name@CEulaSetting@@EAEPAGXZ", "\\Device\\Mup\\", "??4CSetupUISummarySetting@@QAEAAV0@$$QAV0@@Z", "QRPh(", "222;2C2Q2", "8C9`9|9", "9c:y:", "VarFileInfo", "?'?6?Z?r?", "oXPERF_EmbeddedPdbPath", "PPPPVWP", ";D;f;s;", "r#w%;", "uw9ALrr", "DeleteCriticalSection", "?get_ValidateID@CComputerNameSetting@@EAEHXZ", "HZo6m|", "memmove", "=$=?=Z=u=", "?ReadShow@CUserSetting@@IAEJPAHH@Z", "??0CDiskPartUserSetting@@QAE@ABV0@@Z", "t&;9u", "c([a-zA-Z])", "DiskSupportsCapabilityForType", "??4CIBSUIImageSelectionSetting@@QAEAAV0@ABV0@@Z", ">!><>b>", ",Xot5aiz3Otd+M0dsZ+2tlVIxYFNz6hcF6YKeD1Vhf9c=0Z", "??_7?$CShimUserSetting@VCStringUserSetting@@@@6B@", "4+4E4v445S5k5y5", "t*f98t%", "HeapReAlloc", "14181X1x1", "??4CDUUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z", "313d3", "9,9L9r9", "98r#w", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "_NT_SYMBOL_PATH", "7W7x7", "9/949\\9r9}9", "VirtualQuery", "=$=,=4=<=D=L=T=l=t=", "9;9A9J9V9u9", "=&===U=h=n=", "BCryptCloseAlgorithmProvider", "??0CUInt64UserSetting@@IAE@XZ", ">N?w?", "msvcrt.dll", "PublishMessage", "8,8S8", "7-7O7T7", "GetCurrentThreadId", "0L0\\0t0x0", "3!3>3Y3", "WdsEnumFirstBlackboardItem", "D$`;C", "?set_UInt64@CSimpleUInt64UserSetting@@UAEJ_K@Z", "memmove_s", "FreeLibrary", "`.data", ";.;O;p;", "ReturnHr", "=\"=h=x=", "8H8P8X8`8h8t8", "Unable to parse image path: %s", "Failed to parse image event.", "?get_Name@CWDSUIImageSelectionSetting@@EAEPAGXZ", "FormatPartition", "GetDiskKey", "bcrypt.dll", "b([ \\t])", "??1COOBEUIFinishSetting@@QAE@XZ", "??0CShimUInt64UserSetting@@QAE@ABV0@@Z", ">(>H>P>\\>|>", "??1CDiskPartUserSetting@@QAE@XZ", "ProcessTrace", "CShimUInt64UserSetting::set_UInt64", "728S8", ".CRT$XCA", "BCryptOpenAlgorithmProvider", "Eula\\EulaText", "?SerializeUInt32@CUInt32UserSetting@@IAEXI@Z", "210303183039Z0p1", "ATL$__a", "DiskInfo\\BlockExplanationsDisk", "SetFilePointer", "WdsGetBlackboardValue", "??4CSetupUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z", "RegisterTraceGuidsW", "_91$[bS", ",*~_i", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "fResult", "??0CSetupUISummarySetting@@QAE@$$QAV0@@Z", "??0CUpgStoreUserSetting@@QAE@$$QAV0@@Z", ".cpdb", "??4CSimpleStringUserSetting@@QAEAAV0@$$QAV0@@Z", "8!8(808n8w8", ";0uF9E", "tE, <", "??0CShimUInt32UserSetting@@QAE@ABV0@@Z", ":c:x:", "InstallDate", "WinSAT/SystemConfig", "CoUninitialize", "uNPPV", "??4CComputerNameSetting@@QAEAAV0@ABV0@@Z", "InternalName", "2-3O3", "Microsoft Corporation1.0,", ".didat$4", "??0?$CShimUserSetting@VCStringUserSetting@@@@QAE@XZ", "l.dbg", "250701214655Z0|1", "??4CShimUInt32UserSetting@@QAEAAV0@ABV0@@Z", "6B6M6S6[6b6p6w6|6", "WarningReasonsText", "HashDigestLength", "ConstructPartialMsgVW", ">#?4?[?b?", "OOBEUI\\WelcomePage", "??1CShimUInt32UserSetting@@QAE@XZ", "RaiseFailFastException", "1b2i2u2", "L$ VP", ":,:>:S:_:e:z:", ";Fpu&", "QueryDosDeviceW", "-KB10t", "Translation", "4\"4-4l4", "3*4>4y4", "??0CStringUserSetting@@QAE@ABV0@@Z", "D$ PS", "FormatMessageW", "memcpy", "kernel32.dll", "GetModuleHandleW", "BUnattendDone", ">N>e>", "LoadResource", "GetSystemInfo", "u1SVW", " http://www.microsoft.com/windows0", "WdsSetBlackboardValue", "SetupUI\\DU\\WelcomePage", "D$Tx3", "??0CProductKeyUserSetting@@QAE@$$QAV0@@Z", "?get_Name@CDUUIWelcomeSetting@@EAEPAGXZ", "Washington1", "DiskRegionSupportsCapability:Disk [%d] is %s against capability [%s] for the following reasons...", "??0CSetupUIWelcomeSetting@@QAE@XZ", "5(5/555:5F5\\5p5", "ReleaseMutex", "??0CSimpleUInt32UserSetting@@QAE@$$QAV0@@Z", "??4CSimpleUInt64UserSetting@@QAEAAV0@$$QAV0@@Z", "??_7CShimStringUserSetting@@6B@", "MergeEtlFiles", "=,=7=d=j=", "??0CUpgStoreUserSetting@@QAE@XZ", "VSh@D", "j Xf;D$^", "\\Framework\\", ";\"= 0)", "GetModuleHandleExW", "??4CEulaSetting@@QAEAAV0@$$QAV0@@Z", "FileDescription", "q(\"[^\"]*\")|('[^']*')", "_XcptFilter", "WdsCollectionAddUInt32", "??_7CShimUInt64UserSetting@@6B@", "GetSystemWindowsDirectoryW", "QPWSQQhP", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "=B=a=|=", "SVWjz", "??_7CSetupUISummarySetting@@6B@", ".idata$6", "9@9a9", "??0CUpgradeUserSetting@@QAE@$$QAV0@@Z", "WdsInitializeDataUInt64", "4+565", "LogDiskReasons", "BuildLabEx", "wcschr", "OpenSemaphoreW", "??1CWDSUIImageSelectionSetting@@QAE@XZ", "??0CSetupUIWelcomeSetting@@QAE@ABV0@@Z", "??1CProductKeyUserSetting@@QAE@XZ", "8A8F8[8", "??0CUpgradeUserSetting@@QAE@ABV0@@Z", "??4?$CShimUserSetting@VCUInt64UserSetting@@@@QAEAAV0@$$QAV0@@Z", "Failed to obtain the original file name.", "Diagnostics\\Dword\\SetupCompliance", "?set_UInt32@CSimpleUInt32UserSetting@@UAEJI@Z", "CallbackGetArgumentString", "1$1+181?1+252?2F2L2Q2]2m2", "sgWQR", "RtlReleaseSRWLockExclusive", "??_7CShowFlagUserSetting@@6B@", "base\\ntsetup\\panther\\wdsutil\\usersetting.cpp", "??1CEulaSetting@@QAE@XZ", "??_7CWDSUIWelcomeSetting@@6B@", "WdsInitializeDataStringW", "Microsoft Corporation", "??4CDiskPartFormatUserSetting@@QAEAAV0@ABV0@@Z", "PWQjP", ".didat$6", "RegQueryValueExW", "[1b1g1y1", "%s [%s] failure: ", "9RSDS", "PWh M", "?get_String@CSimpleStringUserSetting@@UAEJPAPAG@Z", "83888?8", "SetupUI\\WelcomePage", "??0CDiskPartFormatUserSetting@@QAE@ABV0@@Z", ")CUserSetting::ReleaseMutex", "aepic.dll", "st QW", "GetProcessHeap", "??4CProductKeyUserSetting@@QAEAAV0@$$QAV0@@Z", "LoadLibraryExW", "343<3`3i3", "%s\\%s\\%s", ";f;r;x;", "calloc", "_errno", "??1CDUUIProgressSetting@@QAE@XZ", "??1CWDSUIWelcomeSetting@@QAE@XZ", "api-ms-win-core-processthreads-l1-1-3.dll", "??4CEulaSetting@@QAEAAV0@ABV0@@Z", "D$d;C", ";\"= 0)", "??_7CSimpleStringUserSetting@@6B@", "2#2/2R2f2", "wcsncpy_s", "WdsValidateInstallDrive", "CUpgradeUserSetting::set_UInt32", "2 2(202D2L2T2\\2p2x2", "VSh(*", "??1exception@@UAE@XZ", "R!s4Z", "??1CSimpleStringUserSetting@@QAE@XZ", "??4CIBSUIImageSelectionSetting@@QAEAAV0@$$QAV0@@Z", "%ws\\drivers\\%ws", "8 8(8,84888@8D8L8P8X8\\8d8h8p8t8|8", "=(=@=`=", "CallbackGetArgumentUInt64", "??1CTimezoneSetting@@QAE@XZ", "GetTempPathW", "VQPWV", "WideCharToMultiByte", "Thales TSS ESN:0A56-E329-4D4D1%0#", "\\SystemRoot\\", "\"Microsoft Window", "4!424J4O4h4o4", "WWWWj", "RegEnumKeyExW", "?get_Show@?$CShimUserSetting@VCStringUserSetting@@@@UAEJPAH@Z", "8_^[]", "5%5R5", "PicFreeFileInfo", "??0CShowFlagUserSetting@@IAE@XZ", "xProductKey\\ProductKey", "8-8N8S8n8", "??4CDiskPartUserSetting@@QAEAAV0@ABV0@@Z", "u+9\\0(u%", "?SerializeField@CUserSetting@@IAEXPBGPAUWDS_DATA@@@Z", "F SWj", "??4CWDSUIImageSelectionSetting@@QAEAAV0@$$QAV0@@Z", "UserSettings", "u8j\\V", "??0CComputerNameSetting@@QAE@$$QAV0@@Z", "ADVAPI32.dll", "%hs!%p: ", "EnterCriticalSection", ":!:Z:f:l:w:", ": :$:(:,:0:4:8:<:@:D:H:L:X:", "2(2z2", "??4CProductKeyUserSetting@@QAEAAV0@ABV0@@Z", "??4CShowFlagUserSetting@@QAEAAV0@ABV0@@Z", "??_7CUInt32UserSetting@@6B@", "WdsSetupLogMessageW", "WARNING", "? ?4?H?Q?Y?e?l?r?w?", "base\\ntsetup\\panther\\wdsutil\\diskcaps.cpp", "SHA256", "Setup.UserSetting.Mutex", "8RSDS", "ti9~8vZ", "3J3w3", "WdsCollectionAddUInt64", "9~8ve3", "CStringUserSetting::SerializeString", "PWQjM", "?get_Name@COOBEUIWelcomeSetting@@EAEPAGXZ", "RtlAllocateHeap", "20201008050501Z", "WdsClient\\UI\\WelcomePage", "1/0-0", "??4CKeyboardSetting@@QAEAAV0@ABV0@@Z", "TSWj@3", "2S3^3c3x3", "7 7$7,70787<7D7H7P7T7\\7`7h7l7t7x7", "DiskRegionSupportsCapability:Couldn't determine whether [%s] is %s for {disk %d, offset 0x%I64x}; hr = 0x%x", "WDSUTIL", "9\"9+9:9U9", "?IsUpgrade@CUpgradeUserSetting@@SGHXZ", ".?AVbad_alloc@std@@", ";8;a;", "tCh0>", "676d6", "_onexit", "PSWh8H", "7 7$7@7D7H7L7P7T7X7", "RtlGetVersion", "*pstDest != 0", "20201008071935.135Z0", "=%=+=6=d=k=q=v=", ".didat$7", "aow\\root\\rootfs", ">NB10tY", "6W6h6s6", "2H4h5x5'7w=", "??0CShimUInt64UserSetting@@QAE@XZ", "?get_Name@CKeyboardSetting@@EAEPAGXZ", "vswprintf_s", "< <0<<&>S>r>z>", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "1&1>1", "8\"898H8q8", "?get_UInt64@CShimUInt64UserSetting@@UAEJPA_K@Z", "%hs(%u)\\%hs!%p: ", "Y__^[", ".idata$3", "j\\^VW", "wX8^Xu", "towlower", "GetWindowsDirectoryW", "?Simple_get_UInt64@CUInt64UserSetting@@IAEJPA_K@Z", "wdsutil.pdb", "Upgrade Unattend Processed: Set %s\\UnattendDone value to 1.", "$`2X`F", "M0K0I", "Value", "??4CDUUIProgressSetting@@QAEAAV0@$$QAV0@@Z", "21Q1@2", "GetFileVersionInfoSizeExW", ">\"?A?\\?", "60686D6L6", "??1type_info@@UAE@XZ", "WDSCORE.dll", ",0E0b0}0", "=$=C=`=", "|hK,_", "BlockingReasonsText", "UR3$?", ".?AVCAtlException@ATL@@", "0070U0\\0:1w1", ": :,:4:T:\\:x:", "\\system32\\wdi\\PerfTrack\\", "4>5X5i5", "??0CProductKeyUserSetting@@QAE@XZ", "base\\ntsetup\\panther\\wdsutil\\wdsutil.cpp", ".edata", "t$", ".data$brc", "CoCreateInstance", "EventWriteTransfer", "Microsoft Time-Stamp PCA 2010", "6;7Z7", "??0CDUUIWelcomeSetting@@QAE@ABV0@@Z", "Legal_Policy_Statement", "__CxxFrameHandler3", "_wcsnicmp", "4:5c5", "??0CDUUIWelcomeSetting@@QAE@XZ", "FindVolumeClose", "9FPsS", "Exception", "~h_^]", ">'>2>B>q>", "1(0&0", "CloseTrace", "??4?$CShimUserSetting@VCUInt32UserSetting@@@@QAEAAV0@$$QAV0@@Z", "??4CWDSUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z", "'bs%`", "LoadLibraryW", "SetUnhandledExceptionFilter", "_ultow_s", "??_7CDUUIProgressSetting@@6B@", "??_7CDUUIWelcomeSetting@@6B@", "4<4H4v4", "?get_UInt64@CSimpleUInt64UserSetting@@UAEJPA_K@Z", "WilError_03", "9:9R9]9d9", "??4CDUUIWelcomeSetting@@QAEAAV0@ABV0@@Z", "??_7CUpgStoreUserSetting@@6B@", "??4CUpgradeUserSetting@@QAEAAV0@$$QAV0@@Z", "FindFirstVolumeW", "?@?~?", "??4CKeyboardSetting@@QAEAAV0@$$QAV0@@Z", "j._Qj", "?set_UInt32@CDiskPartUserSetting@@UAEJI@Z", "PWQjY", "tQhpI", "unexpected caching error: %x", "3$4,4L4h4x4", "?c_stValueName@CUserSetting@@1QBGB", ".CRT$XIZ", "CoCreateGuid", "Fh9~8", "0\"0z0", "CompanyName", "??0CDiskPartUserSetting@@QAE@XZ", "PVRQh", "??0CStringUserSetting@@IAE@XZ", "??0COOBEUIFinishSetting@@QAE@ABV0@@Z", "5 5(5,54585@5D5L5P5X5\\5d5h5p5t5|5", "9%:5:}:", "j:Yf97u?3", "?get_ValidateID@CProductKeyUserSetting@@EAEHXZ", "20201009050501Z0w0=", "??0CEulaSetting@@QAE@XZ", ";*;I;h;", "<9\">.>?>G>Z>f>n>", "CDiskPartUserSetting::set_UInt32", "??0CWDSUIImageSelectionSetting@@QAE@XZ", ";@:\"/\\|,?%&*", ".CRT$XCZ", "OOBEUI\\FinishPage", "fResult != 0", "5#7@7;8g9", "?get_Show@CSimpleStringUserSetting@@UAEJPAH@Z", "_vsnprintf_s", "t);>u", "?c_stErrorName@CUserSetting@@1QBGB", "MaxDuration_ms", "3Y4n4", "??0exception@@QAE@XZ", "%1\\%2", "tVV9_", "50565@5", "??4CShimUInt64UserSetting@@QAEAAV0@ABV0@@Z", "??0CDiskPartFileSystemUserSetting@@QAE@XZ", "QSVWh", ".text$yd", "IsCrossArchitectureInstall", ".CRT$XIAA", "!\\$0!\\$4!\\$", "Upgrade Unattend Processed: %s\\UnattendDone already set to 1.", "RRRRR", ".?AVlogic_error@std@@", "?set_String@CComputerNameSetting@@UAEJPBG@Z", "j\\Zf;Ty", "??1?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@XZ", "??0CSimpleStringUserSetting@@QAE@ABV0@@Z", "DeleteFileW", "=I=N=e=~=", "PartOffset", "??0CShowFlagUserSetting@@QAE@ABV0@@Z", "?SetModuleId@CUserSetting@@QAEXPAX@Z", "434e4n4", "1B1M1", "ReleaseSemaphore", "?terminate@@YAXXZ", "??0exception@@QAE@ABV0@@Z", "RegCloseKey", "QPSWQQV", "=4=<=H=P=", "??0CIBSUIImageSelectionSetting@@QAE@XZ", "??0CDUUIProgressSetting@@QAE@XZ", " Microsoft Operations Puerto Rico1&0$", "%ws%ws", "152J2h22393I3g3", "GetProcAddress", "?get_Name@CWDSUIWelcomeSetting@@EAEPAGXZ", "FindClose", "?get_Error@CSimpleStringUserSetting@@UAEJPAJ@Z", ";P;t;~;", "InitializeCriticalSection", "8MPDB", "5(535:5B5K5Y5", "BCryptCreateHash", "Microsoft Corporation1&0$", "??0CEulaSetting@@QAE@$$QAV0@@Z", "??_7CDiskPartFormatUserSetting@@6B@", "1@3k4", "?set_Show@CUserSetting@@QAEJH@Z", "??0CSimpleUInt64UserSetting@@QAE@ABV0@@Z", "??0CTimezoneSetting@@QAE@ABV0@@Z", "??0CWDSUIImageSelectionSetting@@QAE@$$QAV0@@Z", "??0CDiskPartFileSystemUserSetting@@QAE@ABV0@@Z", "GetFileSize", "ReleaseSRWLockExclusive", "InstallDestination\\DestinationFileSystem", ".CRT$XCU", "CreateMutexW", "_stricmp", "9,949<9D9L9T9`9", ":%;2;F;v;", "wcsspn", "??0CShimUInt32UserSetting@@QAE@XZ", "5!6X6g6", "??0COOBEUIFinishSetting@@QAE@$$QAV0@@Z", "DriveInformation", "8D9P9b9i9s9", ".?AVexception@@", "TdhLoadManifestFromBinary", "??0CUpgradeUserSetting@@QAE@XZ", "\\\\?\\VMSMB\\", "90:@:L:l:x:", ".data", "?Simple_get_String@CStringUserSetting@@IAEJPAPAG@Z", "?get_Show@CSimpleUInt64UserSetting@@UAEJPAH@Z", "StringFromGUID2", "_wcslwr_s", ";3;~;b/><>U>r>~>", "?ReleaseMutex@CUserSetting@@IAEXXZ", "DiskInfo\\BlockExplanationsRegion", "lL7Ki\"0", "??0?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@ABV0@@Z", "@.reloc", "LogHr", "??0CSimpleStringUserSetting@@QAE@$$QAV0@@Z", "??0CDUUIWelcomeSetting@@QAE@$$QAV0@@Z", "??0CSimpleUInt64UserSetting@@QAE@$$QAV0@@Z", "?get_UInt32@CShimUInt32UserSetting@@UAEJPAI@Z", "??0CDiskPartUserSetting@@QAE@$$QAV0@@Z", "RtlFreeHeap", "U0S0Q", "mscoree.dll", "8$8+82888D8O8T8Y8_8i8s8", "1 1$1,10181<1D1H1P1T1\\1`1h1l1t1x1", ";J>i>", "_callnewh", "|$XjD", "WDSUTIL.dll", "??4CDiskPartUserSetting@@QAEAAV0@$$QAV0@@Z", "MapViewOfFileEx", "ATL$__z", "%s\\DiskCapabilities", "2+262I2g2s2{2", "3 3@3H3T3\\3|3", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "?set_UInt32@CUpgradeUserSetting@@UAEJI@Z", "DiskRegionSupportsCapability:Region on disk [%d] (offset = [0x%I64x]) is %s against capability [%s] for the following reasons...", "??0CComputerNameSetting@@QAE@XZ", "LogDiskRegionReasons", "MultiByteToWideChar", "TraceEvent", "_P+_L", "Microsoft Time-Stamp PCA 20100", "PublishMessage:Failed to format the message. MessageID is [%d]", "1$1,141<1H1h1p1x1", "3D4W4", "??4CShimUInt64UserSetting@@QAEAAV0@$$QAV0@@Z", "WdsCreateBlackboard", "_hMutex != 0", "RtlCompressBuffer", "InstallDestination\\Selection", ".idata$2", "??_7CWDSUIImageSelectionSetting@@6B@", "ImageInfo\\OSImage", ".CRT$XCL", "; ;(;,;4;8;@;D;L;P;X;\\;d;h;p;t;|;", "ObjectLength", "api-ms-win-eventing-tdh-l1-1-0.dll", "4C5o5", "< <$<(<,<0<4<8<<<@3C3N3[3o3|3", "=\"?)?", "wcsnlen", "CreateFileMapping failed: %d", "2,242<2D2L2T2`2", "%wc:%ws", "C,)sHjX", "9~(s+j", "vLh\\K", "??0CUInt32UserSetting@@IAE@XZ", "Ad;Bdr", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "2:2n2", "HeapDestroy", "list too long", "8,8L8\\8l8r8", "VS_VERSION_INFO", "4:4T4Z4", "=7=?=Q=q=", "%wc:\\Symbols", "OutputDebugStringW", "OLEAUT32.dll", "??1?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@XZ", "O0M0K", "??0?$CShimUserSetting@VCStringUserSetting@@@@QAE@ABV0@@Z", "realloc", "VERSION.dll", "??0?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@XZ", "??1CSimpleUInt32UserSetting@@QAE@XZ", "DeviceIoControl", "656F6\\6g6", "9 :l:r:", " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", ">m?s?", "DiskRegionSupportsCapability:Couldn't determine whether [%s] is %s for disk %d; hr = 0x%x", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", ";HXw;;H8r", "2e2", "GetModuleFileNameA", "+a,Y?", "WdsAbortBlackboardItemEnum", "?get_Show@CShowFlagUserSetting@@UAEJPAH@Z", "Odu;`Q", "?get_Name@CTimezoneSetting@@EAEPAGXZ", "GetSystemDirectoryW", "GetThreadInformation", ".rsrc$01", "?ReadError@CUserSetting@@IAEJPAJH@Z", "u1j\\XP", "DebugBreak", "_unlock", "6$6(60646<6@6H6L6T6X6`6d6l6p6x6|6", ".?AVout_of_range@std@@", "BucketSizes_ms", ":9:_:", ".gfids", "??4COOBEUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z", "s{WVj", "5*6j6", ".rsrc$02", "u*9EDt", "GetLastError", "memcpy_s", "GetTempFileNameW", "xPhh?", ":$:+:;:J:R:{:", "??0CShimUInt64UserSetting@@QAE@$$QAV0@@Z", "8'9E9K9V9", "CShimUInt32UserSetting::set_UInt32", ">Q>W>", "XPERF_NGenPdbsPath", "??4CTimezoneSetting@@QAEAAV0@$$QAV0@@Z", "ntdll.dll", "??0CKeyboardSetting@@QAE@$$QAV0@@Z", "=t>}>b?", "999\\9", "_amsg_exit", "memchr", "InstallDestination\\DiskNumber", "8.9v9", "%hs(%d) tid(%x) %08X %ws", "0'0P0R1", "??0CIBSUIImageSelectionSetting@@QAE@$$QAV0@@Z", "WdsPickTempDriveBasedOnInstallDrive", "??_7COOBEUIWelcomeSetting@@6B@", "CStringUserSetting::DeserializeString", "Relogger", "Microsoft", "3&3C3J3T3[3a3f3r3", "FailFast", ":$:X:h:t:|:", "UnhandledExceptionFilter", "__dllonexit", "??_7CStringUserSetting@@6B@", "=$=A=J=P=q=y=", "WdsAllocCollection", "L$@QP", "??_7?$CShimUserSetting@VCUInt32UserSetting@@@@6B@", "TdhGetEventInformation", "NULL path in image path.", ">RSDS", "??4COOBEUIFinishSetting@@QAEAAV0@ABV0@@Z", "GetApplicableDiskRegionReason", "z([0-9]+)", "??0CSetupUIWelcomeSetting@@QAE@$$QAV0@@Z", "invalid string position", "?get_Error@CSimpleUInt32UserSetting@@UAEJPAJ@Z", ".didat$2", "SetupInfo", "GetFullPathNameW", ".giats", "??0CUpgStoreUserSetting@@QAE@ABV0@@Z", "7$7,747<7D7L7X7x7", "GetRegionKey", "4 4$4,40484<4D4H4P4T4\\4`4h4l4t4x4", "?get_UInt32@CSimpleUInt32UserSetting@@UAEJPAI@Z", "?get_Show@CComputerNameSetting@@UAEJPAH@Z", "3#444J4", "0A2K2h2b3", ")Microsoft Root Certificate Authority 20100", "Keyboard", "AcquireSRWLockExclusive", "100701213655Z", "??_7CDiskPartFileSystemUserSetting@@6B@", "WARNED against", "0$0(00040<0@0H0L0T0X0`0d0l0p0x0|0", "WaitForSingleObject", ">$>G>Q>g>v>0?T?f?", "??0CProductKeyUserSetting@@QAE@ABV0@@Z", "?Simple_set_String@CStringUserSetting@@IAEJPBG@Z", "FindNextFileW", "?get_Error@CSimpleUInt64UserSetting@@UAEJPAJ@Z", "Wow64DisableWow64FsRedirection", "kernelbase.dll", "OutputDebugStringA", "??1CSetupUIWelcomeSetting@@QAE@XZ", "RtlAcquireSRWLockExclusive", "RaiseException", "??_7CTimezoneSetting@@6B@", "7#7(7u9", ": :$:,:0:8:<:D:H:P:T:\\:`:h:l:t:x:", "607@7L7T7", ";s$vX", "1 242D2L2T2`2", "?get_Error@?$CShimUserSetting@VCStringUserSetting@@@@UAEJPAJ@Z", "t'Ph,&", "\\GLOBAL??\\", ";xds/k", "??_7?$CShimUserSetting@VCUInt64UserSetting@@@@6B@", "??4CShimStringUserSetting@@QAEAAV0@$$QAV0@@Z", "??4CSimpleStringUserSetting@@QAEAAV0@ABV0@@Z", "??0CWDSUIWelcomeSetting@@QAE@ABV0@@Z", ":1:\\:", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "526r6", "_wcsicmp", "WARNED", "ControlTraceW", "QQSV3", "<$<,<4<< too long", "0\"0)0", "5j5o5", "WdsCollectionGetValue", "4,5<5H5P5", "OpenTraceW", ".didat$5", "_memicmp", ";'I>d>", "0L0P0X0`0x0", "?Simple_get_UInt32@CUInt32UserSetting@@IAEJPAI@Z", "UnregisterTraceGuids", "D$ SP", "??4COOBEUIWelcomeSetting@@QAEAAV0@ABV0@@Z", "y>", "(((HRESULT)(hRes)) >= 0)", "?SerializeUInt64@CUInt64UserSetting@@IAEX_K@Z", "081U1", "User selected upgrade option", "??_7CUpgradeUserSetting@@6B@", "CUserSetting::DeserializeField", "777!9X9", "Microsoft Windows0", "User selected clean install option", "w([a-zA-Z]+)", ":':B:]:", "APPID", "bCreateFile failed: %d", " Operating System", "hbad allocation", "BuildLab", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "?get_Name@CDiskPartFormatUserSetting@@EAEPAGXZ", "SVWj@", "210317011459Z0", "?c_stMutex@CUserSetting@@1QBGB", "*.ptxml", "SetLastError", ">7>R>m>", "oK0D$\"<", "_lock", ".rdata$brc", "CallContext:[%hs] ", "Timezone", "SetThreadInformation", "PWQj[", "BCryptFinishHash", "2%3H3c3", "z.9Wv", "9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9", "?get_Name@CDUUIProgressSetting@@EAEPAGXZ", "%s\\RegionAtOffset%I64u", "uF9SLrA", "9CdvD9A", "vector too long", ".?AVResultException@wil@@", "??1CUserSetting@@QAE@XZ", "??0COOBEUIWelcomeSetting@@QAE@XZ", "8,888X8d8l8", ";8;H;T;t;|;", "??0CDiskPartFormatUserSetting@@QAE@XZ", "??4?$CShimUserSetting@VCUInt32UserSetting@@@@QAEAAV0@ABV0@@Z", "tdh.dll", "?get_Error@?$CShimUserSetting@VCUInt64UserSetting@@@@UAEJPAJ@Z", "?get_Show@CSimpleUInt32UserSetting@@UAEJPAH@Z", "GetFileVersionInfoExW", "Hbg&~", "7+7A7i7z7", "6i7i;", "??0CSimpleUInt32UserSetting@@QAE@ABV0@@Z", "?,?4? iterator", "0I0n0", ";T;Z;e;", "2,272N2l2", "WdsDestroyBlackboard", "PicRetrieveFileInfo", "1575;5J5Z5`5d5q5", "TlP0X", "?get_Name@CProductKeyUserSetting@@EAEPAGXZ", "StartTraceW", "2\"282T2", "3C3K3X3^3f3", "&PWSV", ";u=f9w", "??0CSimpleUInt32UserSetting@@QAE@XZ", "7'8=8", "j\\Yf9", ".rdata$sxdata", "??0CWDSUIWelcomeSetting@@QAE@XZ", "D$$Ph", "2#2;2X2|2", "wcscpy_s", "??4CSimpleUInt64UserSetting@@QAEAAV0@ABV0@@Z", "9] tJ", "DiskInfo\\Disk%u", "CUpgradeUserSetting::UnattendChecked couldn't create BB", "LockResource", "GetSystemTimeAsFileTime", "memset", "DiskRegionSupportsCapabilityForType", "GetTickCount", "CoInitializeEx", "ext-ms-win-eventing-tdh-ext-l1-1-0.dll", "\\StringFileInfo\\%04X%04X\\OriginalFilename", ":($>0>8>P>t>", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "??1CDiskPartFormatUserSetting@@QAE@XZ", "ProductName", "a/Richx", "??0COOBEUIFinishSetting@@QAE@XZ", "Aow\\RootFS", "TdhGetEventMapInformation", "5D5T5`5", "_except_handler4_common", "QQh@L", "111I1a1y1", ":2;{;", "686X6h6", "?get_Name@CDiskPartFileSystemUserSetting@@EAEPAGXZ", "9$9,9D9L9", "9;9N9_9o9v9", "7L8W8u8", "QPVSW", "q(9>u", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "_pBlackboard != 0", "4xCh F", "??0CUInt32UserSetting@@QAE@ABV0@@Z", "SetupUI\\DU\\ProgressPage", "?9?F?f?", "CallbackGetArgumentInt32", "6QPQS", "%Microsoft Windows Production PCA 20110", "FreeReason", "8.8S8q8", "I0G1-0+", "2k3k5", "wcstol", "??1CStringUserSetting@@IAE@XZ", "MapViewOfFileEx failed: %d", " Microsoft Corporation. All rights reserved.", "WdsFreeCollection", "8NB10", "1*1g3", "Upgrade", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\PerfTrack\\InteractionClasses", "!This program cannot be run in DOS mode.", "GetExitCodeProcess", "WinSAT/WinSPR", "??_7CUserSetting@@6B@", "4G4`4y4", "CreateMutexExW", "9P:W:", "?Simple_set_UInt64@CUInt64UserSetting@@IAEJ_K@Z", "<,<7\">)>N>d>", "??0CWDSUIWelcomeSetting@@QAE@$$QAV0@@Z", "1X1^1m1", "FileVersion", "{28ad2447-105b-4fe2-9599-e59b2aa9a634}", "?.?Q?", ".rdata$zzzdbg", "??4CUserSetting@@QAEAAV0@ABV0@@Z", "WdsClient\\UI\\ImageSelectionPage", "4'484y4", "??0CDUUIProgressSetting@@QAE@ABV0@@Z", "t VWS", "; \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "products.cab" ], "path": "/opt/CAPEv2/storage/analyses/3/files/7677dd6247c5768737b643911894374939aac5ae2dea158c272511fdd2ac52bf", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\products.cab" ], "size": 44045, "crc32": "299C1371", "md5": "52b7d0637974ed697dd8aa819ed3c8b0", "sha1": "e81a7094362964e9ae69580b91a1e72207be667d", "sha256": "7677dd6247c5768737b643911894374939aac5ae2dea158c272511fdd2ac52bf", "sha512": "173a5893612a789f51ee9d914ae26e1faec557dcfab4ddb8aa8c8baa7690ca456af117e14e2b6d004c963573cb67a02f0e2760cc8c609287587dc335f9c4c1a8", "rh_hash": null, "ssdeep": "768:a7WxoIAiafX3+okXkCCn22+ZvEcKdH+u0eZfQEj7Mq6TFSguODDOLANYo:a6yIAVfX3EYn22+9vKow7MtFLu1LAN1", "type": "Microsoft Cabinet archive data, Windows 2000/XP setup, 44045 bytes, 1 file, at 0x2c last modified Sun, Dec 07 2023 22:07:36 +A \"products.xml\", ID 33800, number 1, 86 datablocks, 0x1503 compression", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T11713F1471D991A6EA3C0F5585F63CBA08107DAC39304870A9C870D772A9E7F9B2DC3A0", "sha3_384": "fd15a804eff6ece4726dd7dcb6df08bdc2c1e118bad65a05f4d8f07ce16fa797f59c4cf6eddd6c25d82183efb788ab62", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "c\\c\"}", "x{JJ]", "9/lBJ7", "~vv2k", "Aw 342", "7yv;:*", "eWOV+", "7]B\\<", "vHj$e", "A;lCZ ", "u@/v1", "XB47@%", ".we(\\", "9!C1(O>", "07Yv*", ")H}jV", "4!sS&", "ZP\"}LW", "6@&;9h", "cZY}V", "|n>{KW2", "-Hz%g", "2Zh35", "lI!;x(", "rhQ[H", "Ke%>O", "'}gun", " {0}4T", "C](1;11", "j\\gp/", "v 041@K", "_3s>\\", "*cO}n", "}sI]f", "hB47@&69o", "N!\\!=", "\\L1t\"", "1q*xm,|a", "$_yK#", "5Hf6L~,", "TFoirI=*", "Up|/}a", "\\rO+j", "-7NXP", ">F~aK", "Sco=FS", "21hBt7@&69", "lYjB9", "g@kfl", "q@^=r", "6hh%d'", "gGa,C", "5):42", "']k:7", "+lCT It P", "P\"vL04'", "PjGWfP", "^8wy\\", "442@f", "SVT[2", "B&(v:m", "Z<=n}w", ")esF!T", "w[AC1(V>'", "UoC82", "g@:G1", "w[AC8(", "CI&\"J", "{A6]B", "[~h9m", "(j|w0", "d?~0R", "?)cQ)", "G'g@l\"C!", "e@lDG!", "B kg", "6njF\\", "@~u1l", "S:8u2Y", "KdoU-", "g@k4d", "PB{L,;", "/F~aKZ[", "b7z\"8", "W,%ux", "n=cW)", "9<}gt", "@whee", "6Hl#[", "/;lC_", " qu _9", "YDxB)a", "KMk1Y~", "f@l\\G!", " ;lBJ ", ":]}as", "-Hk$`", "LPkgl", "pR8AWms", "BZ6`%", "w-`O{", "+au\\*6", "#|QI{M", "$Nu7M;", "<1C ", "i'Zcu*", "KIC 5ux", "{~}{l)I", "XcM/g", "oe:C(", " > > >::SetParameters", "Microsoft.Windows.162.X21-43642_8wekyb3d8bbwe", " Microsoft Corporation. Med ensamr", "8#9(9-92979<9A9G9", "a pas pu s", "jabb verzi", "CDlpActionFactoryImpl >,class CDlpActionUpdateMediaFactory,class CDlpActionUpdateMedia>::SetActionId", "jele. %0", "ebc0a77f-31c7-424b-8c62-638278ebdc23", "tsbericht kann aufgrund einer fehlenden Systemkomponente nicht angezeigt werden.%0", "Windowsin palautusymp", "Microsoft.Windows.98.X19-99662_8wekyb3d8bbwe", "3bea74c5-3b8d-38fb-49fb-823cb9287cc1", "9cc24120-fa06-08df-1253-73f588f3ef2f", "Microsoft.Windows.7.X21-83184_8wekyb3d8bbwe", "Egy sikerparancsf", "HN8HJ-PCTFX-K4X3W-YM8D9-TF4BG", "ShouldSuspendBitlocker", "STATUS_SXS_ASSEMBLY_NOT_FOUND", ";+;M;S;n;|;", "De angivne automatiseringsoplysninger var ugyldige.%0", "ZwOpenKey", "DriverSkippedCount", "Microsoft.Windows.122.X20-29617_8wekyb3d8bbwe", "2d1d42b6-85a2-6257-ba56-ab8f7b38198f", "ris f", "5$5q5", "Vaadittuja ehtoja vastaavaa tarjousta ei l", "7WNQY-TJPFM-RXDB8-K4HTR-2KDFX", "8I8^8e8}8", "9M3QN-7CPRK-XVVM4-GFXGH-8HV2C", " bulunamad", "ar-MA", "6HNX2-8WPCG-4YD6C-99G7X-TF4CC", "QPWSQQh", "http://www.w3.org/XML/1998/namespace", "RtlNtStatusToDosError", "Microsoft.Windows.98.X19-99580_8wekyb3d8bbwe", "DiskSpaceInstallReq: Initializing Critical Count [%ld]", "ml-IN", "Microsoft.Windows.122.X19-98693_8wekyb3d8bbwe", "N79J7-VMKVD-9XKD8-378K3-9778G", "0e65f202-a15e-96cb-596d-afc74b3209c2", "An unexpected version of Update Agent client was encountered.%0", "Een precommit-script kan niet worden uitgevoerd of heeft een fout geretourneerd.%0", "Recovery: Image Language: [%s]", "%CLOUD_E%", "060L0Z0f0n0", "7*878", "n no est", "9sTtr", "0B1N1g1", "Brukeren har avsl", "4SVWQ", "Microsoft.Windows.48.X20-23598_8wekyb3d8bbwe", "12aebd59-f351-b4c2-ed8d-f56ba94c6861", "?MdDlt", "serverenterprisev", " setup.exe ", "030E0r0", "es de compatibilidade para transfer", "[RS2]", "Microsoft.Windows.100.X19-99458_8wekyb3d8bbwe", ".?AV?$CZeroInit@VCSetupFCDiagnostics@@$00@@", "5f2b068c-4ea3-e6a4-edc2-db19ef581689", "Microsoft.Windows.50.X17-54014_8wekyb3d8bbwe", "d9794ff0-7416-1879-63aa-8eca7ab86cb7", "9$9*90969<9C9J9Q9X9_9f9m9s9", "[%hs]", "DUImage: Hardware compatibility file [%s] not generated.", "NMX7M-7233W-6962R-K6GX6-V6DD6", "MoSetupPlatform: ReleaseSetupAutomation called with invalid suspend path: [%s]", "=9=K=", "5c03df24-1fdf-1556-f71d-b000b631db32", "Sh_^[", "UseStorageReservesForInstall", "InstallChoice", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDataMigrateFactory@@VCDlpActionDataMigrate@@@@", "Microsoft.Windows.7.X18-81291_8wekyb3d8bbwe", "8&8d8k8", "DuplicateHandle", "CDlpActionCompat::InitializeFinalizeReqScan", "MoSetupPlatform: Creating SetupAutomation object from [%s]...", "dia. %0", "DUSetup: Downloaded %d updates.", "DataMigration: Migrating ReportId [%s] into Target OS...", "<{u%;", "CDlpActionImpl > > >::SerializeRoutine", "lemi bir s", "az-Cyrl-AZ", "Finalize: Remapping install success [0x%X] -> [0x%X] for telemetry.", "9C:_:", "", "> >$>4>8><>@>D>H>L>T>X>\\>`>d>h>p>", "k~[\\*A", "st nem lehet megjelen", "O utilizador optou por cancelar a Configura", " megszak", "st inden for den kr", "Proces instalace byl neo", "CDlpActionImpl > > >::GetSerializeOnProgress", "BUCL::Rtl::BlockLookupTable(unsigned __int64 const &,unsigned __int64 const &,int *),struct BUCL::Rtl::BlockLookupTablePODSetPolicy >::Insert", "Asennuksen etenemiseen liittyv", "tej zgodno", "Microsoft.Windows.4.X19-99683_8wekyb3d8bbwe", ", mert a v", "Microsoft.Windows.47.X17-48253_8wekyb3d8bbwe", "Um script de pr", "3 3,383D3P3\\3h3t3", "CDlpActionImpl > > >::Execute", " platforma zjistila nespecifikovanou chybu.%0", "lanan otomasyon bilgi ge", "Microsoft.Windows.125.X21-83178_8wekyb3d8bbwe", "3M3F8-YN4T9-DJMK9-VTP6G-MKMQP", "0k0o0", "$:0:C:", "?&?1?L?", "CompatFinalizeReq: Initializing Language: [%s]", "ts-ZA", "adavky na m", "Microsoft.Windows.48.res-v3306_8wekyb3d8bbwe", "Microsoft.Windows.99.X20-29698_8wekyb3d8bbwe", "151\\1", "GetSystemTime", "=T=j=w=", "6N6}6", "ConX::Setup::Common::COSInfoHelper::GetHostOSVersion", "pLj Q", "KW9QN-PQXBX-C24PY-23YXX-KQBMG", "1b25ca27-b6f6-e3bc-e039-84c90c734d9b", "SSSjdj", "Kernel-ProductInfo", "MobileUpdate", "04e14d47-d0ff-a6d5-4bcc-8c1f6f33c077", "GPD27-N7P3R-KB999-JWB7W-WB48F", "n levytila on lopussa.%0", "y6Vhj", "totta a telep", "Zadan", ".idata$5", "=;>M>g>", "6L7|7", "Microsoft.Windows.101.X19-98874_8wekyb3d8bbwe", "Microsoft.Windows.17.X17-36803_8wekyb3d8bbwe", "ServerStandard", "serverenterprise", "WH2CN-CV37J-RBD3H-7V4HM-X4R72", ".?AV?$CZeroInit@VCDlpActionSummary@@$00@@", "SkipUpdate from Response [%s]", "RtlTranscodeLBlobs", "f4d98789-b51c-5819-6bfc-15bc92543ff2", "n se est", "210121231914Z0", "041604B0", "4\"6,6@6i6", "010_0x0", "nytelenek.%0", "ExpandEnvironmentStringsW", "ghV!q", "CDlpActionImpl > > >::CheckInitialized", "Microsoft.Windows.48.X20-29562_8wekyb3d8bbwe", "Microsoft.Windows.98.X20-29637_8wekyb3d8bbwe", ": :1:A:R:b:s:", "STATUS_RESOURCE_NAME_NOT_FOUND", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART", "=*?L?^?", "NtQueryWnfStateData", "nskede migreringsvalg.%0", "8f4c5a4f-f1b7-3d12-2f5d-98b012b0463d", " ilmoitusta.%0", ";C;l;v;", "SetupCore: Registered COMPAT_INSTALLREQ action", "WimEnterCriticalSectionWithLazyInitialization", "si folyamat ", "0W0f0", "040904B0", "t$$9t$ vb", ";5<@<", "Microsoft Time-Stamp Service0", "t;j#j", "58016268-1238-7d9c-e53f-121f5c492f91", "Not-null check failed: MatchIndex", "1891eef8-6577-94d7-e6f4-eb3b2d464468", "DataMigration: Request for file migration of ActionList.xml has been queued", "FPN6M-RCWPF-BJHXY-8P3PY-VQXCY", "Microsoft.Windows.98.X20-29570_8wekyb3d8bbwe", "CDlpActionGetWebSetupUserInput::InitializeRoutine", "Microsoft.Windows.50.res-v4328_8wekyb3d8bbwe", "DiskSpaceInstallReq: Initializing Media Path: [%s]", "D$`SVW", "36890805-a2f3-a8fc-0a79-84735e5af4c4", "3$303P3\\3|3", "delegge meldingen for blokkering av avslutning.%0", "SetSecurityDescriptorDacl", "ProductKey: Validating Default Product Key for edition [%s].", ">[>f>m>", "CDlpActionImpl > > >::Prepare", "J7D66-7NJXV-KK87W-CMB3J-TQ8GQ", "objet Diagnostics n", "GNKHT-YC997-R8DK2-Q9X27-KHJVG", "9,:J:p:", ".data$r$brc", "7(747@7L7X7d7p7|7", "OpenEncryptedFileRawW", "Microsoft.Windows.161.res-v3917_8wekyb3d8bbwe", "FNJXY-3HTTH-28G88-GVX68-TQ8J8", "2FNQG-3WH7P-QJXMT-7YPJX-MHCF6", "%c:\\$Windows.~BT\\Sources", "Redmond1", ">a>|>", "Kompatibilitetsproblemene ble ikke l", "LockFileEx", "Microsoft.Windows.49.X20-29565_8wekyb3d8bbwe", "87dbda3e-0555-9550-6f80-dfaca1d8a2e3", "e692bcb2-3367-f19e-3978-f450869b48ce", "SSh @", "tt lisensvilk", "StringCchCopyN failed", "00240df7-8a9e-73ec-240f-c262cbcedb45", "0j0K0c0_0_0", "Microsoft.Windows.101.X20-29678_8wekyb3d8bbwe", "DataMigration: Queue preservation of recovery image into Target OS...", "Failed to mark system store. File: %ws Status: %x", "n, lisans s", "D6YXN-73KK9-RRTG9-B3J7V-8HWWD", "525b5u5", "Microsoft.Windows.101.X19-99538_8wekyb3d8bbwe", "Microsoft.Windows.50.X18-81306_8wekyb3d8bbwe", "Et forudinstallationsscript blev ikke udf", " Uudelleenyritys mahdollista.%0", "yi-001", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "673JN-2Y3HJ-HW9TK-488TJ-Q69QT", "CloudN", "No hay paquetes para descargar.%0", ">%?,?f?", "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\WebSetup", "b5836f57-dc49-564a-4ba0-b44c8c85c93a", "Os problemas de compatibilidade de requisitos m", "Nyttolastfiler var skadade.%0", "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\Activation", "INVALID_DISPOSITION", "DecryptionKeyX64", "ExecuteDownloadReq: DiskSpaceReq polling starts...", "no lock available", "RtlDosPathNameToNtPathName_U", "57db946d-31e6-56b3-1e1a-c387ae15d1c1", "RBPVT-NJ672-TCHWV-Y798M-MY47P", "8$8<8H8`8l8", "MoSetupPlatform: NewSystem object suspended!", "embeddedindustrye", "MapViewOfFile", "HMN4B-X8XB6-HG4PD-MKMYY-K763Y", "FveDisableAuthenticationW", "9/9R9^9", "UncompressFile failed", "33CY4-NPKCC-V98JP-42G8W-VH636", "DUSetup: SqmOptin from Response [%ld]", "DUImage: Skipping Dynamic Update due to timeout getting FOD updates.", "DUImage: Initializing Drivers Path: [%s]", "o de dispositivo para instalar a atualiza", "PidGenX", "Microsoft.Windows.122.X19-98697_8wekyb3d8bbwe", ">&>8>w>", "Microsoft.Windows.7.X17-66959_8wekyb3d8bbwe", "8f8e669d-6e3d-23b4-c736-330f3eb413dd", "ProductKey: Pid.txt file not found.", "Microsoft.Windows.184.res-v4256_8wekyb3d8bbwe", "MicrodomImplementation::CMicrodom::GetElementNodeSet", "f0daae41-acbe-ad6f-a81c-773375d8a240", "T9D8N-TWPHV-VB9TJ-DB2QW-F3KTP", "a6f215f4-faed-09f4-fb38-57d3b4b2379a", "A [%s]", "0A1_1", "2)272", "Microsoft.Windows.101.X20-39250_8wekyb3d8bbwe", "DataMigration: Initializing RecoveryOption: [%d]", "8E9j9q9|9", "Cihazda indirme i", "3T4FN-F8BBV-YHYY3-MY7DP-FYBJ2", "Microsoft.Windows.161.X21-43625_8wekyb3d8bbwe", "3558b48b-23c3-f7b5-cf56-b17f75f75152", "gn0$P", "4\\4z4", "Microsoft.Windows.101.X19-99553_8wekyb3d8bbwe", "T$DQQ", "dbc57aeb-38d5-19bf-c66f-08cc4e8b2176", "D$@j(P3", "HomePremiumN", "en-AE", "546Q6X6`6x6", "?0n0u0", "c5730a55-a0ff-9df6-0aca-f8d4f9512b2c", "4(4S4", "9000726a-46e5-f18d-9df1-3e59b53159a4", "779f9110-74e4-52dc-0d9b-c679b91e5567", "aefad424-3d54-4fb6-c458-27159a52cf01", "Den eksekverbare fil GatherOsState kunne ikke udf", "8\\9l9s9", "a74d8875-a73a-ad6d-d05e-4822cdd1c5df", "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputDefaultArch: [0x%X]", "0$0,040<0H0h0p0x0", "CDlpActionSummary::IsPowerPluggedIn: Unknown power state. Assuming that system is not running on AC power.", "Det gick inte att hitta m", "FveGetStatus", "5I5f5~5", "CDlpActionDU::ExecuteDUSetup", "serverstandardeval", "Microsoft.Windows.100.X19-99452_8wekyb3d8bbwe", "StringFileInfo", "CP4KF-NG6TC-9K6QF-P6GTT-H8RBM", "c19e7ebe-5469-4882-47a1-69533375aeb4", "81fb75af-cebf-2dff-0824-d51242c7ea2b", "N0L0J", "0e31e335-4fca-fae1-9951-be6512ca6f63", "6fba12a6-3077-5301-cfde-f22f59f1e2a6", "CDlpActionImpl > > >::GetError", "6(616;6?6P6V6f6", "CDlpActionFinalize::ExecuteRoutine", "fcb2930b-2f09-d213-b633-5bb8971dc47e", "Microsoft.Windows.49.X19-98859_8wekyb3d8bbwe", "ncia de payload.%0", "aduje se restartov", "7&7}7", "bs-BA-Latn", "Microsoft.Windows.8.X21-83700_8wekyb3d8bbwe", "d9d76e9c-8df7-f303-0387-87c814d0d14c", "Microsoft.Windows.100.res-v3274_8wekyb3d8bbwe", "EtwEventWrite", " kompatibilit", "de915f5f-2a91-98e5-92c3-3f5e8d1147cd", ".?AV?$CUnknownSingletonImpl@VCMoOnlineStore@@VIMoOnlineStore@@@@", "Microsoft.Windows.119.X19-99606_8wekyb3d8bbwe", "::RtlIsLBlobValid(Blob)", "iostream stream error", "b8739611-196c-e9ac-80ed-b0e68a7483c4", "tirmeyi s", "f8a65f03-cfaf-3769-c20e-73a3d0691c68", "4%5T5", "Microsoft.Windows.161.X21-03400_8wekyb3d8bbwe", "6503bbff-b6b7-8fee-c881-502dcc08d577", "Microsoft.Windows.8.X21-83705_8wekyb3d8bbwe", "my s kompatibilitou pro stahov", "Microsoft.Windows.98.X20-24584_8wekyb3d8bbwe", "CDlpActionDataMigrate::MigrateKeyboardLayout", "Het systeem voldoet niet aan de schijfruimtevereisten voor het downloaden en uitpakken van media met meerdere architecturen.%0", "Microsoft.Windows.100.X19-99444_8wekyb3d8bbwe", "RDGBN-RMM3C-R66WW-J82GM-43KT3", " ei ole p", "MigChoice: Initializing Image Name: [%s]", "es de automa", "Microsoft.Windows.98.X20-29574_8wekyb3d8bbwe", "t)j\\V", "bcd037f0-2143-0a95-7876-8929ab1eef00", "ImageDeploy: Initializing Use Storage Reserves: [%d]", "b8246f08-d711-611e-7e4c-4bdc24d27743", "d3a6f691-5e05-7aac-f18e-5d13b9297422", "DataMigration: Initializing FlightData: [%s]", "454p4", "BXCFX-GQGQ7-8XHPK-CCWHQ-6WPHR", "D42FN-YGMP6-92CFJ-6XDCJ-J8HY7", "::RtlXmlExtentToUtf8String( 0, &m_State.ParseState.RawTokenState, &Src, TempString.GetMutablePointer(), &cRequired)", "XQJXN-H6Y7K-6CJ2W-TJQ63-B99Y2", "o em disco suficiente para transfer", "AllocateReadChunk", "Microsoft.Windows.4.X21-03400_8wekyb3d8bbwe", "(Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Stream) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::BlobProvider) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Blob)", "5 50545L5P5h5x5", "cdb27332-3f94-28f0-5052-b2e45c19552c", "CDriverCallback::ValidateDriverPackage: Package is not a candidate for migration. {938EFDDC-D0F5-46E2-82B5-65F3F9683E31}", "MigChoice: After Migration Filter -> [%s]", "cej ilo", "DbgPrintEx", "Microsoft.Windows.125.X21-83255_8wekyb3d8bbwe", "L$t_^[3", "Meddelelsen om blokering af lukning kunne ikke oprettes eller destrueres.%0", "network_down", "File is not system store. File: %ws Status: %x", "ndaren har valt att avbryta f", "DebuggerOptions: Initializing Debugger Key: [%s]", "0\\0~0", "vector too long", "000L0v0", "Microsoft.Windows.122.X19-98838_8wekyb3d8bbwe", "dd2c7337-4554-3659-0cca-ed42f78b3202", "BiCreateBootEntry: Could not retrieve BCD Object application description. Status: %x", "5c2de669-7fe4-2a04-d6bb-92f55b04b996", "8(888<8L8P8`8d8|8", "939R9", "Microsoft.Windows.100.X19-99666_8wekyb3d8bbwe", "Microsoft.Windows.136.X21-98320_8wekyb3d8bbwe", "X6B8W-TN3XG-6F22Q-RQG6Q-BHCJK", "=L9o<", "c1b9a94b-6763-dfaf-9fe8-b11c3a6d59a9", "=0=4=L=\\=`=t=x=", "ff-Latn-SN", "45e0ccf8-18c7-061c-aa8a-7420cba82f8b", "count", "GetLocaleInfoW", "DataMigration: Not migrating file: [%s]", "f;F$u", "%hs: Failed to read 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber'. Error = %d", "Kan geen installatiekopie vinden voor dit systeem.%0", "=$=(=@=D=H=L=P=T=X=\\=p=t=x=|=", "Problemerne med diskplads i forbindelse med download blev ikke l", "InstallChannelFromSkulib", "4/5Y5", "fi-FI", "Microsoft.Windows.121.X19-98668_8wekyb3d8bbwe", "?H?d?", "t/h|s", "YN4MQ-MQR6P-QWT6F-9BGVP-V8RBQ", ":Q:[:", ".?AV?$CZeroInit@VCDlpActionPackageMigrate@@$00@@", "CDlpResponseImpl > > >::Deserialize", "6\"6+6a6p6w6", "9JCN8-D6K64-2H7TY-XB3TW-DGP22", "No se encuentra el ejecutable de instalaci", "J9P3N-4PQF4-9XW8M-2HGTQ-FM47D", "Kunde inte hitta en installationsavbildning f", "4d8be97f-72d2-afc5-60f5-0d3cfae6097b", "CXmlCursor::CompareExtents", "Impossibile creare o eliminare il messaggio di blocco dell'arresto.%0", "CDlpActionImpl > > >::CheckUserInterruptEx", "w h8$", "DUImage: Initializing payload ImageDU", "%PRO%", "DKDNW-TVC88-9TMY7-YT9PF-8B49Y", "8bcd2f4f-8b45-3e55-522d-c3875c18832e", "RtlAppendLUtf8StringToLUtf8String", "6 7B7", "cych miejsca na dysku potrzebnego do pobrania i rozpakowania no", "SetupDU", ";(;4;T;`;", "ProductKey: SelectImageIndex: Clearing saved SKULIB info because selected edition has changed.", "4BTVN-8469B-GG8H6-D7YWY-FGDGT", "ar-DZ", "En ov", "CDlpActionPackageMigrate::ResumeRoutine", "MoSetupPlatform: Preserve the existing recovery image if available.", "BCN6M-7KMX4-FDP6K-6BF4F-GX2F2", "WaitForThreadpoolTimerCallbacks", "bg-BG", "RtlLengthSecurityDescriptor", "CDlpActionImpl > > >::Initialize", "ibb-NG", "CDlpActionImpl > > >::CheckUserInterruptEx", "F83XK-9QND6-T3GC9-DX6PD-C372F", "NTSTATUS_FROM_WIN32(", "HZo6m|", "a82fbc79-7a7d-1342-dd2e-aa961cf2d291", "DataMigration: Failed to read WebSetup media location Hr=[0x%X].", "bb2e5d22-191c-294c-c00f-79aac3efd61a", "?I?^?", "Microsoft.Windows.7.X21-83724_8wekyb3d8bbwe", "Windows-Wiederherstellungsumgebung kann derzeit nicht gewartet werden.%0", "outil n", "memmove", "teni a le", "=0>F>\\>", "PNX2M-CCXYM-7XD4Q-Y64GX-BKMK7", "ProductsXmlFilePath", "1 1$1(1,101D1H1X1\\1l1p1", "DiskSpaceReq: skipping GDR packages...", "CDlpActionCompat::ExecuteRoutine", "P4N8K-HMWMH-TD94J-DCJFP-XTPHF", "<'<> > > >::GetResultsRoutine", "c1c508de-cb97-15de-0c12-80a1dd2b1fce", "rtill", "0&0<0i0", "WKPKN-YBMB2-KVQ9F-H2XCW-9TPHJ", "ad363a15-61aa-cb4a-c7f3-30edaf1ac0c2", "inde kabul etmedi.%0", "Microsoft.Windows.48.X19-98858_8wekyb3d8bbwe", "DebuggerOptions: Initializing Debugger Type: [Net]", "sszetev", "UnlockFileEx", "9@:O:X:]:g:", "NewContext.Allocate()", "Finalize: Error creating compat instance: [0x%X]", "SkipOCMigration", "8/8D8y8", "2%212C2K2u2}2", "CDlpActionDiskSpaceReq::CallTriggerStorageCleanup", "Microsoft.Windows.171.X21-24740_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-98821_8wekyb3d8bbwe", "L$(Qh", "Failed getting versionless keyform for: {0}", "4\"4.494W4n4", "CDlpActionCompat::GetResultsSysReq", "ExecuteInstallReq: Error reporting telemetry for bExtDriveUsed: [0x%X]", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "ActionListPath", " /MediaArch %s", "Microsoft.Windows.7.X21-83745_8wekyb3d8bbwe", "Aucune offre correspondant aux crit", "rizze a csomag tartalm", "es-SV", "CDlpActionCompat::DeserializeFinalizeReqScan", "fr-CD", ">A>U>o>|>", "CDlpActionDataMigrate::MigrateLicenseState", ":X:q:", "YCT8J-N9JVK-V2KYK-CH7DX-RM48H", "0004080@0X0\\0d0|0", "3e1f71dc-b9ae-fd63-c3a2-e99682911015", "t$(VW", "Microsoft.Windows.98.X20-29590_8wekyb3d8bbwe", "CDlpActionImpl > > >::InitializeRoutine", "deab2afa-33d0-db7a-ac5b-111af1ce1a2d", "4*505\\5{5", "BCryptCloseAlgorithmProvider", "CDlpActionProductKeyValidate::ExecuteRoutine", "CDlpActionDiskSpaceReq::ExecuteDownloadReq", "Bugcheck param 2", "j\\hps", "XMGYY-R8NRP-DV4CM-7QYP4-9W6BQ", "9f9m9", ".?AVCBcdUtils@@", "?\"?/?6?M?T?", "Microsoft.Windows.7.res-v4291_8wekyb3d8bbwe", "a3964773-6055-f435-0da5-fbfe4b816cfe", "4*515", "DataMigration: Initializing OfflineGather: [%s]", ".?AVIDlpRestartable@@", "6`7l8~8", "Microsoft.Windows.98.X20-44905_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-99514_8wekyb3d8bbwe", "Translated a DontSync entry with ID 0x%x", "9:9D9q9{9", "HN6JV-2PVDT-VHX2K-BVRMY-WHV3D", "BiExportStoreAlterationsToEfi failed %x", "46169a66-5cad-f39b-3ce4-83b2745b99d8", "Microsoft.Windows.49.X19-99522_8wekyb3d8bbwe", "quc-Latn", "feac0d25-1bde-48b4-0807-099197cbe1bd", "::RtlIsLBlobValid(Source)", "FreeLibrary", "memmove_s", "`.data", "DUImage: Downloaded %d LangPack updates.", "Die Speicherplatzanforderungen zum Herunterladen und Entpacken von Medien f", "Target OS: UpgradeFlags = [0x%X]", "Microsoft.Windows.7.X21-83737_8wekyb3d8bbwe", "882caa2e-f7a8-c9e1-afff-25306ec3e591", "8I8d8|8", "DM2KN-J8JPJ-6VD2F-QPB9D-PYT4R", "8PNQX-RF873-CXRPY-8J42B-XBWWC", "Het systeem voldoet niet aan de compatibiliteitsscan voor het installeren van de update.%0", "7N977-4C3F2-KRQYD-J3T8J-PKCH3", "N09{4u", "6I6`6", "1V1l1", "XN9J7-JRDBW-H38BQ-8CFVW-WB6KQ", "nimos de compatibilidade n", "CDlpActionImpl > > >::ExecuteResponse", "DBGJD-HN3WP-V9VQC-4WXC7-B7W4K", "Microsoft.Windows.99.X19-99562_8wekyb3d8bbwe", "InstallPackage", " per l'installazione dell'aggiornamento.%0", "b1399e8c-1de4-2f44-8b18-5fd31ec76009", "?'?/?l?", "Microsoft.Windows.27.X20-00860_8wekyb3d8bbwe", "FHN6M-B7FTV-DGC97-K7F98-82QD6", "24c2d982-7385-9e41-a30d-09c297d0a6bf", ">=>G>t>~>", "!E\\H4", "NPW4D-8DK99-VT9WM-9K2CM-8FG36", "?D?N?x?", "N9QCR-YMVJ3-VY847-8XPWQ-977Y8", "76ca07c4-730c-df4d-7dc9-548271d90c76", "vel localizar uma imagem de instala", "O relat", "GHH37-F4N9K-3MHBJ-MQRRW-D9MQG", "Installationsprocessen pausades.%0", "CDlpActionPackageMigrate::MigratePackages", ".?AV?$CZeroInit@VCDlpActionImageDeploy@@$00@@", "bcrypt.dll", "7J8Z8", "si lemezk", "PreFinalize: Automation error: [0x%X]", " architetture. %0", "Denne versjonen av verkt", "050?0F0P0b0p0w0", ">->B>I>_>f>z>", "RtlIsLBlobValid(BinaryData)", "757p7", "uw!\\$", "Activation: Suspend was requested", "eafabc82-86a9-014d-71df-657935ee3e02", "PD9BN-KTQRG-2GH6T-3BT96-KTRBM", ">+>6>c>m>", "Betriebssystem Microsoft", "ImageExit: Initializing Scenario: [%d]", "x/fzz", "itli uyumluluk taramas", "sr-latn-cs", "The install diskspace issues were not resolved within the required time limit.%0", "vg0\\PbkU0", "5O6y6", "ulIndex < m_Header->ulTotalNodeCount", ":2:@:H:", "Nyttelastfiler er skadet.%0", "Microsoft.Windows.4.X19-99672_8wekyb3d8bbwe", "Het installatieproces is onverwacht be", "6E7i7n7", "ra redan beg", "Log: Failed To Get Msg From ID", "kompatibilit", "210303183039Z0p1", "GNY6G-JQPBM-HJDY7-B4KDP-YKMK4", "1>1E1V1]1u1", "d453110b-f9fc-726a-59d8-8d419922d03b", ";#<;9?W?z?", " s neplatn", "CDlpActionImpl > > >::GetProgress", "CDlpActionPackageMigrateFactory::CreateInstanceRoutine", "Microsoft.Windows.161.X21-43633_8wekyb3d8bbwe", " obrazu instalacyjnego tego systemu.%0", "$Microsoft Ireland Operations Limited1&0$", "1%2,2?2F2\\2", "Microsoft.Windows.188.X21-99376_8wekyb3d8bbwe", "677t7", "1a1aa123-c15c-5111-d443-bc9613e219dd", "a35474e6-1706-a2dc-6ae5-ad803f3f7f7f", "FHDPX-JNVDW-FF3RD-HPDKC-MP2TB", "< <(<0<8<@ > > >::DeserializeRoutine", "WATSON_STACK_TEXT", "Microsoft.Windows.4.X19-99674_8wekyb3d8bbwe", " cancelar porque el dispositivo no tiene suficiente espacio en disco para instalar.%0", "Kompatiblitetsproblemen f", "PackageMigration: Migrating GDR packages from [%s] into Target OS...", "2:3R3", " [0x%I64X / 0x%I64X]", "Translation", "CDlpActionFactoryImpl >,class CDlpActionFinalizeFactory,class CDlpActionFinalize>::GetActionId", " Nytt fors", "nl-BE", "ve-ZA", "OYu-Nn0 ", "tr-TR", "WimBufferToHexString", "ivitysagenttiasiakkaan odottamaton versio.%0", "dcdc3493-a32e-2514-865a-9916dc32ffc8", "CDlpActionProductKeyValidate::PopulateImageInfoSet", "CloserElement = this->AllocateStreamObject()", "mr-IN", "05ce649a-eed1-d14e-aa01-4045f35ca54d", "IMAGE\\WINDOWS\\INSTALLATIONTYPE", "258c688f-d982-4403-1688-eeda394ecebc", "memcpy", "her spezifizierter Fehler erkannt.%0", "7#7d7|7", "YQTNY-6Y3D3-HYCF9-BB99B-43K2J", "2K98T-2NYMC-FT4VT-XH8GX-FRJYQ", "CDlpResponseAutomation::InitializeRoutineMigChoice", "Compatibility: Resolve successfully completed.", "Microsoft.Windows.122.X19-99473_8wekyb3d8bbwe", "uje po", "CDriverCallback::ValidateDriverPackage: Package found under reflection path - Returning DRV_ANSWER_REFLECT. {89E750E4-77A4-44F2-A450-368978DA08CB}", "MoSetupPlatform: Suspending SetupAutomation object to [%s]...", "ERROR_SXS_ASSEMBLY_MISSING", "ndsinstallasjonsskript kan ikke kj", "Microsoft.Windows.8.X21-83185_8wekyb3d8bbwe", "MediaPath", "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeName", "78ad7fd4-aaaf-e2ff-a457-ca636a7c842f", "nika.%0", ".?AV?$CZeroInit@VCDlpActionCompatFactory@@$00@@", " http://www.microsoft.com/windows0", "Recovery: Image Edition ID: [%s]", "Microsoft.Windows.125.X21-83250_8wekyb3d8bbwe", "serverstorageworkgroup", "ulValue < MultFactor", "6H6i6x6", "BootFinalize: Initializing Target: [%c]", "Microsoft.Windows.98.X20-15876_8wekyb3d8bbwe", "zane w ramach wymaganego limitu czasu.%0", "ZwSetValueKey", "1#212?2", "3f4b5d66-2e78-a473-c74c-7675e98b940d", "EDU_N", "(unknown enumerant ", "9N9T9", "swprintf_s", "teruppta den tidigare p", "Installationsprocessen startades med ett ok", "9)9h9", "CDlpActionImpl > > >::UpdateState", "onecore\\base\\ntsetup\\lib\\narratorutil\\src\\narratorutil.cpp", "SetupLog", "4752babe-6396-cd46-bf0b-c2af7bf4aa24", "DB4MM-NPT6H-W6Q63-M73Y7-CYVCJ", "o em disco suficiente para instala", "Un script engag", "7916045c-88ba-0f57-e9b2-d9fdc07ea88b", "r die Installation aufweist.%0", "SetupCore: Registered IMAGE_EXIT action", ":I:v:", "bs-Cyrl", "MicrodomImplementation::CMicrodom::Initialize", "FLT_UNDERFLOW", "K62NP-KT2WK-6HX2X-B8JJR-PPQPM", "Microsoft.Windows.17.X17-66964_8wekyb3d8bbwe", "0f0D0~0[0", "f692d8a4-a7a5-fd7a-b326-3cb59aef80b0", "NPYGM-T4JGM-RBDJC-KVRBM-F9CHV", "No se cre", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@", "dNarratorUIClass", "51c9b746-232c-af4f-314e-8894846a1247", "TempNodes.Allocate(UpperIndex - TheElement.Reserved)", "CheckDiskSpace: Drive [%c] is BitLocker enabled", "707N7`7n7", "@*97u", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode", "ProductKey", "CDlpActionFinalize::ArmReserveManagerForReboot", "57fd41a9-e9fd-815d-6687-17b5f8ff18f9", "CHCDD-NBFKY-M8DJM-MHYBQ-T6RFF", " wersj", "CElementModification::ChangeTextValue", "Y8D8N-6XHGY-D3V7X-8648J-78RB7", "Microsoft.Windows.4.X19-99696_8wekyb3d8bbwe", "ProfessionalEducationN", "Microsoft.Windows.164.X21-06154_8wekyb3d8bbwe", "9!:>:", "Der er ingen pakker, som skal downloades.%0", "6bb17b1a-4cf8-0e82-84d9-f3bb8cc30502", "8 8(80888@8H8P8X8`8h8p8x8", "MG29Q-WWWH3-QCXCD-KT7RQ-HQQFC", "cf8c5921-2a2a-29a5-6f28-c3e5c4d1f565", ">#>)>:>@>", "68NBD-KD2XT-PGR79-BM8QY-TXXRC", "Microsoft.Windows.98.X20-29583_8wekyb3d8bbwe", "o em disco para transfer", "CDriverCallback::ValidateDriverPackage: Not migrating blocked package. {5E08BE46-2307-4752-9A54-7C2761642DFD}", "718N8`8j8", "B7JR7-N48R8-6JB9G-942YX-T83XW", "ProfessionalN", "78e6608c-8f7e-f704-fb28-1c205d165358", "DUCategoriesCmdlineFlag", "tti eszk", "ny kivonata nem tal", "6dd35df5-561e-9b83-c3d5-58c752a9a5be", " trouv", "b3267dc8-96db-fbbb-752a-737ef02856d1", "GetModuleHandleExW", "4HGWB-MNV2D-YV8WV-RX83M-R62JM", "si parancsprogram v", "zh-CHT", ":*;0;R;[;w;};", "41d042f0-0e3e-409a-ab6e-d22de88f5cfd", "Installasjonen kan ikke fortsette fordi fullf", "1.2A2p2w2", "D$LSP", "CDlpActionPackageMigrate::InitializeRoutine", "0C0r0", "AllowPartitionChanges", "Converting to NT filename failed", "a0411bca-cf7a-4d90-a21f-2bd31ee69506", "WTHelperProvDataFromStateData", "7c442192-0bfe-577b-5bcd-2b33d3d31187", "Microsoft.Windows.145.X21-83699_8wekyb3d8bbwe", "CDlpActionFactoryImpl >,class CDlpActionRecoveryFactory,class CDlpActionRecovery>::GetActionId", "te-IN", "39ed6ee1-790c-c15b-6893-58734331c64f", "Microsoft.Windows.121.X20-29640_8wekyb3d8bbwe", "ConX::Setup::Common::COSInfoHelper::GetHostSkuInfo: GetProductInfo failed, Err=%d", "98caebba-369f-5044-a921-1f692884de70", "serverdatacenteracor", "L$\\_^[3", "TWTQC-WN4RR-FRFP9-QJ9R9-MG9RM", "=+=;=C=J=Q=i=", "5efbf535-2402-b1cb-e2f2-3687350e548d", ">6>`>", "baff6551-7fa0-4071-c7ec-f00ac7cd1bd2", "SWj43", "The diagnostics object was not created. Events cannot be reported.%0", "yo-NG", "CDlpActionDiskPartition::DeserializeRoutine", "Not-null check failed: Params", "ar-KW", "4XKB3-CN8G6-M9HBH-R3GYB-39MMG", "nyt asentamista varten.%0", "Microsoft.Windows.98.X19-99597_8wekyb3d8bbwe", "CDlpActionImpl > > >::CheckUserInterruptEx", "PackagePath", "YVWGF-BXNMC-HTQYQ-CPQ99-66QFC", "O utilizador optou por cancelar o an", "Der blev fundet en uventet version af Update Agent-klienten.%0", "F8PSj", "=*>c>", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDebuggerOptionsFactory@@VCDlpActionDebuggerOptions@@@@", "Microsoft.Windows.100.X20-29720_8wekyb3d8bbwe", "8JKQN-CYCPT-PW8R8-CTWHY-VQYMF", "n de migraci", "1baed060-4b63-d54c-7d2c-83c3614dda03", "9a<>?", "a3a5edb3-03f0-c2d5-4a36-1aeb9e644908", "GetSupportedDriveLetters: Drive [%c] bIsReadOnlyDrive = [%s]", "DiskSpace: Desired Post upgrade free space: [%llu] MB", "5<5I5a5", "Microsoft.Windows.4.X19-99676_8wekyb3d8bbwe", "Synchronizing store with firmware", "wcschr", "t taramas", "DUImage: Skipping Dynamic Update due to timeout getting LangPack updates.", "OpenSemaphoreW", "Microsoft.Windows.49.X20-29564_8wekyb3d8bbwe", "Installationsprocessen blev ikke fuldf", " laste ned og pakke ut multiarkitekturmedier.%0", "Microsoft.Windows.99.X20-23530_8wekyb3d8bbwe", "6c8d3dcb-ce05-587e-62bf-1010c8a86714", "6M6{6", " z serwera jest niepoprawnie sformu", "DUOptIn", "Basebrd", "Finalize: Remapping internal cancellation request [0x%X] -> [0x%X]", "9s v5", "EULA[*]", " il dispositivo non dispone di spazio su disco sufficiente per l'installazione.%0", "ProductKey: Error reporting telemetry for GatherOSState exit code: [0x%X]", "8PYNV-8RJ8R-7K93C-RGPJX-RM7WT", "32275875-e43d-d18a-a7ed-172934c1934a", "N0R&{", "ProductKey: No SkuLib Upgrade edition available.", "Microsoft.Windows.22.X17-53885_8wekyb3d8bbwe", "Wj(Q3", "FreeSid", "3*313", "vel encontrar uma letra de unidade de destino. %0", "Proces instalacji nie zosta", "SaveOffset failed", "SetupCore: Registered PRE_FINALIZE action", "Microsoft.Windows.121.X20-29612_8wekyb3d8bbwe", "CDlpActionCompat::RescanAsync", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItemNs", "T9>F>V>u>", "[SetupConfig]", "na obs", "=9>g>", "RNVXQ-7KVPJ-HG3HW-FXB68-D9G73", "Microsoft.Windows.99.res-v3264_8wekyb3d8bbwe", "Microsoft.Windows.4.X19-98707_8wekyb3d8bbwe", "Microsoft.Windows.164.res-v3793_8wekyb3d8bbwe", "BQQ76-BD8XB-JTPK4-YC93K-JMJYX", "21282?2F2M2", "16d7c127-3e28-ff41-f786-d0068acfc9e5", "Microsoft.Windows.48.X20-32146_8wekyb3d8bbwe", "8e4d0d87-b781-6b32-c5d5-c6a9c7eb893b", "Compatibility: Calling Resolve(SETUP_DISMISS_ALL_RESOLVE_STRING)", "Microsoft.Windows.98.X20-24580_8wekyb3d8bbwe", "Microsoft.Windows.161.X21-43631_8wekyb3d8bbwe", "Microsoft.Windows.145.X21-83753_8wekyb3d8bbwe", "9\";?;J;t;", "8L8y8", "665f6f21-1692-5d08-17e4-934e0c638268", "5&5-5O5V5x5", "PRWQJ-K4NGT-8H2TM-PJXJ4-BY7B6", "RegQueryValueExW", "Microsoft.Windows.162.X21-04954_8wekyb3d8bbwe", " holde avinstalleringsalternativet aktivt.%0", "2L3b3", "ky-KG", " il sistema non ha superato l'analisi della compatibilit", "g akt", "Finalize: Delaying telemetry upload until exit action.", "Microsoft.Windows.171.X21-24742_8wekyb3d8bbwe", "o encerrado inesperadamente.%0", "7$7,787@7H7P7X7`7h7p7x7", "=.=A=b=|=", "Microsoft.Windows.4.X19-99705_8wekyb3d8bbwe", "6)7b7 8C8_8w8", "g0M0~0[0", "SystemPartition", "Installasjonsplattformen har funnet en uspesifisert feil.%0", "CompatFinalizeReq: Initializing Image Index: [%d]", "File[*]\\Architecture_Loc", "dc43bdc4-5263-64ab-f814-51be4c28ed51", "%hu.%hu.%hu.%hu", "Microsoft.Windows.48.X20-35544_8wekyb3d8bbwe", "a9bddef1-4a6b-b1e6-a022-f52b70e9d75e", "Microsoft.Windows.50.res-v4335_8wekyb3d8bbwe", "GetProcessHeap", "HBY4H-RNXB8-Y2YTR-443VB-MY6F8", "EventProviderEnabled", "CDlpActionImpl > > >::Initialize", "46BNG-GP74X-PT69H-MVWD3-7T9TG", "LoadLibraryExW", "4A4\\4", "Microsoft.Windows.7.X21-83683_8wekyb3d8bbwe", "090T0o0", "ProcessorNameString", "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )", "K8ND4-KBPFY-3QCDH-2MQQB-2PQX7", "WWhl*", "3X4f4|4", "me.%0", "d4081056-a1b9-6ed6-1288-b7f86067ea4c", "grehajthat", "Brugeren har valgt at annullere, fordi systemet ikke opfylder minimumskravene til genoprettelse af Windows.%0", "CDlpActionDiskSpaceReq::DeserializeRoutine", "07cba33f-13bd-2d4d-e600-190199c378da", " puuttuu.%0", "InitializeRoutine: UNKNOWN", "CDlpActionRecoveryFactory::CreateInstanceRoutine", "ZwQueryInformationProcess", "SetEndOfFile", "CompatFinalizeReq: Initializing SPMajor Version: [%d]", "DataMigration: Not requesting file migration.", "00e232a4-9952-b228-e45b-8af3b908e183", "Microsoft.Windows.8.X17-66951_8wekyb3d8bbwe", ">%>d>k>", "Brugeren har valgt at annullere, da enheden ikke har tilstr", ";&;-;6;I;P;Y;~;", "[19H1]", "DataMigration: Initializing Target: [%c]", "ProgressCurrent", "GXN9C-9G2DB-C2H6F-CG4QY-39MMP", "9^$>g>t>", "bsearch", "?*?2?B?X?a?m?u?", "FACILITY_HYPERVISOR", "cfb258a3-4d58-7a9e-2473-cff56225c762", "01XJTg0M0~0[0", "f29c3237-cd09-88eb-afa3-bc4d7c14c804", "argument out of domain", "98;l;", " a Friss", "V3VRY-WYNMD-PW8GJ-2XV4M-CWF9G", "QW889-26N3M-P2X9V-2RH7Y-YWT2B", "RtlDeleteResource", "6cfba5a0-7f9d-7bb9-03bd-99191cef43a3", "Microsoft.Windows.49.X19-99507_8wekyb3d8bbwe", "RtlSetDaclSecurityDescriptor", "Microsoft.Windows.162.X20-00861_8wekyb3d8bbwe", "ImageExit: Initializing SQM: [%s]", "n. Comprueba el contenido del paquete.%0", "Microsoft.Windows.98.X19-99582_8wekyb3d8bbwe", "ADVAPI32.dll", "tg-Cyrl", "md3rQ@", "FTPKP-6DNGQ-47VWJ-R4X2W-Q699F", "bad file descriptor", "not enough memory", "dia multiarquitetura.%0", "CDlpActionImpl > > >::UpdateState", "eni nedeniyle g", "Configurar A", "CDlpActionImpl > > >::SerializeRoutine", "llnings", "6&6R6_6f6", "9fbacd96-d8a6-e440-4bc9-87c8b2860337", "lemedi.%0", "NetPort", "CDlpResponseImpl > > >::GetResults", "Microsoft.Windows.48.X19-98851_8wekyb3d8bbwe", "lo k chyb", ".?AV?$CZeroInit@VCDlpActionActivation@@$00@@", "?!?P?c?", "pa-Arab-PK", "Microsoft.Windows.48.X19-99715_8wekyb3d8bbwe", "lle ei l", "WARNING", "040504B0", "112R2e2", "Esiasennuksen komentosarjan suorittaminen ep", "\\$4YY", "Volume", "STATUS_SXS_IDENTITIES_DIFFERENT", "DebuggerOptions: Initializing Debugger Host IP: [0x%X]", "sr-Latn-CS", "ERROR_SUCCESS_REBOOT_INITIATED", "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de minimum vereisten voor het herstellen van Windows.%0", "ProductKeyHostOS", "TriggerStoragePolicies is not supported", "NHKY8-V4VGV-BT322-H2DBB-TXYWG", "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)", ".?AVCDlpWimInfo@@", "0$0D0L0X0x0", "BootFinalize: Initializing Update and Shutdown: [%s]", "?!?(?R?l?", "Activation: Something went wrong during Polling.", "0 0'0=0D0", "3L3W3", "RtlDuplicateLBlob", "CDlpActionFinalize::ResumeRoutine", "Microsoft.Windows.48.X19-98848_8wekyb3d8bbwe", "73DYK-MYXR4-DF43W-82VQ6-KR7CB", "m_StoredTable.Initialize()", "4c81231f-149d-3c69-dfef-db65727481d0", "Microsoft.Windows.27.X20-00859_8wekyb3d8bbwe", "PreSelectedLanguage", "25e89c3c-a750-7b58-97e7-e80682d8ce72", "Installasjonsprosessen krever at brukeren godtar lisensavtalen.%0", "TQN2F-TQWM4-DTPVH-D3FB7-CYVJ6", "TVDW8-7NPHX-GXY7F-X6T3H-G6PJR", "Microsoft.Windows.48.X19-99481_8wekyb3d8bbwe", ", proto", "10f6e94c-d449-60eb-800e-b3f314df1a71", "hu instalace nen", "Microsoft.Windows.162.X21-43648_8wekyb3d8bbwe", "Egy hibakezel", "PRh,%", "Microsoft.Windows.98.X19-99578_8wekyb3d8bbwe", "|d-Vk", "QQSVW3", "969@9X9", "f39d8e46-a1c4-ce10-36be-1021a4c0754e", "|$0u&", "69NHX-WQQ7G-QVBPG-4HPQP-8XDB7", "fc4ffa48-a219-f88f-ec15-ef961cbf5578", "MoSetupPlatform: SetupPlatform::INewSystem::Finalize returned: [0x%X]", "9(919H9O9]9", "Microsoft.Windows.98.X20-35494_8wekyb3d8bbwe", "8?8N8u8", ".?AVIDlpResponseFactory@@", "f618c4c4-b1ea-468a-516c-7e0e9915200c", "operation_in_progress", "Microsoft.Windows.139.X99-99999_8wekyb3d8bbwe", "33QT6-RCNYF-DXB4F-DGP7B-7MHX9", "DUImage: Searching for GDR updates...", "FNYQ6-7MJJH-MHBWT-HWTQG-8TYMH", ";D$$u", "t&f;E", "The system does not pass the diskspace requirements to download the payload.%0", "serverdatacenter", "YB}bk", "The minimum requirements compatibility issues were not resolved within the required time limit.%0", "cc59514a-ad7f-dc01-503d-8cf34e4e9f76", "bfe31205-f327-6433-949f-1df8c6ec6a8c", "G4J8V-NC892-P2HCW-GQF9M-WHVX6", "ta-LK", "DBN7V-4R3HT-7P6Y3-TBJDT-GMPM3", "316b3942-5097-7dc5-85c4-520c1bac5466", "=(=0=<=\\=h=", "RC4VN-4GQBW-WYPTV-3BD66-FVXR6", "Microsoft.Windows.122.X19-98688_8wekyb3d8bbwe", "ImageDU", "%wOtF", "Microsoft.Windows.146.X21-83741_8wekyb3d8bbwe", "0L0zv", "Activation", "c62e1eeb-ada4-ac0d-1c59-fc6d5a4b1980", "GetWebSetupUserInput: Execute: PreSelected Edition is = [%s].", "Microsoft.Windows.50.X18-81309_8wekyb3d8bbwe", "Microsoft\\Windows NT\\CurrentVersion", "pToRemove != 0", "Setup Core-acties", "in en d", " podpis.%0", "7NFK4-8GG72-XH3G6-XC7TF-KBV4W", "SourceBuild", "ActionListParser::ParseMediaPackage", "2a8c537b-e754-fa64-bbe3-4e8581fc414c", "2WPGN-4JH6M-BB4YK-TVF3F-7H7CK", "CDlpActionProductKeyValidate::ValidateEICfgFile", "041D04B0", "TargetUsbDrive", "s, mert hi", "RP2X2-C2NFW-RGFM7-VGWQW-VH8XH", " > > >::Initialize", "CheckDiskSpace: Error reporting telemetry for DISKSPACE_DATAID_OSPARTITION_REQUIREDSPACE_NO_STORAGERESERVES: [0x%X]", "?%?Q?\\?", "KH86N-T2W2H-YTKVC-7QDHC-YKPJC", "MoSetupPlatform: ExecuteCurrentOperations was successful!", "DJBMD-4F9CD-YJ9Q4-NDHD2-6JF9H", "a2dfc2a6-9d22-1e71-70de-f7f28278d232", "Microsoft.Windows.95.X99-99999_8wekyb3d8bbwe", "Microsoft.Windows.164.X21-11809_8wekyb3d8bbwe", "ACCESSDENIED-feil oppstod i de f", "EDU_KN", "TheNode != TheNode.InvalidValue()", "QSWh$V", "Created boot entry 0x%x using cached variable", "b541c0b5-d28f-4ade-cb28-e560a4dc334b", "060?0M0T0f0~0", "?!?2?A?S?s?x?}?", "CompatFinalizeReq: Initializing Processor Architecture:[%d]", "ados.%0", "939f273b-a050-0ff3-2509-a2f0c210ae17", "XRC2X-2RN9M-F6BT9-V9BX7-R9FBX", "<$(>,>D>H>`>d>|>", "1'1O1", " el proceso de instalaci", "CWHF2-FNTDD-6FMTF-7K6HC-FX8XQ", "installation va ", "QGN8F-VCF82-DXQ6D-XCBBW-29XRV", ". Les ", "8HQ9M-QNCX9-FV4G2-88VDT-6FXGD", "illegal byte sequence", "161N1", "b571de05-2149-a31e-3a7e-411e8417a643", "r minimumskravene for ", "9K4Q3-XNV7V-QQFFR-DCXGT-H8RCC", "Microsoft.Windows.146.X21-83746_8wekyb3d8bbwe", "Target OS: Detected Source SPVersion = [%s]", "DiskSpaceDownloadReq: Initializing UseExtDrive: [%s]", "6c0ac4b2-43ea-fc5a-adee-c9b8d495aef4", "CLIENT_KN", "?,?5?V?m?y?", "*ppObject = State->m_pAllocator->Allocate()", "Microsoft.Windows.121.X19-98671_8wekyb3d8bbwe", "67818069-a73c-d397-8934-f934e28ced7d", "gend Speicherplatz f", "5h5o5", "srendszer-vissza", "PackageMigration: Initializing FOD Path: [%s]", "NW0~0W0_0", "j\\Xf;A", ".idata$3", "YMBMN-JM3KY-VVT26-9X2DJ-D9QD6", "0454df5d-b971-b6aa-0e24-6a96ec650ccd", "670152bd-b5d1-a0d9-d608-341b3b31f83d", "9-:4:G:N:a:h:", "CDlpActionProductKeyValidate::ValidateAndGetUpdatedDefaultProductKey", "N3M67-82C2B-64DVW-C7BP2-7CFDM", "9772215d-d6aa-6945-7a70-a01c0b75d563", "4 5@5l5", ".?AVCDlpActionSummary@@", ";E+>", "Microsoft.Windows.7.X17-36796_8wekyb3d8bbwe", "Systemet opfylder ikke minimumskravene til genoprettelse af Windows.%0", "The user has chosen to abort Setup to keep Uninstall option active.%0", "enterprisesn", "FindFirstChunk", "3I4P4", "Sistema Operativo Microsoft", "GetSystemMetrics", "0%080b0i0u0", "el hash instance.%0", "No packages to be downloaded.%0", "SOFTWARE\\Microsoft\\Sysprep", "DataMigration: Queue Request for data migration - full upgrade scope", "De gebruiker heeft ervoor gekozen om Setup af te breken en de optie voor het ongedaan maken van de installatie actief te houden.%0", "Microsoft.Windows.162.X21-83177_8wekyb3d8bbwe", "Microsoft.Windows.7.X21-83742_8wekyb3d8bbwe", "PVVj@Wh", "DiskPartition: Target drive not found in automation.", "EventRegister", "s kezdeti szakaszaiban ACCESSDENIED hiba l", "Wykonywanie skryptu powodzenia nie powiod", "MoSetupPlatform: Resume requested without Pause.", "PPPjd", "File[*]\\FileName", "Microsoft.Windows.4.X21-05132_8wekyb3d8bbwe", "c7d0ad9f-b664-baaf-0194-4aba01522e7f", "Microsoft.Windows.122.X19-98837_8wekyb3d8bbwe", "MMNXW-37YYP-RV6PQ-WVD4Y-R63H8", " > > >::GetError", "Microsoft.Windows.164.X21-11811_8wekyb3d8bbwe", "83172dcb-5e3b-50be-1324-d41e6766eccf", "~,9~(t", "Microsoft.Windows.98.res-v3269_8wekyb3d8bbwe", "Az adattartalomf", "96GT9-N299H-9HBTB-9H6WW-82QFF", "20b91409-d1a0-f476-4b33-e5243b6d2fc0", "Antwoord van server is ongeldig.%0", "627A7", "5#606Y6d6", "HRNHB-MDMKJ-7B74M-FB6M8-JFG7B", "Microsoft.Windows.126.X21-83276_8wekyb3d8bbwe", "__rv.UcsCharacter != (0xffffffff)", "tre consolid", "Problemene med portet kompatibilitet ble ikke l", "ActionListParser::ParseInstallFeature", " vazio.%0", "de5d27de-33e6-6fa9-bd07-26a948eba840", ".?AV?$CMoSetupActionImpl@V?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@@@@@@@", "53a8ebd2-fd2a-2177-36be-cfb6e1d36c4d", "es-EC", "nso-ZA", "8*8Q8e8q8", "62d7b6a5-6cd9-6baa-3908-5dea053ad93e", "YF922-NMRJ6-JY939-HFGQ6-RRHKD", "No se ha encontrado ninguna oferta que coincida con los criterios necesarios.%0", "WGGHN-J84D6-QYCPR-T7PJ7-X766F", "setting hardlink failed", ";#;;;V;q;", "RestoreMountStub: Could not move hardlink stub to prepopulate location", "nyt lataamista varten.%0", " /MCTUILanguage %s", "Failed install count for build [%s] is [%d]", "??0exception@@QAE@ABQBD@Z", "Microsoft.Windows.125.X21-83231_8wekyb3d8bbwe", "GetLogicalDriveStringsW", "290d5979-55d5-9572-8dc3-c6398eda81b4", "F4QQS", "DiskSpaceReq: We have an external drive to calculate minimum required space on system drive", "n_0W0f0D0~0[0", "CDlpActionImpl > > >::Resume", "YRD24-NDX6K-Q92J9-42HP6-H8RBQ", "Um script excedeu o limite de tempo.%0", "_u.9S(t", "3#3=3W3o3", "DataMigration: Migrating WebSetup media location [%s].", "84810201-9214-329b-be2c-f16cc0ad91eb", "D$L9A", "ProductKey: Matching Install Wim: No edition provided, matching all images.", "7e126f00-204f-08cf-c092-7d0d84d5d000", "CMicrodomBuilder::ProduceStringTable", "ImageFinalize: Initializing Mode: [%d]", "CDlpActionDU::GetResultsRoutine", "39HPt", "Microsoft.Windows.98.X20-29576_8wekyb3d8bbwe", "es Principais", "9$959;9D9N9`9g9o9x9", "Microsoft.Windows.8.X21-83720_8wekyb3d8bbwe", "ProductKey: Eula = %s", "BuildBranch", "NMQWG-TM4R6-2QKJK-MPRCC-BTDGY", "Nutzlastdateien waren besch", " au pr", "50a838e9-66e2-7101-c383-6eec46e8d0aa", "ImageDeploy: Initializing Target: [%c]", "Microsoft.Windows.125.X21-83244_8wekyb3d8bbwe", "r Item ", "cb836420-c8e8-a73b-b693-776028ce365e", "laton.%0", "e581d7fc-ac88-a358-976c-b5236f62cd66", "Microsoft.Windows.48.X19-99716_8wekyb3d8bbwe", "Microsoft.Windows.48.X19-99500_8wekyb3d8bbwe", "DUImage: Skipping Dynamic Update due to timeout getting GDR updates.", "CDlpActionCompatFactory::CreateInstanceRoutine", "YJQ8K-M7FV8-93RC3-VH7WQ-TYKB7", "DUImage: Generating hardware compatibility file [%s]...", "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART", "HostOSBuildNumber", "\\ArcName\\multi(0)disk(0)rdisk(0)", "EventWriteTransfer", "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)", "474V4", "MigChoice: Before Migration Filter -> [%s]", "FveUnlockVolume", "HDNGX-P72PX-PVYMX-K932H-R9CTC", "Brugeren har valgt at annullere, fordi systemet ikke opfylder kravene i kompatibilitetsscanningen til installation af opdateringen.%0", "Het diagnoseobject is niet gemaakt. Gebeurtenissen kunnen niet worden gemeld.%0", "ndaren accepterade inte licensvillkoren.%0", " [0x%X] for telemetry.", "3 3$3(3,3034383<3P3T3X3l3p3", "CDlpActionFactoryImpl >,class CDlpActionEulaFactory,class CDlpActionEula>::GetActionId", "si folyamat nem fejez", "Speeg/T", "718^8k8x8", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility", "9JQNQ-V8HQ6-PKB8H-GGHRY-R62H6", "1%2_2u2", "30e20fad-4d8b-1615-eb3a-8f660d28348f", "ttelep", ">MdDtt", ":=;I;d;Y > > >::Execute", "lise compacta protegida para instalar a atualiza", "293C3Y3", " stato trovato.%0", "remedi", "STATUS_NO_MORE_MATCHES", "JF9NT-7JJCQ-HPKQF-X4PPJ-VH642", "No se pudo continuar con la instalaci", "3$3,343<3D3L3T3\\3d3l3t3|3", "CDlpResponseAutomation::GetResultsRoutineUpdateMedia", "285c76ab-c5b7-68eb-944b-3f5293a26ce3", "Microsoft.Windows.161.X21-83177_8wekyb3d8bbwe", "Microsoft.Windows.98.X19-98883_8wekyb3d8bbwe", "rdateien f", "Microsoft.Windows.48.X19-99491_8wekyb3d8bbwe", "7F7o7", "W7RNC-HPTRX-DCQ9T-GBGW9-H6DDQ", "Die Installation kann nicht fortgesetzt werden, weil bereits ein Abschlussvorgang angefordert wurde.%0", "3%4C4a4~4", "Systemet opfylder ikke kravene i kompatibilitetsscanningen til installation af opdateringen.%0", "RtlIsLUtf8StringValid(Name)", "B9H4N-38JYF-3XY33-QPVD4-YTDD6", "L0zzg0Y0", "PackageMigration: Initializing GDR Count [%ld]", "GetFinalPathNameByHandleW", "2@2n2", "PreFinalize: Queue Request for driver installation", "MoSetupPlatform: Persisting telemetry data", "PackageMigration: Initializing Critical paths [%ld] [%s]", "destination_address_required", "72443ffb-2478-4a66-babc-5af8e236546a", "nia minimalnych wymaga", " ei t", "nce ba", "ImageDeploy: Initializing BitLocker Mode: [Suspend]", "Microsoft.Windows.48.X20-29566_8wekyb3d8bbwe", "tKWVj", "NPPR9-FWDCX-D2C8J-H872K-2YT43", "de375d4a-3c5d-7344-db44-cf8fc849f31c", "2$2,242<2D2L2T2\\2d2l2t2|2", "D$@PW", "DATATYPE_MISALIGNMENT", "660c85c9-5f1a-01b0-2811-67b09f9a61c4", "Payload", "Enumerate_OnDemand", "MicrodomImplementation::CDomPositionCache::GetLocation", "DYNQ8-H7BQB-YCF8K-PM77M-PR66D", "C6HQY-NDPTB-B8V8D-BKY6X-FRG4F", "Failed to get img buf", "lido.%0", "1v1}1", "1<2g2t2", "InitializeCriticalSectionEx", "(Bytes % sizeof(WCHAR)) == 0", "u.FAB;", "host unreachable", "Installasjonen kan ikke fortsette fordi forekomst-hash ikke ble funnet.%0", "Microsoft.Windows.100.X20-29644_8wekyb3d8bbwe", "Error setting compression", "r att slutf", ":&;W;q;", "288c10d3-db69-97fd-22d6-d1f83eb7f47f", "FNPG6-GVG6G-8HWJQ-8FR3C-3YJG9", "Eine unerwartete Version von Bin", "DataMigration: Initializing Eula: [%s]", "Finalize", "=W>o>", "Serveren for installasjonsfremdrift er ikke tilgjengelig.%0", "XGYGN-8DQ7H-HGWFQ-XB7CY-KD726", "DUImageInfoSet", "dvendig oppgave mangler.%0", "Y4?L8M", "Den k", "yoj@j", "my s kompatibilitou s omezen", "embeddedindustryeeval", "already connected", "8j8q8", "connection_refused", "%hs: Error finding window %s; HR = 0x%x", "T9NFD-3RDH8-GF4RT-Q2K6F-KBVYR", ".?AVIMoSetupCompat@@", "WKFQV-KNKRQ-8XR3J-F2MFG-PDFW2", "d5792fee-169a-c3a7-3942-72548e7d278e", ";4;8;<;@;D;H;L;P;T;\\;`;d;h;l;p;t;", "8?8c8", "%CLIENT_KN%", "No se ha podido encontrar una imagen de instalaci", "5H6]6", "en tuntematonta komentoriviargumenttia.%0", "N3FBK-8V7WF-FT4XF-MR3FV-CYT4Y", "st-ZA", "hrbaren", ".?AVCCompatibilityDataProvider@@", "this->m_PositionList.Allocate(LocationHeader->ulItemCount)", "84YR8-NY984-KPXFV-PWDB7-CYT4G", "a3cb8e47-0039-7125-246d-b36842370f7e", "MicrodomImplementation::CDomLayoutCache::GetNodeChildren", "serverdatacentereval", "4NDDF-WMDXJ-C32YC-FJ7JC-76FH6", "Exporting alterations to firmware.", "2DGWC-6VNGF-YM3YR-Q2HQB-RC2KD", "2WH4N-8QGBV-H22JP-CT43Q-MDWWJ", "CompanyName", "#D$ P", "Il processo di installazione non ", "eb48d790-e947-9b8e-c397-0f2e00e2442e", "Microsoft.Windows.126.X21-83280_8wekyb3d8bbwe", "Microsoft.Windows.136.X21-98321_8wekyb3d8bbwe", "DQ9NR-PK7CQ-42CYF-RQ7HM-39QH2", "D$TX5", "N6233-Y6GCR-6RCM3-QFF3Y-8FG64", "lis k", ".?AV?$CZeroInit@VCCompatProgressHandler@@$00@@", "CGNP9-KFP3C-FPBX6-2R4WD-B98WD", "RtlIsLUtf8StringValid(ElementId)", "Nebylo mo", "de-LU", "Microsoft.Windows.100.X20-00915_8wekyb3d8bbwe", "SelectedMigChoice", "Microsoft.Windows.121.X20-00859_8wekyb3d8bbwe", "Y74D9-QN2XB-TPRT8-KK6JR-PPJJF", "3(3K3c384", "Microsoft.Windows.48.X20-39266_8wekyb3d8bbwe", "chargement de la charge utile.%0", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet", "rts.%0", "!>%>)>->1>5>9>=>A>E>I>M>Q>U>Y>]>a>e>i>m>q>u>y>}>", "=\">R>j>", "Failed to allocate string", ";+;@;", ":@;k;", "RtlAppendUcsCharacterToLUtf8String", "DUImage: Error on Latent Acquisition Payload: [0x%X]", "YHG84-GCN2Y-38QPD-87PWJ-XW3DQ", "PT98N-K47YD-4MHH4-23BWV-3J3GP", "si jelent", "Microsoft Corporation1-0+", "FinalizeActionTimeEnd", "No more than one flag set check failed: __e", "NRG8B-VKK3Q-CXVCJ-9G2XF-6Q84J", "ba-RU", "o em disco para instala", "DiskSpaceInstallReq: Initializing Wim Ref Count [%ld]", "4X4_4", "CDlpActionCompat::SerializeGatedScan", "82a5fc3e-2249-28fe-7ed1-c18f50811993", "o mais atualizada ser", "El sistema no supera el an", "A failure script failed to execute or returned an error.%0", "$Progs", "Microsoft.Windows.126.X21-83272_8wekyb3d8bbwe", "CDlpActionSummaryFactory::CreateInstanceRoutine", "Uyumluluk raporu eksik bir sistem bile", "Proces instalace byl pozastaven.%0", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "enterprisesubscriptionn", "Microsoft.Windows.98.X20-24581_8wekyb3d8bbwe", "sente pas l'espace disque requis pour le t", "796a6096-0c1c-0168-a02c-7dd2a70f6ed1", "VH6KN-F9GXT-4B4DF-WG67G-6F62B", "ynnistettiin k", "Microsoft.Windows.101.X19-99547_8wekyb3d8bbwe", "Microsoft.Windows.101.X20-20961_8wekyb3d8bbwe", "Asennusprosessi k", "DUImage: Skipping Dynamic Update due to timeout getting driver updates.", "313<3h3s3", " nespr", "CheckHotPluggableDrive: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X", "Microsoft.Windows.99.res-v3266_8wekyb3d8bbwe", "o para instalar o sistema operacional.%0", "Esecuzione dell'eseguibile GatherOsState non riuscita.%0", "5@5G5Y5`5", ";`7>K>c>", "4*4a4", "9e9x9", "CDlpActionDU::SerializeDUSetup", "SLC.dll", "Microsoft.Windows.101.X20-36703_8wekyb3d8bbwe", "Microsoft.Windows.48.X19-99479_8wekyb3d8bbwe", "3XWDQ-83NTJ-PB2RK-QVQ7B-MY49G", "Failed to get aliased identifier. Status: %x", "KVKHN-XQMH9-6JR6T-JJ36Q-4F8JY", "RestoreMountStub: setting reparse point data failed", "Microsoft.Windows.4.X19-99689_8wekyb3d8bbwe", "708W8i8K9B:", "Le syst", "mogatott.%0", "Microsoft.Windows.8.X21-83691_8wekyb3d8bbwe", " ACCESSDENIED v po", "WIM\\IMAGE[*]\\FILECOUNT", "vel criar ou eliminar a mensagem de bloqueio de desativa", "ZwOpenProcess", "4abe0f39-ce49-8c95-aa54-9af530556a77", "Microsoft.Windows.27.X19-98757_8wekyb3d8bbwe", "X4NPR-H8B8C-WVP34-CFY48-J8HB6", "t';CTt\"3", "enterprisee", "Os problemas de compatibilidade restrita n", "ce46cf2e-730c-6acc-1da3-37dd442bae9e", "Microsoft.Windows.188.X21-99387_8wekyb3d8bbwe", "CDlpActionFactoryImpl >,class CDlpActionImageDeployFactory,class CDlpActionImageDeploy>::SetActionId", "*0M0S0z0N1g1{1", "NtQueryBootEntryOrder", "GetVersionExW", "8W9o9", "ca57f183-c1d0-2142-8006-c8928824e439", "rz9|$ |t", "OnDemandLateAcquisition", "E_INVALIDARG", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributes", "Recovery: Initializing Wim Path: [%s]", "ec209de6-c5a3-3622-eba9-e898d9bd868c", "ggesztve.%0", "698eca6a-ad28-4643-c263-26db61780eb9", "CDlpActionDataMigrate::SetSModeRegKey", "o foi executado com um argumento de linha de comandos desconhecido.%0", "TaskName", "o em disco para transferir e descompactar suportes de dados.%0", "Microsoft.Windows.8.X21-83689_8wekyb3d8bbwe", "5I5T5", "['`kb", " nieprawid", "FACILITY_CLUSTER_ERROR_CODE", "8G8Q8", "Compatibility: GenerateInstallReqCompatReports enter", "Not-null check failed: Document", "0#1J1", "ar-JO", "%PRO_K%", " aktualizace nepro", "Microsoft.Windows.4.X19-99673_8wekyb3d8bbwe", "Microsoft.Windows.125.X21-83247_8wekyb3d8bbwe", "nda kar", " avbryte fordi enheten ikke har nok diskplass for installasjon.%0", "SQMOptIn", "4 5*5U5_5", "De time-outlimiet voor een script is overschreden.%0", "WdsLogStructuredException", "QueryPerformanceCounter", "rbare installasjonsfilen.%0", "Proces instalacji wymaga, aby u", "~j\\XPW", "$Microsoft Ireland Operations Limited1", "veletet ", "nk.%0", "Microsoft.Windows.27.X19-98750_8wekyb3d8bbwe", "ug-CN", "Ingen pakker som skal lastes ned.%0", "ndirme disk alan", "Microsoft.Windows.172.X21-24744_8wekyb3d8bbwe", "FlightData", "DataMigration: ActionList.xml does not exist under given path, skipping migration.", "Features", " tietojen asentamisen levytilavaatimuksia.%0", "serversbspremiumcore", "Microsoft.Windows.7.X21-83728_8wekyb3d8bbwe", "n para mantener activa la opci", "Microsoft.Windows.49.X20-00862_8wekyb3d8bbwe", "SetupCore: Registered PKEY_VALIDATE action", "GetLocalTime", "CDlpActionDiskPartition::GetDriveLetterFromAutomation", "Microsoft.Windows.98.X20-29582_8wekyb3d8bbwe", "130d221e-7fe1-651f-5f90-7732d98e8caf", "PsfTargetName", "SP_UPLOAD_ASIMOV", "20201008074304.973Z0", "sd-Deva-IN", "MMKYK-QNQFH-KJF3V-J4HTF-BY49Y", "6cd908b3-98dd-6eee-1b66-d8ca18e27567", "Microsoft.Windows.121.X19-98672_8wekyb3d8bbwe", "cdade081-9ca8-0047-b2bd-af947e336cbc", "Microsoft.Windows.99.X19-99575_8wekyb3d8bbwe", "pt-BR", "BASE_K", "Microsoft.Windows.98.X19-99431_8wekyb3d8bbwe", "3:3i3|3", "ModuleCollection", """, "ds inte.%0", "?:\\WINDOWS", "71155f88-b268-868a-12aa-c8812f905a5d", "toupper", "a2bc938f-732d-3e46-a7c0-b4b6e9a2f694", "INT_OVERFLOW", "0a211e3c-4f27-fd2f-7867-9dd56d1e5ff0", "0bd4c858-4ff6-75ea-2bd0-f90186499f27", "Not-null check failed: Value", "ReserveManager.dll", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionImageDeployFactory@@VCDlpActionImageDeploy@@@@", "ne-IN", "r Windows ", "Microsoft.Windows.172.res-v3859_8wekyb3d8bbwe", "Microsoft.Windows.98.X20-29575_8wekyb3d8bbwe", "CreateEventW", "8e0997f2-d7cb-d109-d02b-df5dbd8affe7", "de-DE", "ID testovac", "DriverInstallPath", "QQVWhLH", "233T3c3p3", "WIM %s, offset %.8x%.8x, length %x", "Microsoft.Windows.4.X19-99679_8wekyb3d8bbwe", "3cd959bf-4b07-9b5b-f3d9-43da28f1a94a", "Installationsprocessen bruges i et testmilj", "Failed to populate Plan from {0}", "embeddedeval", "Der Installationsprozess wurde mit einem unbekannten Befehlszeilenargument gestartet.%0", "es-419", "4$4D4L4T4\\4h4", ".?AV?$CZeroInit@VCDlpActionMediaCreationSuccess@@$00@@", "sa-IN", "3PJXD-QNDX8-C2X37-TWX3C-JB6PW", ", Microsoft Yaz", "027589f5-8532-6d05-5fea-09975eea486a", "FNPJB-C6Y6X-GXQWM-79GJJ-XW3HB", "Clean_FailForward", "8$9,9T9\\9", "ProductKey: Initializing Media Path: [%s]", "CXmlCursor::Next", "DiskSpaceInstallReq: Initializing Image Index: [%d]", "4F973-NKYKY-X6MBQ-3X93P-FX9FX", "cfb52acc-0316-006c-5759-4c7ce50c6d4b", "NYM7J-CRRVT-D232T-748BW-HMHY7", "DUImage: Enumerating build offer", "protocol not supported", "NtWaitForSingleObject", "::;A;T;", "65ff92ea-03a2-b2b6-b2f3-03b426dc324c", "RestoreFileInfo", "61d61405-688d-516f-1136-3ce845b485a7", "echna pr", "_snwscanf_s", "???E?g?m?", "3PBTQ-9N4MQ-K6KVC-G28GJ-9TQM6", "531bdf5a-e3d6-4229-1833-55f29bd2b1f9", "5f14f159-95f7-5b9a-b565-b880ae7aa201", "CriticalCount", "Compatibility: Device-Actionable Block found.", "iotos", "serverforsbsolutions", "AuthUsesFlags", "NJJX7-2FV3V-7W6D3-J3764-W8F9D", ":(:M:T:Y:", "be2c7002-5af5-fea2-524d-5e99667f6391", "2f071021-0adc-659c-3490-5ee065717dc0", "QQQjd", "MoSetupPlatform: Release Identifier -> [%s]", "CDlpActionCompat::GetResultsInstallReq", "ACCESSDENIED error encountered in initial stages of Setup - Retry possible.%0", "ccd20ad9-38bf-2209-417f-79f171a0bade", "CDlpActionDU::SuspendRoutine", "bca76167-cf70-f7e3-55dc-b172992debe0", "Microsoft.Windows.161.X21-43622_8wekyb3d8bbwe", "ERROR_ACCESS_DENIED", "7KWY4-2NQW6-CQ6M2-2RQ9X-9HJVT", "0-Nk0", "Activation: OS is Threshold Plus. Assuming no issues.", "winbrand.dll", "NR4R9-WF6TQ-4TVB6-3YMX7-XD73C", "starter", "CDlpActionFactoryImpl >,class CDlpActionRecoveryFactory,class CDlpActionRecovery>::CreateAction", "RtlUnregisterFeatureConfigurationChangeNotification", "rd fr", "rio reiniciar o sistema.%0", "CompatInstallReq: Initializing Media Path: [%s]", "97u\"3", "The user has not accepted Advertisement within the required time limit.%0", "= =<=B=", "=?>_>", "o existem pacotes para ser transferidos.%0", "OnDemand", "Microsoft.Windows.48.X20-29664_8wekyb3d8bbwe", "Not-null check failed: pWriter", "CBasicNodeType::ForceNameSetting", "755d8f5a-8c4f-c827-d0bf-688887ac06e5", "DeleteFileW", "3@3p3", "on inattendue.%0", "7;7B7d7k7", "PostUpgradeDiskSpacePercentage", "CheckDiskSpace: External drive is not available", "<5=v=", "527079ee-10ca-8f4a-608d-224c476b04ac", "GetSupportedDriveLetters: Fixed drive found [%s]", "Microsoft.Windows.162.res-v3921_8wekyb3d8bbwe", "Microsoft.Windows.50.X18-81305_8wekyb3d8bbwe", "AppScanResult", "DebugBusParams", "20d045e6-00a9-23be-78ae-03b87ae9c143", "Duplicate install feature. Group: {0}, FMID: {1} , Feature: {2} or out of memory.", "GetTraceEnableFlags", "8a2f8653-bd04-f1f8-21c1-ba9cb3cd25f6", "CDlpActionFactoryImpl >,class CDlpActionAdvertiseFactory,class CDlpActionAdvertise>::GetActionId", "JNMYF-GG4M9-X9BFY-87FT8-TQ7YD", "sti syst", "Serwer post", "rd hittades.%0", "6!6F6Q6l6", "Microsoft.Windows.145.X21-83756_8wekyb3d8bbwe", "GJTYN-HDMQY-FRR76-HVGC7-QPF8P", ";!<7<", "RtlXmlInitializeTokenization(&TokenizerState, &TokenizerInit)", "CDlpActionFactoryImpl >,class CDlpActionDiskPartitionFactory,class CDlpActionDiskPartition>::SetActionId", "18dd1c9c-dfb2-d64f-84b1-38ac8c224ceb", "pStringPool->Signature == ('pSdM')", ".?AVCDlpActionDU@@", "Microsoft.Windows.101.X20-35488_8wekyb3d8bbwe", "lasza helytelen form", " serveru m", "CDlpActionFactoryImpl >,class CDlpActionUpdateMediaFactory,class CDlpActionUpdateMedia>::GetActionId", "95c1e1de-c21b-cb6e-6167-ef626e48821c", "Microsoft.Windows.164.X21-06156_8wekyb3d8bbwe", "onecore\\base\\Cbs\\Util\\inc\\CbsArray.h", "Microsoft.Windows.99.X18-52141_8wekyb3d8bbwe", "adavky pro obnoven", "889e1e01-dc4c-a152-629f-bbb47ffea84a", "4?5^5i5q6", "Microsoft.Windows.125.X21-83236_8wekyb3d8bbwe", "f2631487-ecfd-dea5-3a8c-7250cf82f792", "Microsoft.Windows.4.X19-99694_8wekyb3d8bbwe", "7 7(70787@7H7P7T7X7\\7`7d7h7l7p7t7x7|7", "ilo se naj", "_wcslwr", "DataMigration: Queue Eula Accepted into Target OS...", "LdrGetDllHandle", "%hs: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0", "ndan, kullan", "MN6BV-H3XRF-89T3G-3Q7QB-2PQGT", "HRP6Q-NVBG7-PFYKR-R6JHJ-BWT37", "Microsoft.Windows.188.X21-99377_8wekyb3d8bbwe", "PreFinalize: Initializing Drive letter: [%c]", "Not-null check failed: PseudoKeyOut", "Microsoft.Windows.17.X17-66962_8wekyb3d8bbwe", "5P6V6p6", "Systemet opfylder ikke gated-kompatibilitetsscanningen for at installere opdateringen, og brugeren skal ikke have besked.%0", "Microsoft.Windows.48.X19-98795_8wekyb3d8bbwe", "a05d7b05-aa3a-aef8-231d-ca190ff77335", "JM8PN-694RH-VT977-37X34-84474", "afea7842-d4ab-2fb0-acc8-ed9c40f354df", "la se neo", "Microsoft.Windows.101.X19-98873_8wekyb3d8bbwe", "no such device", "FveEnableAuthenticationW", "InitializeCriticalSection", "3.4u4", "B2C7P-MN9Y4-4F9W4-PFR6X-8QKRG", "Object alias resolves to %s", "Error restoring directory metadata", " nem ", "businessn", "7 7(747T7\\7d7l7t7|7", "QVPCV-NCD6K-KQV3Q-X6RWP-VFR9Q", "Not-null check failed: pDocument", "4756039f-e56b-d2f5-0f5a-3a4a127650a7", "d893c338-f318-eaa3-ebbf-d287f57c5522", "Compatibility: Calling Resolve(WICA_DISMISS_ALL_RESOLVE_STRING)", "TmiMatrix\\VersionRanges", "o aceitou o An", "o foi criado. N", "9p:x:", "Microsoft.Windows.4.X19-98702_8wekyb3d8bbwe", "o para manter a op", ".?AV?$CZeroInit@VCDlpActionRecovery@@$00@@", "8[8~8", "1(141T1`1", ".?AV?$CUnknownImpl@VIFCPayloadCallback@@@@", " sakl", "64b3ac32-0881-b1d9-f2a6-1ac988945082", "873bd014-8929-2e9e-8a8c-fc28003253cb", "1I3^3}3", "Could not find a target drive letter. %0", "8b9w9", "GetSystemDefaultUILanguage", "CDlpActionImpl > > >::Execute", "Array size too big", "4Y4c4", "ProfessionalSingleLanguage", "Microsoft.Windows.101.X19-99532_8wekyb3d8bbwe", ";.<5Y>r>", "DLPLOG: [0x%X] [%s] [%s]", "b2dffd2a-f887-2434-3447-51d78a81b95d", "]._g*", "D$0SV", "959D9{9", "Microsoft.Windows.125.X20-00862_8wekyb3d8bbwe", "XXJN6-VCHX7-99BCX-T2GJ4-VMKV9", "ZwOpenFile", "YY_^]", "BUCL::Rtl::AddInPlaceWithOverflowCheck(&MaximumLength, Sources[i].Length)", ">#>.>?>F>_>x>", "D$@PjZ", "9c7668c4-2f21-2b81-55ff-2e88921b7785", "Asennus keskeytettiin.%0", "2GXNB-H7M3M-M3W32-H77XJ-7FVBY", "D$$PQ", "Microsoft.Windows.164.X21-06161_8wekyb3d8bbwe", "0a8023cc-3d45-1447-54d8-12de7f16c449", "QNG88-GPCPC-V9FF2-MTCC2-MP2JP", "enterprisesneval", "T$0QQV", "DUSetupMUv6", "<&=1=f=q=", "MoSetupPlatform: Resurrecting SetupAutomation object from [%s]...", "Uno script ha superato il limite di timeout.%0", "Microsoft.Windows.172.X21-24721_8wekyb3d8bbwe", "Microsoft.Windows.7.X17-66961_8wekyb3d8bbwe", "Microsoft.Windows.122.X19-98892_8wekyb3d8bbwe", "bbd87642-32a8-e374-33ad-fad51be8f47f", "WN7RF-QBR8G-4PMJR-2DJJF-HQXC3", "NCHYW-W9P2G-RW847-Q4VHV-BDWWD", "Der Installationsvorgang erfordert, dass der Benutzer dem Lizenzvertrag zustimmt.%0", "Microsoft.Windows.50.X21-83778_8wekyb3d8bbwe", ">'?;?P?y?", "27531ae3-4d2e-abc0-4439-831ce2bd9a31", "mesini kabul etmesini gerektirir.%0", "605db963-940a-27f7-a167-c9f1c87a288e", "Microsoft.Windows.27.X19-98754_8wekyb3d8bbwe", "UTF-16", " przerwany w trakcie fazy sprawdzania zgodno", "ERROR_MOD_NOT_FOUND", "D43PH-NJP6R-C4GGV-HCX23-PYVKQ", "::RtlIsLBlobValid(Destination)", "D$$;D$", "0c81628b-ef22-db62-fa8e-ebcf109c912b", "Het installatieproces is uitgesteld.%0", "Offer", "*ppObject = State->m_pAllocator->Allocate()", "cf2ba416-72bb-19ca-c460-201533650bd3", ";;;_;i;x;", "my s kompatibilitou se nevy", "coreconnectedsinglelanguage", "8a9a32f5-fdc2-728e-7d68-58737a286c64", "Server response is malformed.%0", ";0;8;@;P;t;|;", "MinOSVersion", "7d3773ed-642e-2ff8-f8da-7da76805eda4", ";S s!k", "UncompressFile", "Microsoft.Windows.162.X21-03401_8wekyb3d8bbwe", "CDlpActionImpl > > >::GetActionId", "Microsoft.Windows.188.X21-99384_8wekyb3d8bbwe", "94c763b0-3f26-55d1-3867-d35e6b38ace5", "layan bir teklif bulunamad", ":,:J:h:", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "r inte att visa kompatibilitetsrapporten p", "0u1|1", "2.3Z3", "KN368-RBYCH-GW4CW-K8WRV-WK8XT", "LangPackChecked", "GKHN2-DYYPG-J94DP-Y4WK7-M4G6M", "Microsoft.Windows.49.X19-99720_8wekyb3d8bbwe", "TX9XD-98N7V-6WMQ6-BX7FG-H8Q99", "JPHNP-VJ3RW-HX2HT-6X9GB-X4R9J", "9D$$t", "rdien skal konsolideres til telemetriform", "GTHNT-JQHQM-YQVKH-CB6JB-K766G", "Finalize: Clearing update and shutdown key after successful finalize", "0,1c1", "CDlpActionImpl > > >::Restart", "f5722f77-2605-aef7-4e1a-6de522aa7a51", "3f01e834-6a0b-6cb5-a83e-e4c5748b8f69", "w binarnych platformy instalacyjnej. Sprawd", "Pairs.Allocate(m_StringTable.GetEntryCount())", "1'1U1`1", ": :8:<:T:X:\\:`:d:h:p:", ":a;Z<", "Zu-C;", "Microsoft.Windows.4.X19-98720_8wekyb3d8bbwe", " in un formato non valido.%0", "Microsoft.Windows.7.X18-81302_8wekyb3d8bbwe", "Het installatieproces is gestart met een onbekend opdrachtregelargument.%0", "VJNG4-JVRBV-QQ2TM-TX3DX-66RC3", "62ec1525-423c-8a1d-a1fa-1fadb528b50a", "1532aab5-9681-fe23-2697-dd808bbedd78", "B3NJP-H76KG-WGPG2-8WJQY-TXXRJ", "serverazurecor", "_wfopen", "MdSpt", "RtlIsLUtf8StringValid(Source)", "es-AR", "ERROR_SUCCESS_REBOOT_REQUIRED", "R7NPP-B8F2Y-9289P-922Y4-3DB9B", "xJj&Y", "GPFMN-2W48F-YP3FV-WHBTG-683FY", "Microsoft.Windows.101.X19-98868_8wekyb3d8bbwe", "wcsncmp", "Cabinet.dll", "3fc7e515-53f1-af36-81cc-2efb4f90ba1c", "MoSetupPlatform: Calling SetupPlatform::INewSystem::RequestResumeOperations...", "WATSON_DRIVER_PROVIDER", "1cec6511-14e2-6261-7868-07e5297a6f37", "The installation process terminated unexpectedly.%0", "connection refused", "string too long", "404i4s4", "DUImage: OsVersion: [%s]", "66b24907-7304-7adb-9c16-a0cd80d01aa1", "0>1T1y1", "labilir.%0", "NQWWD-8T2J9-K8HCG-9W6YB-TX2GB", "[ybVh", ">D>f>m>", "Compatibility: Hardblock resolved. InstallReq polling ends", "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputDefaultEdition: [0x%X]", " avbryte for lisensavtalen.%0", "MigChoice: No Response found. Continuing with default values.", "Global\\SetupLog", "3b3d09ee-3dc4-0ae0-7651-90ec0d9540dc", "SessionData", "Microsoft.Windows.101.X20-35485_8wekyb3d8bbwe", "CorrelationVector", "ch po", "Diagnostikobjektet skapades inte. Det g", "?A?G?M?S?Y?_?}?", "PackageHash", "SSSjdQ", "Brugeren har valgt at afbryde installationsprogrammet, s", "Not-null check failed: Decoder", "Not-null check failed: fHasChildNodes", "QX6XR-WNWTF-PB4MQ-87R6B-FGFJD", "f5d70ff6-db33-bab3-42e3-4a28ea339595", "me ne satisfait pas ", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;p;t;x;", "Uno script di errore non ", "zh-Hans", "CDlpResponseAutomation::GetResultsRoutineDiskPartition", "originatingBinary", "Det gick inte att hitta installationsavbildningen.%0", "N3P28-TW9C9-69PWP-YQVC3-YBKR4", "DiskSpaceInstallReq: Initializing RollbackOption: [%d]", "ff-Latn-NG", "JGKTN-69CHM-2RG3R-VHHG8-PKFBQ", "a pas pu ", "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x", "7X<`O?]?m?", "ce2818fa-9073-bf6b-8da7-42e4d5833e98", "Microsoft.Windows.101.X19-99528_8wekyb3d8bbwe", "strrchr", "8067f28f-a6db-02ee-3c4d-380e11bc66e4", "NWWGK-3QTDG-D322H-PRD7G-V6DG3", "t$pVQ", "tg-Cyrl-TJ", "2b2970e5-99f2-babb-af2b-06bf80b8b507", "BQ4FN-3794Q-8R8QC-KFYT7-94R8H", "9(9t9", "CDlpActionImpl > > >::GetError", "MoSetupPlatform: Finalize was successful!", " nem fogadta el a licencszerz", "ya al", "Microsoft.Windows.121.X19-98669_8wekyb3d8bbwe", ";V;w;", "QY2N8-QJB87-234JV-KRBRY-HT92P", "n no se resolvieron en el plazo requerido.%0", "Q6736-9NJ23-YKM8K-WHX2P-9QCRP", "NJ3GV-MCQHC-DJMDK-TK8F3-C373M", "VerQueryValueW", "3F3U3", "Sources\\pid.txt", "2(2,2D2T2X2`2d2h2l2p2t2x2|2", "Sag>k", "ru-RU", "LocalFileTimeToFileTime", " reklamy w wymaganym czasie.%0", "ZsZ(p", " podporovan", "304h4", " || SourceName: ", "filename_too_long", "Microsoft.Windows.48.X19-99488_8wekyb3d8bbwe", "26a09250-c5c7-6508-05e2-4fdf32214d2c", "NGMHF-GW28B-76HMB-6JTRX-GJF9Q", "Microsoft.Windows.49.X19-98820_8wekyb3d8bbwe", "1D1O1m1", "lv-LV", "Substitute name string copy failed", "8r ,Y", "Y6NXQ-GY9CW-J96YV-QV98H-94VYX", "Target OS: Error retrieving feature info! [0x%X]", "serverwebcore", "CDlpResponseImpl > > >::GetError", "RemovePackage", "NDHK4-38D89-FJHP7-G338J-D9G9C", "DUImage: Initializing Media UpdateAgent Path: [%s]", "RestoreFileCompression", ";(;4;@;L;X;d;p;|;", "46PN6-R9BK9-CVHKB-HWQ9V-MBJY8", "durangohostos", "rodowisku testowym.%0", "BCryptDestroyHash", "?=?H?i?s?", " k instalaci dostatek m", "CDlpActionDU::CancelRoutine", "Het systeem voldoet niet aan de gated compatibiliteitsscan voor het installeren van de update.%0", "Microsoft.Windows.99.X18-28456_8wekyb3d8bbwe", "1c5489de-1481-d3f6-f0cd-bc868b0b01b1", "041504B0", "MoSetupPlatform: Detecting recovery image option through ReAgent...", "\\\\?\\UNC", "DebuggerOptions: Initializing Debugger Type: [USB]", "Microsoft.Windows.98.X20-24582_8wekyb3d8bbwe", "=$=S=b=o=", "Finalize: Leaving install error [0x%X] as-is for telemetry.", ":>:|:", "PackageMigration: Initializing Critical Count [%ld]", " syst", "SLClose", "DownloadFileSizeX64", "70ed257e-3423-7fe4-3a39-255d640ae114", "serveressentialadditional", "hr-BA", "CompatMigXmlPath", "CMicrodomBuilder::CElementNameToAttributeListTable::Find", "?-?d?", "=<=d=~=", "GetFailedInstallCount:RegGetDword failed. GLE is [%d]", "CDlpActionImpl > > >::Prepare", "iotedgeos", "KM6DK-VN9Q4-FHBK2-PP2VV-8HV2C", "GetSupportedDriveLetters: Drive [%s] has free space [%llu] MB", "es-PR", "NtYieldExecution", "Complete", "SVWjLj", "cc6c141d-29b1-9ced-88c0-e71a78570d97", "GetVolumePathNamesForVolumeNameW", "t{Vh ", "Finalize: Compat instance not found.", "79e630d5-63cd-5414-1043-333df2426fb4", "Uno script di precommit non ", "bf0ead1f-aa88-60bb-59f1-c7d5827a9e51", "Microsoft.Windows.145.X21-83697_8wekyb3d8bbwe", "NPTRB-CFYFD-DGFPG-DY9GJ-CPR8F", "<&=_=", "RollbackOptionFound", "CDlpActionRecovery::SerializeRoutine", "bdf0e134-5ac1-339a-c3e8-ea0bd165a2a0", "D$@t3", "0dce95b2-e77d-c1ed-6328-55a07902a37d", "Invalid parameter passed to C runtime function.", "t_VVVP", "2<2R2k2r2", "< <(<< > > >::GetResults", "Microsoft.Windows.49.X19-98815_8wekyb3d8bbwe", "NPPFM-238TT-HJHKC-R2CCJ-4VV2C", "Ein Fehler ist aufgetreten. Der Ergebniswert muss zu Telemetriezwecken konsolidiert werden.%0", "chr-Cher", "111019184142Z", "The install cannot continue because finalize cannot resume the previously started update.%0", "zverzi", "JNPM6-RQB23-8TGWF-Y6TCT-683PJ", "CDlpActionCompat::SerializeFinalizeReqScan", "f92ffb5f-e273-09a2-c3fa-4d2d0c07ee4a", "CDlpActionPreFinalize::InitializeRoutine", "?(?@?X?p?", "rdet m", "CDlpActionFactoryImpl >,class CDlpActionActivationFactory,class CDlpActionActivation>::SetActionId", "Microsoft.Windows.125.X21-83242_8wekyb3d8bbwe", "Af;H(s", "ERROR_INVALID_HANDLE", "NHBGK-XPJP2-4TKJ6-RRR2V-PWF7T", "4YGRN-GMPC8-GG84C-4BTFR-MWT47", ".rdata", "x'Sh ", "D$pSVW", " > > >::GetResultsRoutine", "NCM4C-9DM2J-GG7YC-XJCRK-BKMWX", "Params->fRequireUtf8", ">9?Q?g?", "=7>^>j>", "CDlpResponseAutomation::GetResultsRoutine", "Failed to set registry data for element %s. Status: %x", "%s.%s.%s.%s", "4F8Q4-47Q6Y-7HKM9-BPYH2-9FJJR", "2L3|3", "onecore\\base\\servicing\\actionlist\\lib\\mergeaction.cpp", "680d697d-c060-2ea2-36b9-2768a4375d51", "Bugcheck driver version", "eca51c98-9f32-a55e-e289-e78118f96d74", "34265225-7db3-d75d-0cfd-f990f68eadbb", "MoSetupPlatform: Finalize reported disk full!", "CDlpActionImpl > > >::SetProgress", "Failed to convert data for element %s. Status: %x", "6NFV3-F2M2P-38MXH-X89X6-CGYP3", "Microsoft.Windows.98.X20-30046_8wekyb3d8bbwe", "eHomeEdition", "SetupCore: Registered INSTALL_GET_WEBSETUP_USER_INPUT action", "Closing store. Flags: 0x%x", "DeleteFileEx: hardlink given to us is: %s", "Module path is [%s]", "555L5a5", "WXW9N-48W7R-VX939-B3XYX-BKMPF", "5bb7bdc4-4673-a846-6829-c7bd4ee187c6", "22CW3-WXNPV-F7DYJ-BGXDF-MWRBJ", ">C>O>n>", "Feature", "F89~;w;F<]<", "[RS1]", "5b078ef5-6680-4b0c-df15-cdf1aacccd19", "M3WYN-36MC4-FP8M4-PC73X-MG9Q7", "Microsoft.Windows.120.X21-83763_8wekyb3d8bbwe", "8\"8(8.848;8B8I8P8W8^8e8m8u8}8", "MoSetupPlatform: Disk space released after install: [%I64u]", "i yap", "4718fb99-0752-0994-5357-5d45f3e287e7", "FD944-NBF4J-4DWHK-QQY3D-CBBJP", "e se nena", "2-242u2", "? ?$?(?,?0?4?8?1>f>q>", ">=>G>n>x>", "515@5M5w5", "?4?X?", "Invalid delimiter: %wc.", "%s\\ControlSet%3.3d\\Control\\Nls\\Language", "ytkownik zaakceptowa", "do foram corrompidos.%0", "0>0D0\\0c0s0", "94b3098d-5e58-8e80-16f8-dcbfbfbcba29", "CDlpActionDiskPartitionFactory::CreateInstanceRoutine", "18d074ab-590f-8161-95cd-c9e886af0407", "Microsoft.Windows.121.X20-35504_8wekyb3d8bbwe", "qsort", "The user has chosen to cancel because the system does not pass the minimum requirements to install the update.%0", "CDlpActionCreateMediaSuccessFactory::CreateInstanceRoutine", "CDlpActionImpl > > >::Prepare", "Microsoft.Windows.7.X17-66960_8wekyb3d8bbwe", "Ett skript ", "lemi ge", "DestinationMaximumLength >= SourceLength", "8#8m8", ">C?I?t?}?", "CHVC6-6NJD7-DF3R7-GV8HM-BBJ4K", "CNG9D-KCYWM-P6B4H-PG3GT-D3XRR", "969A9f9q9", "Too many unexplained failures. File: %s Last status: %x", "Recovery: No matching images found!", "t4f97t", "Microsoft.Windows.172.X21-24713_8wekyb3d8bbwe", "Catalog[*]", "Microsoft.Windows.122.X20-35511_8wekyb3d8bbwe", "Microsoft.Windows.27.X19-98751_8wekyb3d8bbwe", "RtlWriteDataIntoSmartLBlobWritingContext", "3)3P3k3w3", "Microsoft.Windows.100.X20-29649_8wekyb3d8bbwe", "9NFRD-HQQ7R-X3C7M-68B6G-WXCHP", "Suoritettavan GatherOsState-tiedoston suorittaminen ep", "totta a folyamatot, mert a rendszer nem felel meg a friss", "TCNK7-X7QH9-HQ38C-8DDJW-YP4B3", "Compatibility: No UI to notify HardBlock status change", "2QN79-MFHKY-VW4HX-TFD9J-7FR9Q", "7b634362-1456-a552-b9e1-edfe69ee7bb1", "0L0B0", "Microsoft.Windows.49.X20-29600_8wekyb3d8bbwe", "Microsoft.Windows.121.X19-98679_8wekyb3d8bbwe", "CDlpActionPreFinalize::SerializeRoutine", "63FTG-KN7RX-RMYHH-4TGHW-CPQGW", "serverstoragestandardeval", "3H3S3", "Microsoft.Windows.100.X19-99664_8wekyb3d8bbwe", "RtlUnsubscribeWnfNotificationWaitForCompletion", "m ke sta", "nimos para transferir a atualiza", "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength", "Microsoft.Windows.48.X20-32149_8wekyb3d8bbwe", "8K2N2-G2R3X-BBKPT-J8VRJ-DGQFM", "Microsoft.Windows.84.X20-35526_8wekyb3d8bbwe", "Failed load key %ws. Flags: 0x%x File: %s Status: %x", "Microsoft.Windows.125.X21-83241_8wekyb3d8bbwe", "A imagem de instala", "en-NZ", " beti", "Microsoft.Windows.98.X19-99600_8wekyb3d8bbwe", "9D9YT-QNQPJ-RYXJF-XPG9P-3YH26", "memcmp", "AddAccessAllowedAce", "chr-Cher-US", "6Q3NP-P9X4K-C392Y-WY4QM-MY48M", "Translated a DontSync object to ID 0x%x", "6T9CB-NXX3G-8QPH8-M2334-VMJVQ", "Uma opera", "XML parse error: {0} at line {1}, column {2} : {3}", "Yhteensopivuusongelmia ei saatu ratkaistua vaaditussa ajassa.%0", "Sistem, y", "sl-SI", "nkami a u", "Microsoft.Windows.172.res-v3860_8wekyb3d8bbwe", "CompatCtrl.dll", "fr-BE", "XN9GY-C7KVX-P28MW-JF6XH-VT9RM", "bcded0ed-ba50-703a-5cf9-676ccf263522", "y}9O6I6n6y6", "0-1@1o1v1", "9H9x9", "O(u!qHe", " > > >::DeserializeRoutine", "5=6}6", "263ec206-3d7e-dc6e-17f8-1386185e85ed", "CompatFinalizeReq: Initializing Major Version: [%d]", "9s8um", "e17d64d7-77ce-1fce-9a07-8de96aff5f86", "Q2YFK-8FNJ3-WTPRD-7Q4BV-9BT33", "GetEnvironmentVariableW", "Microsoft.Windows.4.X20-29624_8wekyb3d8bbwe", "CPVVD-PNB4C-DFFX2-DJHHD-RJRDD", "inde ", " on peruuttanut asennuksen pit", "n no era v", "93fb20c2-9429-cea7-0c54-a231a31dbf2a", " la publicit", " > > >::GetSerializeOnProgress", "Odpowied", "0/040>0R0Z0a0h0n0", "ivatel odm", "MigChoice: Initializing Drive Letter: [%c]", "CDlpActionImpl > > >::InitializeRoutine", "%s: Registering Setup Platform error: [0x%X]", "8f9c7269-d69c-dfb4-32ea-21b19603f5c5", "; ;$;(;,;0;4;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "llet.%0", "o em disco de download n", "r att installera uppdateringen och anv", "Det gick inte att hitta den k", "EsdFlightData", "Microsoft.Windows.49.X19-99516_8wekyb3d8bbwe", "4\"4O4e4", "en-ID", "a2c5d2ec-c50c-4e25-d080-f77f61330f74", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIFCDiagnostics@@@@@@", "::BUCL::Rtl::Add( cElements, 10, NewCapacity)", "serverenterpriseia64", "CloseThreadpoolTimer", "", "STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION", "na wykona", "too many files open", "3_^[]", "EnterpriseSN", "tij:V", "PreFinalize: Automation information not found.", "855225a0-c332-718d-9af7-ff462aaeab19", "LocalAlloc", "5f76868c-e00b-e577-2f6b-dac1f95c8fbc", "s nem folytathat", "mle kar", "Microsoft.Windows.4.X19-99671_8wekyb3d8bbwe", "sma-SE", "1\"2S2}2", "le fasen van de installatie. Opnieuw proberen is mogelijk.%0", "Problemy z zamkni", "5o5-6165696=6A6E6I6M6Q6U6Y6]6a6", "202Q2a2h2", "OLEAUT32.dll", "Microsoft.Windows.172.X21-24714_8wekyb3d8bbwe", "Microsoft.Windows.99.X19-99658_8wekyb3d8bbwe", " malformada.%0", "DataMigration: Initializing SkipOobe: [%s]", "interrupted", "8<9j9n:", "9\\$0t]", "DataMigration: Initializing Privacy Option: [%d]", "Microsoft.Windows.165.X21-11810_8wekyb3d8bbwe", "Microsoft.Windows.98.X20-29572_8wekyb3d8bbwe", "39JC3-TN66J-TQ3GM-94PG4-DJ3PK", "CDlpActionImpl > > >::Cancel", "DataMigration: Request for file has been queued", "CDlpResponseImpl > > >::CheckUserInterrupt", "Microsoft.Windows.188.X21-99371_8wekyb3d8bbwe", "DUImage: SetupPlatform instance created.", "Microsoft.Windows.7.X21-83401_8wekyb3d8bbwe", "DVBWF-NFKRB-H98XB-JD8YT-XQBMK", "4*5/545>5C5H5R5W5\\5c5h5m5t5y5~5", "CDlpActionImpl > > >::SerializeRoutine", "6l6S7Z7", "DataMigration: Queue telemetry product name into Target OS...", "93456da6-f76d-063b-5b08-bc3ba724baa6", "dc7e7c4e-9e2f-3d56-298f-37ab6c581d6e", "CDlpResponseAutomation::GetResultsRoutineInstallNowOrLater", "? %s] %s", "=)=`=", "51aaa2dc-08b2-9930-a686-b85d38745b80", "898C8X8a8k8", "DUSetup: No Response found. Continuing with default values.", "Duplicate media item: {0}, or out of memory.", "373k3}3", "CSetupCore::Register", "12ebcc0d-a2a5-5669-4c41-cdb90a65c49f", "96b51e4c-3966-e2db-c299-1ed58a0dc2e9", "Failed to set directory extended attribute", "Microsoft.Windows.27.X20-35463_8wekyb3d8bbwe", "6bb0b6ec-e409-a187-679d-e50e4f073450", "GatherOsState", "BNG2Q-VKJ4R-8PX28-C772P-Q3XDB", "Recovery: Found match!", "NCQMH-7JRF3-32PVY-R92K6-9K2J2", "iotuap", " cancelar el proceso porque el sistema no supera el an", "; ;L;W;", ">.?9?e?p?", "P8MVM-NFQMH-HM7QM-KQXY9-QV64J", "professionalstudentn", "A instala", "Microsoft.Windows.98.X20-39255_8wekyb3d8bbwe", "WIM\\TOTALBYTES", "6a47453b-afaa-78c4-6035-9c869a45eb13", "RestoreDirMetadata: RestoreFileStorageTierClass failed", "QQH2N-2KTDV-44K2Y-XBXQ6-WXFBH", "sv-FI", " /LaunchSetupWithConfig %s", "Microsoft.Windows.146.X21-83754_8wekyb3d8bbwe", "CDlpActionDiskSpaceReq::CalculatePostUpgradeFreeSpace", "7<8C8a8j8u8|8", "%s: Leaving Execute Method", "RecordFileDataLocation", "protocol error", "WimParseHexString", "KBJNW-C3PCT-9D7MX-R949M-RC38T", "CDlpActionImageDeploy::SerializeRoutine", "?#???S?", "jlja ", "The system does not pass the gated compat scan to install the update.%0", "9BWN3-937V7-KXK8H-FB78C-JB7YF", "1$1,141<1D1L1T1\\1d1l1t1|1", "2!2O2e2", "=@=`=f=l=r=", "CheckDiskSpace: Not even minimum free disk space on system drive", "ProductKey: Product EditionID = %s", "d7135ec5-9f45-835e-d387-20c2834e011e", "Il file di configurazione del programma di installazione ", "IDREFS", "ku.%0", ">%>l>s>", "connectedcar", "GetSystemDefaultLocaleName", "DUImage: Invoking download on Payload ImageDU", "Microsoft.Windows.145.X21-83690_8wekyb3d8bbwe", "837d4fec-16ed-8c0c-8058-9ff9e3b3b698", "UpdateMedia: Error reporting telemetry for PerformMediaUpdate: [0x%X]", ".?AVout_of_range@std@@", "lida.%0", "iu-Cans", "ERROR_DISK_FULL", "Microsoft.Windows.7.X21-83405_8wekyb3d8bbwe", ".gfids", "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", "5*5M5W5j5", "Microsoft.Windows.161.X21-43638_8wekyb3d8bbwe", "sr-Cyrl-ME", "sr-SP-Cyrl", "taient endommag", "?)?O?Z?", ">>>S>c>", ".rsrc$02", " la configuration minimale requise pour installer la mise ", "RtlDllShutdownInProgress", "memcpy_s", ">!>=>I>", "DeleteFileEx: Unable to allocate hardlink path buffer", "%I64u", "79180463-a512-bd3d-39fc-67c22e86fd96", "Failed to query process info. Status: %x", "GetTempFileNameW", "en-JM", ">(?3?N?o?", "FinalizeReqScan: MigXml path: [%s]", "professionaleducationn", "A felhaszn", "CDlpActionFactoryImpl >,class CDlpActionPackageMigrateFactory,class CDlpActionPackageMigrate>::SetActionId", "Een opruimbewerking van een vorige installatiepoging is nog in behandeling. Het systeem moet opnieuw worden opgestart.%0", "6XTN2-V4VBD-F6TCV-G6KKH-462M6", "3&3;3", "n inesperada del cliente del agente de actualizaci", "MoSetupPlatform: Getting current disk space requirements...", "en-BZ", "Microsoft.Windows.7.X21-83747_8wekyb3d8bbwe", "Compatibility: Deleting RegKey for Driver Reflect", "ERROR_FILE_NOT_FOUND", "Microsoft.Windows.100.X20-00909_8wekyb3d8bbwe", "Os problemas de compatibilidade para download n", "MoSetupPlatform: Checking for system accent color...", "Microsoft.Windows.98.res-v3271_8wekyb3d8bbwe", "NMTOKEN", "Microsoft.Windows.7.X21-83407_8wekyb3d8bbwe", "2 2+292D2Q2_2j2", "serverenterprisecore", " naprawczych.%0", "6f9c97d0-153b-ff3d-6672-6010286b5e4e", "Saved app scan result at : %s", "connection reset", "Microsoft.Windows.126.X21-83266_8wekyb3d8bbwe", "ZwFilterBootOption", "relseshandling.%0", "PreFinalize: Initializing PostOobe Arguments: [%s]", "pChild->pBasicNode != 0", "Microsoft.Windows.100.X19-99440_8wekyb3d8bbwe", "ea4459ba-f950-720b-0c0b-baade12157b3", "_amsg_exit", "afficher le rapport de compatibilit", "ivityksen lataamisen v", "n no puede continuar porque no se encontr", "CDlpActionDU::DeserializeRoutine", "6d959b02-22bd-589d-b25b-2e374876d0fb", "Compatibility: Error Deleting RegKey for Driver Reflect: [0x%X]", "MX7CG-3NV7R-979CY-RBWM6-J2QPK", "ndaren m", "JVNYV-6YRVM-GQ2FX-JFPF8-BWRB9", "Przekroczono limit czasu skryptu.%0", "nda beklenmeyen bir s", "Microsoft.Windows.125.X21-83240_8wekyb3d8bbwe", "7HNRX-D7KGG-3K4RQ-4WPJ4-YTDFH", "=\"=)=", "NCTH2-M3KRD-QRQMK-6XMXX-CDKTY", "3QJ27-8N2GD-P9HGM-7TYKV-G6PJK", "g muligt.%0", "54e33830-28bc-5f20-ab10-9880a4e62163", "professionalstudent", "$SVh4", "]_cOW", "Microsoft.Windows.49.X20-35548_8wekyb3d8bbwe", "st, hogy az Elt", "ad05061b-3f24-61df-4813-f7131900b28e", "jHXPj", "DebuggerOptions: Enabling USB debugging -> [%s]...", "zca tarama i", "Microsoft", "Microsoft.Windows.98.X19-98884_8wekyb3d8bbwe", "N6978-P8C8P-7J8R6-JT96R-2KCKT", "56f6e12a-971b-2300-a8b9-9fe46b6b8b71", "FailFast", ">1>8>h>o>", "Boot entry exists for DontSync with ID 0x%x", "BFM6D-TKNBY-X6RGR-PHJ4G-723B6", "Microsoft.Windows.101.X20-29632_8wekyb3d8bbwe", "9t$ t", "4j$j@", "UnhandledExceptionFilter", "JWFPN-GFH6H-6D3HH-DGDTP-W2R46", "__dllonexit", "f2ad4d9b-b0b2-8a40-5817-a9862ecd083e", "Encontrada opera", "The install cannot continue because a finalize operation was already requested.%0", "3f836b7c-cbcc-97ab-1e6e-31a05c479214", "Microsoft.Windows.184.X21-83662_8wekyb3d8bbwe", "FinalizeReqScan: No MigXml present", "professionalwmc", "totta a m", "2fe638c2-b88f-914c-012e-7b6840808164", "Microsoft.Windows.122.X20-35463_8wekyb3d8bbwe", "TVQN9-H4VQW-YPYVH-PTTBX-4JRDM", "2%383I3r3", "DiskSpaceInstallReq: Initializing GDR paths [%ld] [%s]", "WIM_Verbose_Logging", " > > >::Suspend", "BT79Q-G7N6G-PGBYW-4YWX6-6F4BT", "7N7Y7`7", "6?nIF0", "2 3&3a3", "r det h", "27704654-1e0e-ea9c-2ab0-b4354f3741f6", "CDlpActionImpl > > >::GetWorkingPath", "Microsoft.Windows.7.X21-83406_8wekyb3d8bbwe", "rio optou por cancelar o contrato de licen", ">M>i>p>w>", "DataMigration: Queue Request for setupcomplete.cmd file migration", "invalid string position", "CDlpActionSummary::ExecuteRoutine", "KRNTD-QJ66K-W9GTD-TMY9G-TJF7T", "c1678a13-6aaa-fd2d-2c16-2011dd29ec0b", "k dosyalar", " Erneuter Versuch m", "s kicsomagol", "CDlpActionProductKeyValidate::SearchForKeyInHostOS", "nimos para instalar la actualizaci", "Microsoft.Windows.49.X18-15572_8wekyb3d8bbwe", "2b290825-39de-ac50-b636-a20201dbd25a", "embeddedindustryeval", " ACCESSDENIED. ", "115be1b1-8ff2-c2f5-62ee-e625f6a99418", "QJFNK-JWT88-68VJ7-HFXFB-VQYMV", ".giats", "A,;F8u", "C2FCN-9YQPG-QJP3R-MF4XT-8TYMG", "8e751b31-28e8-e0f2-c57c-745b9409eaa5", "De gebruiker heeft ervoor gekozen om te annuleren, omdat het systeem niet voldoet aan de minimum vereisten voor de gewenste migratieoptie.%0", "SYSTEM\\Setup\\MoSetup\\Volatile", "Microsoft.Windows.171.X21-24722_8wekyb3d8bbwe", "9HGRW-NH2CQ-XQHJD-YCRWB-6VJV7", "w|PPP", "BUCL::Rtl::AddInPlaceWithOverflowCheck(&cbRequired, (*EncodingSizer)(ucsch))", "inden, Kullan", "393V3", "041104B0", "GetAclInfo failed", "+T$\\+", "Microsoft.Windows.49.X20-29597_8wekyb3d8bbwe", "2!3,3X3c3", "ProductKey: SelectImageIndex: Selecting image index from response.", "KCT8Y-N444Q-XTCGD-X99CG-GMWR2", "NWGHQ-MWB7V-RWBVX-GRWK7-DRR8D", "nimos para baixar a atualiza", "505e48aa-dc22-1f91-7a95-1175d361c354", "Microsoft.Windows.7.X21-83733_8wekyb3d8bbwe", " hizmeti verilemiyor.%0", "0n0AS", "e7a6f16c-3735-133a-4a12-c2687e6df401", "1\"1&11171B1S1b1n1", "CDlpActionUpdateMedia::EvaluateApplicability", "Der opstod en fejl, og resultatv", "0~0_0o0", "ijal licen", " terminato in modo imprevisto.%0", "2495552f-9757-2150-2df2-2e4900e5f25c", "dzeniu nie ma wystarczaj", "Kan ikke opprette eller ", "040704B0", "inde tamamlanmad", "RollbackOption", "UpdateMedia: Initializing DUOptIn: [%s]", "Microsoft.Windows.125.X21-83254_8wekyb3d8bbwe", "9PWPK-NWF68-K33W2-MVD4B-F877B", "NQXXQ-DXW8K-B2GTB-KJ4QM-R63GV", "6d8b2ce5-0f14-8668-97a1-228b599fa680", ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatAction@@@@@@@@@@", "cross device link", "8 9z:", "Microsoft.Windows.101.X19-98662_8wekyb3d8bbwe", "5;5d5", "Q6VNQ-TCM4W-CCVWY-B4QKX-6CQGY", "#rSPo", "ProductKey: Initializing Min OS Version: [%ld]", "f87b227f-c33f-4a8c-5ed6-d01b8a234463", "ServerImage", "CDlpActionImpl > > >::InitializeRoutine", "FindNextFileW", "9'909?9L9", "ffbd79ab-8bc0-26b4-2984-47c501d053af", "MoSetupPlatform: The recovery image option is invalid.", "d3d7c9ad-2c5d-4fd7-f628-718e4048b705", "Microsoft.Windows.99.X20-23527_8wekyb3d8bbwe", "Tapahtui virhe, mink", "5b3ca306-9e7c-5274-bcff-80a94289fcbc", "FQGNV-X2XKP-T94YQ-GBFCT-237Y9", "o pode retomar a atualiza", "4 4$4(4,4044484<4@4D4H4L4P4T4h4l4p4t4x4|4", "3NQ62-T2KDP-GBGWJ-VC3B7-WK8V2", "4 5'5;5B5", "zh-SG", "Eula: Getting EULA for language: [%s]", "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x", "en-IN", "82DMY-NGKV6-YYJ98-8HPY2-XTPHM", "Microsoft.Windows.49.X20-29589_8wekyb3d8bbwe", "CDlpActionImpl > > >::Cancel", "=+=L=b=i=s=", "eef23cc5-d8a7-9bbf-4bfc-81bfa5ea93ad", "3&3R3]3", "HKLM\\SYSTEM\\Setup\\MoSetup", "ReAgent.dll", "8826fbb6-d0de-7305-dac6-4687bc8261db", "kleme ilerleme sunucusu kullan", "ProductKey: Matching Install Wim: Target Image Index: %d TargetImage EditionID: %s", "78e6bbeb-f984-9527-3c53-bd04dc406961", "bd3f490e-3a8d-c4f9-dbfd-47f689d0ee45", "ScanResult", "DataOnly", "Activation: Machine is NOT active.", "Microsoft.Windows.7.X18-81289_8wekyb3d8bbwe", "; ;0;@;l;t;", "Eula: Using Online Store version = [%s].", "fy-NL", "9eec1eec-cbf5-b60d-9b00-bb9a329df633", "ProductKey: Looking for EICfg file.", "CBasicNodeType::ChangeNamespace", "D$,_^[3", "202<2\\2d2p2", "Failed to shred keyform: {0}", "ERROR_PATH_NOT_FOUND", "L$hQS", "33efd4ae-70da-81c1-2e5a-e478d653f264", "YNRRQ-2TPDJ-W7HCP-3PMTX-YDWWM", " vazia.%0", " los t", "om-ET", "CDlpActionProductKeyValidate::GetResultsRoutinePkeyGetEdition", "::RtlIsLUnicodeStringValid(String)", "Microsoft.Windows.50.X21-83771_8wekyb3d8bbwe", "randeprocessen inte kan ", "40>0H0R0f0", "CompatFinalizeReq: Initializing Edition ID: [%s]", ".?AVCSetupFCDiagnostics@@", "CompactOs", "Failed to open file attributes. Status: %x", "3I3^3", "Microsoft.Windows.99.X20-35491_8wekyb3d8bbwe", "9-:8:i:t:", "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8", "81888K8", "Rg0W0_0", "Microsoft.Windows.48.X19-99496_8wekyb3d8bbwe", "pkeyconfig.xrm-ms", "=(=4=@=L=X=d=p=|=", "QQSV3", "4.4\\4", "CDlpResponseImpl > > >::Cancel", "97c90407-8ddf-203c-f97c-f789c691cb46", "taj=R", "c1903514-3149-ceff-5856-ad6f5c6ed253", "Microsoft.Windows.7.X18-87815_8wekyb3d8bbwe", "rulay", "FACILITY_NDIS_ERROR_CODE", "5<5C5", "9-:p:w:", "Microsoft.Windows.4.X19-99675_8wekyb3d8bbwe", ";!<2AllocateStreamObject()", "0&040M0j0", "0b583451-441f-0325-c1e1-6e6ae2dfcf8c", "WATSON_DRIVER_VERSION", "KQP6C-NH3KF-D3XCW-H9JMP-27JXQ", "E(SVW", "JKDN6-VP37T-G7W39-PG788-Q69TQ", "4,4J4_4", "ProcessSecurityData", "de-LI", "Microsoft.Windows.101.X20-35484_8wekyb3d8bbwe", "1#1=1B1I1P1W1^1e1l1s1z1", "lb-LU", "%PRO_N%", "Microsoft.Windows.98.X20-29578_8wekyb3d8bbwe", "6 6'666=6L6S6", "RtlIsLBlobValid(Source)", "CDlpActionImpl > > >::Cancel", "XN829-2DTD4-RRV3C-GVGJ4-VMJGQ", "The installation process is being used in a test environment.%0", ".?AVCDlpActionDiskPartitionFactory@@", "0o0\\O", "VX38R-JFNW9-PJY8H-X9H9M-2PQDQ", "A telep", "Microsoft.Windows.99.X20-25153_8wekyb3d8bbwe", "0=0G0t0~0", "A resposta do servidor est", "9T9[9p9", "PerformMediaUpdate", "Nepoda", "XVMNF-PH2KF-HXQ3B-RGMDV-DRR9Y", "5!656>6E6", "tX9~.>L>", "inappropriate io control operation", "Setup360Extended", ">(>/>]>s>z>", "a863dec6-3d20-1a9a-8081-3f7046f8813c", "PreFinalize: Queue Request for driver migration", "D9YBH-FYJ7G-4GB6T-B7DK4-FWWJ7", "RestoreDirMetadata: RestoreFileInfo failed", "WIM_Enumerate_Directory_Reparse_Point", "VXW7P-QKN37-XTGGH-4DRTM-43KQ6", "<&.>O>", "Microsoft.Windows.175.X21-41297_8wekyb3d8bbwe", "818;8h8r8", "DUImage: Initializing DU Sandbox Path: [%s]", "tta eftersom en ", "Odpov", "99:S:b;};", ":1:6:>:", "151Y1w1(2B2Q2e2", "DUImage: Initializing DU Channels: [0x%X]", "Target OS: Detected Source DomainJoined = [%s]", "RestoreMountStub", "Microsoft.Windows.99.res-v3265_8wekyb3d8bbwe", "CDlpActionImpl > > >::GetSerializeOnProgress", "towupper", "dda860a3-3a9d-6c28-f5c9-cc7c982ee22b", "W269N-WFGWX-YVC9B-4J6C9-T83GX", "Microsoft.Windows.98.X19-99579_8wekyb3d8bbwe", "UnregisterTraceGuids", "0ec42cc5-2b09-a734-1bb9-ff00e4a52d46", "1.2]2", "11181G1e1", "NWFGV-2B6FY-RWD28-FM6XR-7H7CK", "707L7", "KERNEL32.dll", "dala po", "GetDriveTypeW", ":8:D:d:p:", "mn-Mong-MN", "Activation: Error reporting telemetry for bActivationBlockFound: [0x%X]", "CDlpActionDebuggerOptionsFactory::CreateInstanceRoutine", "Microsoft.Windows.119.X20-35536_8wekyb3d8bbwe", "%EDU_N%", "t(9\\$", "CDlpActionFinalize::DeserializeRoutine", "MoSetupPlatform: Setup Platform object resurrected!", "t}WhpC", "CDlpActionDiskSpaceReq::InitializeRoutine", "7c838941-1d04-809a-f8d4-1b5cba8b80c3", "El sistema no supera el examen de compatibilidad controlada para instalar la actualizaci", "smj-NO", "\\Windows\\System32\\Config\\FP", "DiskSpaceReq: Drive [%c] has enough free disk space", "L$8;U", "Microsoft.Windows.165.X21-11812_8wekyb3d8bbwe", "=\"=>=M=#>", "MoveCaptureNode", "Der Installationsvorgang wurde unerwartet beendet.%0", "o foram resolvidos dentro do limite de tempo necess", "NX2BK-Y2GR2-XP7XQ-WFJPG-Y99YT", "7187cd9c-190f-99cd-23de-ad2be6c96851", "808M8t8", "SetupUpdate", ">#>d>|>", "2d047180-9be9-1907-6abd-779ef08955c1", "f55425ba-2dab-7616-98a2-9a37c26bf45a", "ba517a10-4f95-fb56-6f38-88130f8127f0", "Microsoft.Windows.98.X19-99594_8wekyb3d8bbwe", "3R7NT-MTX6X-WJ3X8-KJY2B-7MKTQ", "CDlpActionDU::ExecuteFacilitatorDUSetup", ", Kald", "A precommit script failed to execute or returned an error.%0", "MediaUpdateAgentPath", "QNH8Y-PG6KP-C7MDM-CX9XP-TMT64", "59e9a3b2-1229-5b81-7fa1-759e94640887", "9$9,949@9d9l9t9|9", "laton, ", "relsen ikke kan genoptage den tidligere startede opdatering.%0", "ProductKey: Error reporting telemetry for dwIsDefaultKeyUsed: [0x%X]", "cutable GatherOsState a une signature non valide.%0", "4O4\\4q435", "lasztott ", "1f17335c-cf9a-6bcf-702b-f4f7f2805f6c", "WGPNC-FBRQ4-QQDFV-T7W6Y-92FCB", ":':,:a:n:", "UseStorageReservesForDownload", "CopyFileExW", "ZwSetSecurityObject", "DebuggerOptions: Enabling 1394 debugging -> [%d]...", "PT3N7-CYHX6-8FPDY-X4QGF-4X8WB", "3NR8Y-GF6BG-MFBP8-88K8G-BP2JH", "m_PropertyCache.Allocate(m_LayoutCache.TotalObjectCount())", "Ein Skript hat das Zeitlimit ", "ForcePrepareTIForReserveInitialization", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionFinalizeFactory@@VCDlpActionFinalize@@@@", "<,<7m_pAllocator->Allocate()", "sr-Latn-RS", "Microsoft.Windows.7.X21-83684_8wekyb3d8bbwe", "hr-HR", "The requested attribute is not supported.%0", "SystemPhysicalMemory", "s let", "UTF-8", "BBHB3-GNRMD-48PJ9-QKYKJ-7FR72", "T$@j[P", "a1fb5b8f-d7ab-f2db-3f1b-ba2449cabd5a", " operace vr", "NtQueryDirectoryObject", "15c99cc4-84f9-621d-6881-19b5211d80ec", "3N46B-F8R7T-BM6CV-TRTMX-T83GY", "Microsoft.Windows.8.res-v4310_8wekyb3d8bbwe", "5d277d9e-6ef6-b89c-a8ab-5a9c723378ca", "MajorVersion", "afc58d1b-7524-6777-6564-da0eadf469db", "ultimatee", "3\"4Y4`4m4{4F5`6", " Microsoft Corporation. Med enerett.", "ioctl: setting reparse point tag failed", "o em disco para baixar a carga.%0", "PreFinalize: Initializing Target: [%c]", "FTXYN-HFX89-BD3GK-VBYY6-VCFBG", "PVR6H-NTGD7-BQ7X4-93Q9R-MWRDD", "Microsoft.Windows.8.X21-83718_8wekyb3d8bbwe", "r installationen l", "0L0lQ", "Microsoft.Windows.125.X20-35519_8wekyb3d8bbwe", "8670dbb1-c29b-3fbc-c0cb-dd9c437ce962", "o foi iniciado com um argumento de linha de comando inv", ":N;Y;", "not supported", "J3DVD-NVHDM-PH9B8-HCTYB-TXXQR", ";y-{e", "en-US", "Microsoft.Windows.7.X21-83729_8wekyb3d8bbwe", "CDlpActionImpl > > >::GetState", "7:8G8N8Y8", "<)=9=@=o=", "j\\Zf9", "sv-SE", "Microsoft.Windows.171.X21-24741_8wekyb3d8bbwe", "dzia nie jest obs", "InstallFlowConstraint", "2WYPR-GMN23-BYCHW-6P6WD-QRR7H", ".?AVCDlpActionPreFinalize@@", "4/4D4y4", ";q;M >,class CDlpActionRecoveryFactory,class CDlpActionRecovery>::SetActionId", "Unknown", "=.=4=M=T=c=j=v=", "sto na disku pro instalaci datov", "CDlpActionFactoryImpl >,class CDlpActionImageDeployFactory,class CDlpActionImageDeploy>::GetActionId", "Operacja oczyszczania po poprzedniej pr", "PerformSilentCleanup: Failed to call PerformTriggerStorageCleanup", "DownlevelActivation", "InstallNow", "Automation: Registered INSTALL_NOW_OR_LATER Response", "se el", "corearm", "CreateReportFromFile", "tBj\\P", "Microsoft.Windows.161.X21-03402_8wekyb3d8bbwe", "Extended", "9U:b:i:", "=#>/>", "CDlpActionDataMigrate::ExecuteRoutine", "Microsoft.Windows.49.X21-03401_8wekyb3d8bbwe", "vel criar nem destruir a mensagem de bloqueio de desligamento.%0", "PVVh<", "Der Benutzer hat die Lizenzbedingungen nicht innerhalb des erforderlichen Zeitlimits akzeptiert.%0", "; OS.%0 y", "Die ausf", "9*989", "Failed to copy source string to destination", "%s: Entering Response Execute Method", "ci miejsca na instalacj", "FveDetectTelemetry", "5a2925ca-d90d-9e10-8164-96659371f9ff", "707m8", "too_many_files_open", "Microsoft.Windows.171.res-v3854_8wekyb3d8bbwe", "compresser le m", "CDlpActionImpl > > >::Deserialize", ":&;1;i;", "RtlDuplicateLUnicodeStringToLUtf8String", "sPublishedMedia\\Files", " wiersza polecenia programu setup.exe tylko do przeprowadzenia skanowania, a nie do zainstalowania systemu operacyjnego.%0", "7,878j8u8", "Environnement de r", "lla avinstallationsalternativet.%0", " Lisans Ko", "%d.%d.%d", "6NDBM-3HP48-KJMTX-BY298-YP2JB", " csomagokat.%0", " wstrzymany.%0", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteRawString", "VWj(j", "<<=M=", "ndaren har k", "fullUpgrade", "CDlpActionImpl > > >::SetProgress", "nia wymaga", "The system does not pass the requirements for desired migration choice.%0", "Microsoft.Windows.171.res-v3855_8wekyb3d8bbwe", "ch instalace ", "ProductKey: Product key found in Host OS.", "XNQ6Q-JMCQ9-JG299-3T7VJ-QDCRJ", ";4 > > >::ExecuteResponse", "d45dd9ed-f352-aefc-bc17-e3ad4d8c9525", "Microsoft.Windows.98.X20-29571_8wekyb3d8bbwe", "o da ferramenta n", "SetupDiEnumDeviceInterfaces", "SystemLanguageFromSkulib", "DUImage: Facilitator DUImageResult: [0x%x]", "stat. failed", "timed_out", "CDlpActionImpl > > >::Initialize", "eeaa6187-c287-b7a0-75c3-718266d6d937", "0O0c0", "J8FBX-NT2GD-MXXWX-4W4MQ-FM63J", "a9e2b33f-4534-2d78-8ed0-fef66981824c", "Compatibility: Device-Actionable Block NOT found.", "A Plataforma de Configura", "en-MY", "?\\?l?", "CDlpActionImpl > > >::CheckUserInterrupt", "JBWQB-VNWQG-93G4V-R23W8-9TP2Y", "charger et d", "8a8fb214-a939-70a7-ecc3-594f7133c295", "Microsoft.Windows.17.X17-36806_8wekyb3d8bbwe", "=+=H=M=", "CMicrodomBuilder::WriteXmlDom", "900de5cb-acf2-fbc8-f711-75728dadfb14", "DataMigration: Initializing ActionListPath: [%s]", "ra meddelandet om blockerad avst", "D$ ;D$", "9GNJJ-DMCCH-J66PX-WCGMF-KBT32", "H9TTN-VGX68-6WX86-KJT7B-7MHYG", "GetFileVersionInfoExW", ">;?\\?|?", "Microsoft.Windows.120.X20-19835_8wekyb3d8bbwe", "Microsoft.Windows.7.X21-83726_8wekyb3d8bbwe", "0k0W0f0J0O0S0h0", "ar-OM", "WINTRUST.dll", "The provided automation information was invalid.%0", ">=?}?", "CDlpActionImpl > > >::Serialize", "RtlIsLUtf8StringValid(NamespaceURI) || (NamespaceURI == 0)", "B228C-4HNV4-KXB9T-Q62MF-KBV4R", "98NKH-VW7G3-6K3BF-22TVH-DRV4K", "State", "Failed to get system store path. Status: %x", "Microsoft.Windows.188.X21-99378_8wekyb3d8bbwe", " laste ned oppdateringen.%0", "d19a41e5-21f7-0658-3a74-42fd23486516", "S(_^[", "CumulativeUpdate", "CMicrodomUpdateContext::CreateVirtualComment", "Microsoft.Windows.49.res-v3314_8wekyb3d8bbwe", "Microsoft.Windows.99.X19-99657_8wekyb3d8bbwe", "W9NV9-HCFTP-DB7WX-RMJ2V-BDXRX", "c2332c5e-f14c-f2f1-67f1-452cfdf5dd26", "Microsoft.Windows.49.X19-98819_8wekyb3d8bbwe", "letim Sistemi", "UpdateMedia: Initializing OneSettingsSetupVersion [%s]", "er ou de d", "Et script overskred timoutgr", "6/7Z7", "1cf35b66-bb4b-7009-ffb1-a8dc39ffa934", "6>7p7", "embeddeda", "7#7Z7x7", "nements ne peuvent pas ", "CleanInstall", "MoSetupPlatform: Upload telemetry data", "RtlCreateDefaultMicrodomXmlWriter", "8(878B8", "Microsoft.Windows.4.X19-98700_8wekyb3d8bbwe", "DiskSpaceReq: Cancel was requested", "Create_Media", "DesktopInplaceUpgrade", "MJ6W9-4NRC9-P74PQ-C4448-F3MMY", "DNJ2Y-6X8M2-427WB-BYV3T-6F397", "0c709f41-c237-aa57-2fe3-81cc880a665b", "connection_already_in_progress", "STATUS_KEY_DELETED", "Found loaded store at key %s", "k venter fortsatt. En systemomstart kreves.%0", "*ppObject = State->m_pAllocator->Allocate()", ".?AV?$CZeroInit@VCDlpActionActivationFactory@@$00@@", "iminden temizleme i", "instance est introuvable.%0", "_^u.h", "1fe8fbdc-ea29-35b5-4dfa-6874d40e2c8e", "5ce027f4-e6ea-421c-331b-343c147ec69e", "k-NB}bk", "CompatInstallReq: Initializing Telemetry OptIn: [%s]", "j?Yf97tQ", "WimCloseImageFile", "1.1;1I1", "ef5d8ea2-b692-0004-edff-3f7ea784b397", "serverhomepremium", "3O3X3_3", "Microsoft.Windows.164.X21-06164_8wekyb3d8bbwe", "DCTRN-JH8PH-HGY4C-X42X6-GMT6R", "Microsoft.Windows.4.X19-99700_8wekyb3d8bbwe", "ytett", "0873c306-63ae-6e1a-f446-bfac35cab4cb", "Q9QFR-8GN4F-7BFFB-VH9TH-X763T", "a502e74d-73be-ced4-ad56-7f53fa7a4de6", "rnyezetben fut.%0", "Une version plus ", "N9M2Y-DFCFT-FHP3C-486W4-F63CC", "4285ea10-fbde-ebca-1120-0fdc50e3209c", " procesu, proto", "8<9C9i9p9", "CDlpActionDebuggerOptions::SerializeRoutine", "es de N", "Compatibility: Calling Resolve(WICA_UNINSTALL_ALL_RESOLVE_STRING)", "LockResource", "tte, fordi forekomstens hash-v", "N73CM-2VTCR-XFD8X-XCMBB-FGFFP", "fen Sie den Paketinhalt.%0", "RemoveDirectoryW", "PSSSSSSSj", "Vdk!q", "PerformSilentCleanup: TriggerStorageCleanup not supported.", "o do sistema ", "4962912c-27e5-a5b4-16e8-e1f58d7fd481", "1&1,191_1f1", "PackageMigration: Initializing SafeOS Count [%ld]", "CDlpActionProductKeyValidate::SerializeRoutineGetEdition", "uje minim", "by.%0", "3v3}3", "QNJWQ-KH7GC-GC7RG-RXJD7-JQMV9", "Problemen med minimikraven f", "E_NOTIMPL", "id-ID", "education", "The requested attribute does not have write access.%0", "Die Installation kann nicht fortgesetzt werden, da der Instanzhash nicht gefunden wurde.%0", "3_5i5(7", "bereinstimmt.%0", "D$ x[", "mes d'espace disque de t", "9(9K9", " >,class CDlpActionProductKeyValidateFactory,class CDlpActionProductKeyValidate>::GetActionId", "318468ee-5642-b7ae-09a7-a8bc8a1daaf7", "Microsoft.Windows.98.X20-15874_8wekyb3d8bbwe", " ei hyv", " kulland", "ef1c605d-d105-8954-c8c5-89382f029f1f", "nimos para descargar la actualizaci", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionActivationFactory@@VCDlpActionActivation@@@@", "CDlpActionImpl > > >::SetProgress", "SVWPj", "MoSetupPlatform: ExecuteCurrentOperations reported disk full!", "7b1deff1-0029-c9d5-4b72-1e9dd7384b35", "=k=~=", "92ecb840-f632-122a-e9fd-c2b575156386", "n se inici", "Microsoft.Windows.21.X18-81301_8wekyb3d8bbwe", "5b9f7c6e-dc26-bab5-3ee9-575a4f720872", "xmlns", "Microsoft.Windows.27.X19-98756_8wekyb3d8bbwe", "ExecuteInstallReq: Auto selected drive [%c] has enough free disk space", " datov", "0n0_0", "GetSecurityDescriptorDacl", "Erro ACCESSDENIED encontrado nos est", "2d93cf82-c2cb-ae91-6a76-0efffb8036f6", "in ayg", "GetProductKeyFromResponse: Response product key is valid.", "ersiz imza var.%0", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length", "CDlpActionProductKeyValidate::ValidateProductKey", "4\"5N5", "04d06df1-ab57-0dd6-1ba4-8c5df08c85ee", "NBHQV-BQC4F-BP4KD-6TBC3-PYVJ9", "Microsoft.Windows.48.X20-23648_8wekyb3d8bbwe", "PQQhd", "Microsoft.Windows.48.X19-98794_8wekyb3d8bbwe", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocument", "FNR2C-V6GDR-PDVKM-VG6MD-7T9RF", "%ARCH_32%", "I problemi di spazio su disco per l'installazione non sono stati risolti entro il limite di tempo richiesto.%0", "WMX8Q-7GN9V-RJ2KH-YRG49-WTY6M", "UserMigXmlPath", "CDlpActionDataMigrate::MigrateFiles", "WYPNQ-8C467-V2W6J-TX4WX-WT2RQ", "Microsoft.Windows.4.X19-99670_8wekyb3d8bbwe", "No se pudo ejecutar un script de error o se devolvi", "7VN96-G3R8F-PPHBV-DVGMV-QPFB9", "GetSupportedDriveLetters: Failed to CheckReadOnlyDrive on drive [%s]. Error: [0x%X]", "4NKRR-W36Y4-48PGV-RHQYQ-4GF9D", "Compatibility: Ignoring Dismissible HBs from now on.", "2'323^3i3", "CDlpActionPreFinalizeFactory::CreateInstanceRoutine", "device or resource busy", "Microsoft.Windows.162.res-v3920_8wekyb3d8bbwe", "Microsoft.Windows.50.X17-54016_8wekyb3d8bbwe", "Installationsfilen blev ikke fundet. %0", "11a310d0-978a-b65b-2f98-f553a4bf0fe7", "MicrodomImplementation::CStringpoolCache::FindString", "74ea4260-9a6f-90d1-6006-5da12542d453", "Microsoft.Windows.98.X18-15541_8wekyb3d8bbwe", " zdarze", "Microsoft.Windows.100.X19-99460_8wekyb3d8bbwe", "4 4$4(444P4x4", "CDlpActionActivation::RescanAsync", "PackageMigration: Initializing LangPack Count [%ld]", "DebuggerOptions: Initializing Debugger Channel: [%d]", "[0x%.8x] ", "ad06549e-369d-3f73-5106-dc018a4e1b00", "o de payload.%0", "FlushFileBuffers", "ead94952-1f62-1f7a-a533-ed81ca55b4b2", "amento est", "CDriverCallback::ValidateDriverPackage: Returning the proposed answer. {62960759-F2E8-41F3-8605-52442B9B2E7B}", "5ea6fe95-1886-387f-b74a-0d9fb0f22b41", "NFCQ2-TJDXD-X6YFX-2JRDM-XBT4X", "968ccd2e-128d-61c6-81dc-5faf1b38d9cd", "CDlpActionCompat::ExecuteMigChoiceScan: Exit", "NJMFF-TXKRR-VG2JY-KMV92-FX8WP", "Microsoft.Windows.7.X17-36797_8wekyb3d8bbwe", "g hely a telep", "GetExitCodeProcess", "t1VPQ", "nost Odinstalovat aktivn", "Activation: Machine is active.", "V2NHV-GQ43K-88YJP-JXF3Y-TXX2J", "Microsoft.Windows.100.X19-99453_8wekyb3d8bbwe", "CDD8N-7MBXW-7XFH9-R388M-7MKPG", "PayloadFilePath", "? ?,?@?f?t?", "UseExtDrive", "eSystemManifest", "d846c97d-d25f-127b-c30e-b466409297eb", "9K:i:", "7N7e7", "DoNotConnectToWindowsUpdateInternetLocations", "CDlpActionImpl > > >::Resume", "lt-LT", "mn-Mong-CN", "de577544-8db0-d3e8-0ea4-d73bc99ce70c", "Installasjonsprosessen krasjet.%0", "Impossibile creare l'oggetto diagnostica. Gli eventi non possono essere segnalati.%0", "ely telemetrie.%0", "Serversvaret er feil utformet.%0", "Asennusta ei voida jatkaa, koska j", "GetUpdateReserveManager", " desteklenmiyor.%0", "%d.%d", "keniyle ba", "263e8f1e-784e-4e23-028f-8e4e23f8f2ef", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatAction@@@@@@@@", "5`5v5", "Microsoft.Windows.99.X19-99564_8wekyb3d8bbwe", "MicrodomImplementation::CDomPositionCache::AttachToPositionList", "9):]:", "ges.%0", " palvelin ei ole k", "6-6d6", "SVWhP", "8 888<8D8H8L8P8T8h8l8p8t8x8|8", "dfa32a07-4ecf-4922-0d10-4f427e0cae87", "Microsoft.Windows.126.X21-83269_8wekyb3d8bbwe", "Microsoft.Windows.100.X18-52140_8wekyb3d8bbwe", ".?AVCMoSetupDUDownload@@", "ImageFinalize: Initializing SetupResult: [0x%x]", "Het installatiebestand is leeg.%0", "DataMigration: Not requesting data file migration.", "HFMVH-KCBNC-7TJWY-KXRQY-X4TWV", "Microsoft.Windows.145.X21-83700_8wekyb3d8bbwe", "Microsoft.Windows.8.X21-83704_8wekyb3d8bbwe", "3<4S4", "WaitForMultipleObjects", "f6ce2f8a-fac2-0556-3330-3fa55691e5d1", "CDriverCallback::ValidateDriverPackage: Driver Package Enter {2A35BE4C-47B4-4F01-88C5-11AFF3A4F834}", "ace5abbe-50a5-f9e1-dea2-70fdf622a7e6", "8cbac387-23fa-83a2-7c36-b2204a918655", ".?AV?$CMoSetupActionImpl@V?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@@@@@@@", "WN9JT-82JJM-F72Y8-FTKGY-WHVYJ", ">A>c>", "OemAcpiMsdmTable", "ZwQueryValueKey", "sr-SP-Latn", "totta a folyamatot, mert a rendszer nem felelt meg a friss", " un error no especificado.%0", "File[*]\\LanguageCode", "CWHKR-GNB9F-6JJTC-CQH9D-PYVM2", "Microsoft.Windows.101.X19-99533_8wekyb3d8bbwe", "PG6ND-KQJY7-HQT2R-XP3DY-JK4HJ", "eMoSetupPlatform: Getting current boot entry...", "WIMExtractImagePathByWimHandle", "RtlCreateHeap", "VWRQSU", "Setup-Kernaktionen", ">$>.>@>X>", "Printed name string copy failed", "b1552e19-6286-7427-6b54-a3e8f298ca7f", "HW4NG-K68YX-W6CXY-9YGRR-DJ49H", "=)=V=`=", "6)7D7r7", " skanowania zgodno", "Finalize: Error reporting WindowsUpdateExit(ASMV): [0x%X]", "f;D$4u", "PQQQV", " konsolidovat pro ", "ro-MD", "mk-MK", "7$7,747<7D7L7T7\\7h7", "Wn0OUL", "WimImageEnqueueOperation", "fc26c7c4-6617-97bc-4e12-c099edce44bb", "GetTokenInformation", "Activation: No response registered.", "UpdateMedia: Starting box download", "Summary: IsPowerPluggedIn returned [0x%X].", "Ein Bereinigungsvorgang eines vorherigen Installationsversuchs steht noch aus. Ein Systemneustart ist erforderlich.%0", ".?AV?$CZeroInit@VCMoReserveManager@@$00@@", " il sistema non ha superato l'analisi del dispositivo per l'installazione dell'aggiornamento.%0", "NCTJJ-RVFR8-DK2M6-4MDR6-9KXQ6", "sr-Cyrl-RS", "o foi aprovado pela verifica", "1'2;2n2", "Microsoft.Windows.98.X19-99595_8wekyb3d8bbwe", ">7>r>", "Microsoft.Windows.126.X21-03400_8wekyb3d8bbwe", ".CRT$XLA", "UpdateMedia: Initializing OneSettingsEnabled [%s]", "(Flags & ((0x00000002) | (0x00000004))) != ((0x00000002) | (0x00000004))", "7O7w7", "RestoreFileMetadata: RestoreFileInfo failed", "4N4Y4", "Microsoft.Windows.161.X21-83176_8wekyb3d8bbwe", "El sistema no cumple los requisitos de espacio en disco para instalar la carga.%0", "BASE_CHINA", "CDlpResponseAutomation::GetResultsRoutinePkey", "e3c8aa33-c828-5deb-88fc-9d2b421fca3b", "0,090T0", "2c0eae5e-466d-0181-39e1-43472796d8e3", ">a?h?", "mi-NZ", "Microsoft.Windows.126.X21-83178_8wekyb3d8bbwe", "DiskSpaceInstallReq: Initializing Perform Silent Cleanup [%s]", " verze je pr", ", mert a p", "9GG6K-VNMDP-DXDHT-MJCY8-JFJR6", "2e01adc7-42a5-fcec-d927-8fa4f11d3a91", "HF29H-DFNHX-JKM6X-3XVK2-YKMP8", "Microsoft.Windows.7.res-v4295_8wekyb3d8bbwe", "Q8NQG-W3WKV-BP27T-KXKHV-X77Y4", "Microsoft.Windows.4.X19-99706_8wekyb3d8bbwe", "rique ne dispose pas de l'espace disque requis pour le t", "Compact", "nb-NO", "Latauksen levytilaongelmia ei ratkaistu aikarajaan menness", "Microsoft.Windows.72.X20-35517_8wekyb3d8bbwe", "6913e02f-1813-f7f4-2827-9141879b557a", "servermultipointstandard", "Compatibility: Uncategorized Block NOT found.", ">+?C?", " pliku wykonywalnego GatherOsState.%0", "lo-LA", "2+2Z2", "Microsoft.Windows.188.X21-99372_8wekyb3d8bbwe", "t adott vissza.%0", "es-BO", "Not-null check failed: Source", "malloc", "7 8R8", "%PRO_KN%", "Microsoft.Windows.165.X21-06168_8wekyb3d8bbwe", "Target OS: Version = [%d.%d.%d.0]", "Microsoft.Windows.99.X20-29705_8wekyb3d8bbwe", "The requested attribute does not have read access.%0", "DUSetup: Enumerating build offer", "charger la mise ", "7GNT4-DJHXD-VFPJY-384GG-683YC", "cf2e0157-a74b-71c7-132a-0cd99abc51a4", "Microsoft.Windows.48.res-v3425_8wekyb3d8bbwe", "The install cannot continue because the instance hash was not found.%0", "Microsoft.Windows.27.X21-83176_8wekyb3d8bbwe", "NVFT8-DCMQY-CT6RF-3BDHP-GQ8Y2", "[RS5]", "Zu$A;", "%CLIENT_N%", "The system does not pass the minimum requirements to recover Windows.%0", "f24f3ce6-bc79-f037-38c5-bd8334b00f61", "f8a2b3f9-53ec-1e3e-1c7a-464714784d59", " na urz", "serverembeddedsolution", "WKKYN-2TTTP-2B4V7-MGFHY-YWRCC", "1ed2dcf6-08a1-f5a8-b60f-81950a55671d", "Microsoft.Windows.50.X17-54018_8wekyb3d8bbwe", "5L6p6", "Microsoft.Windows.146.X21-83744_8wekyb3d8bbwe", "229879+4583620", "GetDeviceNumberFromPath: Drive %s CreateFile returned Error: 0x%X", "Substitue name string copy failed", "b06f3b0a-4496-5399-9e6a-fb51a037767d", "T9DFN-TBX82-V7K77-3RY48-VH8XK", "4C4m4", "Microsoft.Windows.135.X20-43106_8wekyb3d8bbwe", "b64f0e2a-d3d8-b2bd-7980-6310d7929278", " v testovac", "<$<2 >,class CDlpActionPackageMigrateFactory,class CDlpActionPackageMigrate>::GetActionId", "t Sh ", "wcsstr", "?\"?)?K?l?", "CDlpActionFactoryImpl >,class CDlpActionPackageMigrateFactory,class CDlpActionPackageMigrate>::CreateAction", "ra GatherOsState-filen.%0", "9!9%9)9-9=9", "GetFileVersionInfoW", "ZwReleaseMutant", "CMicrodomBuilder::CFourStringIdTable::Initialize", "timed out", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateElementNs", ".?AVCDlpActionDUFactory@@", "L$$QPh", "DUSetup: Setting progress callback for payload SetupDU", "Asennusta ei voi jatkaa, koska viimeistelytoimintoa on jo pyydetty.%0", "O utilizador optou por cancelar, uma vez que o dispositivo n", "Die Speicherplatzanforderungen zum Herunterladen und Entpacken von Medien werden vom System nicht erf", "2B7BM-NFQFX-XKGFX-2W7QF-3DBP2", "44VVN-KQQGY-2FR3C-XFFC4-9W4H4", "GTF7R-4NQ6M-CVCDM-TH442-4RJTB", "SessionId", "MoSetupPlatform: Releasing NewSystem object...", "serverwinsb", "LowCostDeviceMode", "3b512a7a-a766-26c2-d853-8c7de76e95d6", "KHFM3-NW7PC-GYV6D-6YBQB-RC4BJ", "Nejde vytvo", ":d;j;", "ProductKey: Product key is invalid. (Invalid Format)", "DUCategoriesOneSettingsFlag", " olmad", "CDlpResponseAutomation::GetResultsRoutineMigChoice", "3E3R3{3", "44f65b03-ab1a-483e-6fc2-d520edf90291", "d11bc417-12c7-60a8-a597-831853795fdb", "g hely a let", "CERT_E_UNTRUSTEDCA", "<; > > >::GetSerializeOnProgress", "DUImage: Initializing GDR Path: [%s]", "e2949e60-8fca-9383-c923-5b773ab3cf8f", "D$ SVW", "?A?~?", "Failed to add system store from file. File: %ws Status: %x", "Microsoft.Windows.165.X21-06173_8wekyb3d8bbwe", "6MNDJ-WFKGG-C8VP8-44MCH-3J3XF", "1B2[2b2", "CDlpActionDiskSpaceReq::ExecutePollingScan", "ti.%0", "n de la herramienta no es compatible.%0", "kok-IN", "0x%08X", "onecoreupdateos", "Impossible de continuer l'installation, car l'espace disque du syst", "Underh", "fr-CA", "9NJHV-KTFQX-WH62R-8JGCG-Y98VW", "DOCTYPE", "ChunkWriterFlush", "Microsoft.Windows.98.X19-99430_8wekyb3d8bbwe", "e n'ont pas ", "Microsoft.Windows.101.X20-17624_8wekyb3d8bbwe", "ole32.dll", "B8HXJ-GKN7Q-B9FTG-T7HWP-4RG4C", "n palauttaminen.%0", "Microsoft.Windows.121.X19-98885_8wekyb3d8bbwe", "lni.%0", "83XNG-JQFK8-KB3XG-PR3BP-HH74Q", "Failed to get system partition. Status: %x", "f284e5ea-2420-cbca-966f-804211a626e3", "4V7NJ-MQKCW-VYTFX-DX6JD-QRT4B", "TR8V6-X3N8K-X6263-KWD88-Q69Q6", "Le processus d'installation ne s'est pas termin", "DataMigration: Failed to read WebSetup image index Hr=[0x%X].", "G3NDH-4B69M-9DQWK-BMBWC-PGYM4", "YNG9G-C88QB-B88K9-BWWQ8-6MVCK", "CDlpActionCompat::ExecuteSysReqScan", "Microsoft.Windows.49.X19-98861_8wekyb3d8bbwe", "Microsoft.Windows.4.X20-00862_8wekyb3d8bbwe", "MoSetupPlatform: ExecuteCurrentOperations was cancelled!", "Microsoft.Windows.48.X20-29719_8wekyb3d8bbwe", "Microsoft.Windows.99.X20-29707_8wekyb3d8bbwe", "H46W6-R87G2-6J6Y3-YF2WY-7MG4F", "L'utente ha scelto di annullare l'operazione perch", ".?AVIFCPayloadCallback@@", "Ocorreu um erro e o valor do resultado tem de ser consolidado para efeitos de telemetria.%0", "RtlCreateSecurityDescriptor", "ImageDeploy: Initializing BitLocker Mode: [Keep Active (Best-Effort)]", "CDlpActionGetWebSetupUserInput::GetMediaFormatFromResponse", "3(3=3N3c3", "s a felhaszn", "executable format error", "Failed to modify boot entry 0x%x. Status: %x", "Microsoft.Windows.180.X21-83665_8wekyb3d8bbwe", "*ppObject = State->m_pAllocator->Allocate()", "f8ba57f0-1ce1-a38b-0fc3-dde2dc37d12b", "C784F-9KNXX-YWYKK-2FCMP-RVV2F", "MainOS", "Microsoft.Windows.8.X21-83697_8wekyb3d8bbwe", "5ulSignature == ('tDdM')", "CDlpActionActivation::QueryInterface", "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build", "RtlXmlDefaultCompareStrings(&m_State.ParseState, Left, Right, pResult)", "74R7N-QX2QT-69CQ2-K2BPC-BTDYP", "4D4w4", "9N9WF-7QKQ2-2W69C-92GWG-J2QY3", "6781637f-9fdf-398e-3dd0-016bc23c255f", "Er wordt een beter bijgewerkte setup-versie gestart om de installatie voort te zetten", "6DWFN-9DBPB-99W4C-XYWKQ-VXPFM", "Microsoft.Windows.4.X19-99699_8wekyb3d8bbwe", "CDlpActionFinalize::ExecuteCompatFinalize", "Microsoft.Windows.146.X21-83738_8wekyb3d8bbwe", "9K:\\:~:", "Herstelbewerking van OS gevonden die nog in behandeling is.%0", "DosDateTimeToFileTime", "%s\\Partition%lu", "22bef844-58c2-85ad-a9ed-618dfad2fad4", "CDlpActionDataMigrate::MigrateEulaAccepted", "Microsoft.Windows.8.res-v4307_8wekyb3d8bbwe", "A more up-to-date version of setup will be launched to continue installation", "Bugcheck driver INF name", "ur-PK", "1fea6576-6b7a-0139-b7a0-115eec2ef933", "L$<_^[3", "CDlpActionCompat::SerializeRoutine", "ar-EG", "m_StoredTable.FindOrInsertIfNotPresent(Pair, pAttDef)", "Microsoft.Windows.125.X21-83681_8wekyb3d8bbwe", "owy podpis. %0", "Microsoft.Windows.121.X20-00862_8wekyb3d8bbwe", "fr-SN", "Microsoft.Windows.100.X19-99438_8wekyb3d8bbwe", "en-ZW", "tL0-N", "5)5L5f5", "rt eller returnerede en fejl.%0", "Microsoft Corporation1", "\\VarFileInfo\\Translation", "DebuggerOptions: Initializing Debugger NoDHCP: [%s]", "7NY2F-2RPB3-TJ734-YW6TM-B4HCK", "ndaren har valt att avbryta eftersom systemet inte klarar kompatibilitetskontrollen f", "RK3P8-FNTGF-B8338-63JD9-DYHY9", "ivatel p", "MoSetupPlatform: Failed to set Correlation vector. [0x%x]", "Not-null check failed: Context", "zenetet.%0", "2QW8H-7RNHB-MPWPJ-8RJDT-V6D27", "lla Windows.%0", "CDlpActionPackageMigrate::PauseRoutine", "Channel", "rjestelm", "Microsoft.Windows.50.X17-54019_8wekyb3d8bbwe", "27FB3-G8NKF-X8RGK-GDBV6-7226C", "Microsoft.Windows.50.X21-83790_8wekyb3d8bbwe", "41ee95c5-4cc6-5369-1ea3-8a0a3b35c166", "Microsoft.Windows.80.X18-81293_8wekyb3d8bbwe", "CDlpActionImpl > > >::ExecuteResponse", "DataMigration: Skipping Request for OC replication", "> > > >::Prepare", "Microsoft.Windows.98.X20-35495_8wekyb3d8bbwe", "8ffa2de3-a844-431a-09bf-f02da3853561", "lony b", "8G9{9", "22331f5f-cef7-8bde-2c3b-204280861647", "ily v po", "ae575973-4b94-46de-f946-5c0661f0646b", "BNY6R-2PG44-HX6Q2-P4V4F-WFG6G", "GN6FF-PBWTQ-PQ73B-7B98T-GMWR2", "Compatibility: Device Block NOT found.", "TKMKK-8NH9Y-VKD4Y-B2RDD-KKX2M", "LicenseStateFound", " anulowania dla umowy licencyjnej.%0", "B2V2J-RPNXQ-2HB33-4X397-XD8HT", "Microsoft.Windows.8.X21-83713_8wekyb3d8bbwe", "FWDNG-YRM8C-26J68-348V8-29X9B", "ImageDeploy: Initializing SafeOS Image Index: [%d]", "=Q=t=", "iu-Latn", "b584a45e-438b-0f51-b7df-848a731b845c", "8RNJ7-PPRTG-2MJQW-YHK6T-D3WVG", "tzm-Tfng-MA", "Microsoft.Windows.98.X20-30043_8wekyb3d8bbwe", "El sistema no cumple los requisitos de espacio en disco para descargar y desempaquetar los medios.%0", "<,=P=", "7 8'8R8Y8", "DataMigration: Initializing System Language: [%s]", " durante la fase de compatibilidad que requiere acci", "WaitForSingleObjectEx", "=[>b>r>", "JTYNQ-D7RXR-23JKV-M3QTX-8QKRQ", "c6b15ef0-61d5-ab48-52fe-a66bf5b9c144", "0(0d0", "IDREF", "N2WHR-HQJ72-WX9PY-62G3P-P92F6", "742b3744-ac1d-1e22-076b-6f981e9084d9", "ka-GE", "kozen", "2+363[3f3", "na raportowa", "9,:[:u:", " skanowania urz", "?l?}?", "Not-null check failed: BytesRequired", ";J::CreateInstance", "m haklar", "c16cf877-fe17-8dfa-b82f-565d05143322", "7d3086d5-e46c-410e-9710-5f4ea3c8997e", "242W2j2", "0eca6d44-b789-3b6a-9b3b-cb6fb76fcd02", "bad_address", "Windows::Rtl::IPoolAllocator::AddAlignedBlob", "MB2VG-4NKDH-BQRX8-K6R8P-BTDGQ", "MNPJW-XM6KJ-TKJ7M-3RWW7-8HWGR", "o pode continuar porque o sistema n", ".?AV?$CZeroInit@VCDlpActionPreFinalizeFactory@@$00@@", "cs-CZ", "Microsoft.Windows.164.X21-06153_8wekyb3d8bbwe", "GUARD_PAGE", "Q4B4P-NMXVT-MRTHW-Q98WJ-78RCB", "Microsoft.Windows.125.X21-83235_8wekyb3d8bbwe", "CDlpActionImpl > > >::DeserializeRoutine", "F28RV-NYFK4-FFHV7-QQYRH-462JC", "DeleteCompatibilityController", "00V0y0", "NX6TT-WH4BH-CJC2P-M98B8-33YPV", "Microsoft.Windows.49.X20-29603_8wekyb3d8bbwe", "1!1H1Q1m1s1", "Microsoft.Windows.7.X21-83723_8wekyb3d8bbwe", "Failed to set file extended attribute", "<* > > >::GetActionId", "=F>P>", "n termin", "WimAtExitInitialize", "O(9_ptO", "fcb31748-5921-4712-fe8a-45ce2529cdf8", "Microsoft.Windows.48.X19-98809_8wekyb3d8bbwe", "<@ > > >::GetProgress", "Microsoft.Windows.48.X20-23646_8wekyb3d8bbwe", "Microsoft.Windows.119.X20-35535_8wekyb3d8bbwe", ":8:@:H:P:`:", "Serveren til installationsstatus er ikke tilg", "8*8<8d8l8", "PublishedMedia\\EULAs", "5<5G5x5", "serverstandardv", "NewChild->Attribute.Allocate()", "ActiveScenario", "Microsoft.Windows.98.X19-99663_8wekyb3d8bbwe", "Microsoft.Windows.101.X19-98878_8wekyb3d8bbwe", "NV4W3-THJ3C-62W4W-B3HTH-FJRBY", "CMicrodomBuilder::ConsumePCData", "Microsoft.Windows.48.X19-98843_8wekyb3d8bbwe", "o anterior pendente. ", "Microsoft.Windows.8.X17-66952_8wekyb3d8bbwe", ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@@@@@", "CheckHotPluggableDrive: Drive %c SetupDiGetClassDevs Error: 0x%X", "@(97u", "D$(f9", "1(141@1L1X1d1p1|1", " ei ole Windowsin palauttamisen v", ": :Q:\\:", "CDlpActionImpl > > >::InitializeRoutine", "QSVWj2^", "674d496b-3d5b-5393-286b-2fba09f649f5", "Microsoft.Windows.7.X21-83399_8wekyb3d8bbwe", "PackageType", "D$(Pj", "59a36947-6953-3558-a634-c27ecd560ef7", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0t0|0", "0", "9d801308-39fc-5652-8647-a1ef3ae51722", "Ainda existe uma opera", "2[2h2", "7'8p8", "RtlXmlInitializeNextLogicalThing(this, &Init)", "MoSetupPlatform: Setup Automation object suspended!", "Microsoft.Windows.180.res-v4259_8wekyb3d8bbwe", ".?AVIFCDiagnostics@@", "Finalize: Error reporting mapped result(ASMV): [0x%X]", "WimAtExitReserve", ".\\%s.mui", "6TDNG-YWPDR-W3FDM-WPKTP-7CFC8", "b5e97bfd-c03f-88ce-b405-3c4edf9d0007", "ntande OS-", "Failed to get img event", "Sources\\ei.cfg", "servermediumbusinessmanagement", "Microsoft.Windows.122.res-v3284_8wekyb3d8bbwe", ":2:=:o:z:", "D$0PQ", "NHK7B-F3BDF-42JVF-QXQP3-PYT4Q", "M9H87-JN9JF-FHDJ9-67MF6-Y986C", "Target OS: Install Drive does not match. Removing install choices...", "jl nem tal", "%I64x", "Microsoft.Windows.100.X20-39259_8wekyb3d8bbwe", "A cleanup operation from a previous installation attempt is still pending. A system reboot is required.%0", "*WjdWjd", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetXml", "ig-NG", "R8XF6-NJRHB-3Q4W8-WY92W-K2GB2", "95bd2561-e54d-b969-789e-f7d12b386c67", "XGXGD-NQRGY-2JBBQ-266HK-RM49M", "CloudE", "pte az id", "ncia n", "HeapReAlloc", "RtlDeleteCriticalSection", "servermediumbusinesssecurity", "QQPQQQQW", ".?AVCMoSetupCompat@@", "RtlFreeSid", ":.:[:w:", "n uudelleenk", "39CRN-27R8Y-8H3BW-834W2-9QB6P", "N27GV-J68WH-Q8899-K8QM4-R3K9F", ".?AV?$CDlpOSInfoT@V?$CUnknownImpl@UIUnknown@@@@@@", "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x", "ProductKey: Looking for product key in Pid.txt file.", "649cf126-a7d6-5f75-8135-bd52f04bc4d9", "Microsoft.Windows.122.X20-29615_8wekyb3d8bbwe", " hatal", "UpdateNotificationShownCount", "Microsoft.Windows.121.X19-98677_8wekyb3d8bbwe", "File[*]\\Edition", "\\Users", "W8VRN-D6776-749GR-V66H2-DC68B", "Failed to populate download actions from {0}", "2!20272", "Fail to read WIM header", "CDlpActionProductKeyValidate::GetResultsRoutinePkeyValidate", "Microsoft.Windows.101.X20-15875_8wekyb3d8bbwe", "tu ve sonu", "000H0`0x0", "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x", "L'utilisateur a choisi d'annuler l'installation, car l'analyse de compatibilit", "Microsoft.Windows.144.X20-91395_8wekyb3d8bbwe", "File[*]\\Edition_Loc", "Finalize: Retrieving downlevel ticks from registry...", "06ab7504-d420-3d96-b872-759bf540718c", "BASE_KN", "PerformSilentCleanup: Failed to create CMoSetupSchTask instance: [0x%X]", "SyspartIsSpace failed for partition path: %s", "1$2E2T2a2", "6C7I7", "DH2NC-P6PBY-XB7MT-WBF9Q-Y4G4F", "Failed to open process. Status: %x", "0#0*0Z0a0w0~0", "RWTV4-N4BKJ-CT2Y2-HF7VM-TXXRY", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetItem", "6da1a0d7-ddb7-e514-f1d9-a66dd9fe7f3b", "GetCurrentThreadId", "Microsoft.Windows.125.X21-83233_8wekyb3d8bbwe", "Microsoft.Windows.125.X21-83259_8wekyb3d8bbwe", "stem na disku pot", "iswspace", "RtlpGenericMicrodomUpdateGetCookieForExistingThing", "Systemet godk", "4&4+4", "ELEMENT", "Microsoft.Windows.121.X19-99607_8wekyb3d8bbwe", "N8HYM-T3P4J-C3B93-G9FQJ-JFJTD", "FODChecked", "CompatFinalizeRequirement", "serverstorageworkgroupcore", "va vyhrazena.", "RtlInitializeSmartLBlobWritingContext", "98d54efa-8cc6-f4ee-3f42-f5625e352488", "PYBGV-N94P6-PB79J-87RQ7-BDWWB", "El usuario no acept", "jeblikket. %0", "b562e32a-776c-9dde-e5e4-865746bd574e", "51566df4-f650-9729-20aa-62c74dece7b7", "=8=?=X=", "cbaa4126-1412-28e4-1cec-283433c45c30", "5QhLu", "QNTWT-3MMT6-Y3QVC-FYPHF-369T3", "D$0PVj", "<==Q=X=s=", "ZwQueryInformationFile", "ProductKey: Is Machine Active : [%s]", "minVersion", "74b7288a-9af9-707e-fc71-50bf6eb3abde", "7'8`8j8", "Microsoft.Windows.8.X21-83721_8wekyb3d8bbwe", "9*919B9I9", "A8PSV", "ObjectCookie.Opaque != 0", "WWWjd", "Microsoft.Windows.8.X21-83702_8wekyb3d8bbwe", "DigitalProductId4", "Sammutuslohkon sanoman luominen tai poistaminen ei onnistu%0.", " iptal etmeyi se", "040804B0", "UseStorageReserves", "<( > > >::Execute", "ExecuteDownloadReq: DiskSpace issuses resolved. DiskSpaceReq polling ends", "0c05f7db-8475-a950-0982-f5380e3d24e9", "m argumentem p", "string size too big", "BootFinalize: Initializing Scenario: [%d]", "SetupCore::Initialize", "destination address required", "Systemet videresender ikke kravene til diskpladsen for at downloade og udpakke medier med flere arkitekturer.%0", "SWjH_Wj", "Bugcheck stack", "sszeomlott.%0", "too many links", "5'616^6h6", "PackageMigration: Initializing LXP Count [%ld]", "tu wyst", "85a21e01-ffe6-be98-6550-0df43124c94b", ".?AVIMoOnlineStore@@", "Microsoft.Windows.169.X21-14947_8wekyb3d8bbwe", "DataMigration: Migrating keyboard layout values under reg key: [HKLM\\%s].", "2N694-4XJDK-MGDCF-3V623-YBKPG", "BCryptOpenAlgorithmProvider", "b15a5952-28ec-b215-3164-10fc800204ba", " /ClientId %s", "191{1", "CDlpActionProductKeyValidate::GetResultsRoutine", "9YDXY-4N3FG-8RBT3-JC8B3-VXQFR", "FveGetAuthMethodInformation", "DUImage: Failed to execute critical search and download [0x%x]", "RegCreateKeyW", "3c67f521-81a4-8cb6-f140-9e8ed85ce05c", "is a directory", "GetSystemDefaultLCID", " compat", "Le processus d'installation s'est termin", "o inesperada do cliente Agente de Aplica", "Microsoft.Windows.130.X21-83284_8wekyb3d8bbwe", "0 0$04080<0@0D0H0\\0`0d0|0", "1:2z2", "4$4/4J4^4q4", "System store path: %s", "analogonecore", "STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT", "The install cannot continue because the system is out of disk space.%0", "Microsoft.Windows.27.X20-35527_8wekyb3d8bbwe", "HDCHQ-FNTQ6-XRP3B-RM84V-MBHYJ", "Microsoft.Windows.101.X20-15872_8wekyb3d8bbwe", "0(un0", "p\\O(u-N", "8b69a7dc-687c-9b3c-ecf1-d9bc6412ae7d", "CDlpActionCompat::ExecuteInstallReqScan", "GJW76-WNM7Q-P6RK9-RQJXD-FM47T", "De problemen met de schijfruimte voor de installatie zijn niet opgelost binnen de vereiste tijdslimiet.%0", "2?3J3", "1V1`1t1", "901a9565-35e8-40a8-c4f3-b726713688e8", "DiskSpaceReq: Migrating LangPacks from [%s] into Target OS...", "ncio.%0", "P3NFB-3DD4J-8BV29-6FGVP-KW3F2", "a07ca41c-282f-abb2-ef37-3e629118dce7", "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputSelectedEdition: [0x%X]", "Asennusprosessi lopetettiin.%0", ".?AUIUnknown@@", "HYNWR-MVXJX-6PJHM-BQRHT-RRG3Y", "t'hh7", "Microsoft.Windows.101.X20-29674_8wekyb3d8bbwe", "8WVNW-47G3Q-QFHXC-F678C-D692P", "La informaci", "ProductKey: Product key target version does not match.", " procesu instalace.%0", "HMNWJ-V69R6-B2CDC-8P7VT-2373K", "CDlpActionImpl > > >::GetResultsRoutine", "serverdatacenterv", "Het systeem", "Not-null check failed: DocumentNode", "nns i enhetsgenoms", "Microsoft.Windows.8.X17-36776_8wekyb3d8bbwe", "Fail to flush file buffers", ";J;T;", ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@", "7c28c8d2-8e87-8963-5fb2-810499917d47", "kleme g", "2(2S2f2", "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c", "D$4>>>T>", "WT33N-7KFCT-6PJ3M-4VGM7-6XXQY", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionGetWebSetupUserInputFactory@@VCDlpActionGetWebSetupUserInput@@@@", "FP7QN-KR4PT-X6K6X-3RGMP-HH7MF", "YHr,g", "Microsoft.Windows.165.X21-06177_8wekyb3d8bbwe", "ImageDeploy", "6&656@6K6Z6e6p6", "5 555R5y5", "cloude", "CDlpActionRecovery::InitializeRoutine", "DataMigration: Initializing Compat MigXmlPath: [%s]", "CDlpActionFactoryImpl >,class CDlpActionSummaryFactory,class CDlpActionSummary>::CreateAction", "ver, at brugeren accepterer licensaftalen.%0", "9YQP3-N367H-CB4YR-4R2KT-P7JWD", "Microsoft.Windows.165.X21-06172_8wekyb3d8bbwe", "tzm-Latn", "DecompressChunkedFile", "MoSetupPlatform: Error retrieving installed size for package [%s] -> [0x%X]", "CDlpActionDiskSpaceReq::SerializeRoutine", "relse af kompatibilitetsproblemer.%0", "FC_CreateFCManager", "We can only update the same product once per operation. CompDBs specified updating product at least twice: {0} with versions {1} and {2} and types {3} and {4}", "3(4P4g4", "DataMigration: Not requesting migration of ActionList.xml", "Das System hat die Compat-Pr", "=M=q=", "CDlpActionUpdateMedia::ValidateOneSettingsSetupVersion", " manca un'attivit", "Microsoft.Windows.49.X20-29569_8wekyb3d8bbwe", "<3=>=L=w=", "2(2K2", "Er is een fout opgetreden en de resultaatwaarde moet vanuit een telemetrisch standpunt worden samengevoegd.%0", "FormatMessageW", "CSetupCore::RegisterSetupActions", "QHMY3-NMFJF-HYY3D-VRM3Q-2WHB3", "P4G7N-HV6D6-PBTBG-C7666-YG9TT", "EXFAT ", "4!4H4", "kernel32.dll", "476d261d-fd38-4da6-0637-48d8b94d814f", "0!0i0", "GetModuleHandleW", "ImageFinalize: Initializing Update and Shutdown: [%s]", "CDlpActionImpl > > >::GetError", "0ea595b7-b92e-34ab-7079-f78ee335ddc8", "2395f173-7cd5-25e2-50f9-c7ae0afd1755", "2;2E2b2h2", "CompatFinalizeReq: Initializing Minor Version: [%d]", "L$djo_", "95e8b596-1f6f-dba8-0ea6-7aff09bc2f18", ".?AV?$CMoSetupUnknownImpl@VCAutomationManager@@@@", "GetSystemInfo", "Microsoft.Windows.99.X19-99574_8wekyb3d8bbwe", "enterprises", "cannot read WIM header", "Finalize: Error during compat Finalize: [0x%x]", "Failed to open description key for store. Store: %s StoreKey: %ws Status: %x", "4NHPP-3KJPH-28KGH-8MDW3-XHJWP", "ProductKey: Error reporting telemetry for Digital key cmd used, exit code: [0x%X]", "Microsoft.Windows.48.X20-21795_8wekyb3d8bbwe", "4f422859-7345-0a42-2916-c4e3401bcbdd", "2PVXM-GN9GV-4QJ7K-CRF7T-HFTP4", "hIPCA", "920e502b-bbb5-f7ab-207e-c0c931cec6cc", "n bel", "MicrodomImplementation::CDomLayoutCache::FindObject", "Microsoft.Windows.189.res-v4367_8wekyb3d8bbwe", "Microsoft.Windows.98.X19-98877_8wekyb3d8bbwe", " anulowania, poniewa", "Microsoft.Windows.48.X19-99493_8wekyb3d8bbwe", "istiedostoa ei l", "CDlpActionFactoryImpl >,class CDlpActionDataMigrateFactory,class CDlpActionDataMigrate>::CreateAction", "NewDocument = this->AllocateStreamObject()", "DebuggerOptions: Debugging not enabled.", "3+464b4m4", "SpaceIssuesFound", "ok mimarili medyay", "<:C?V?", ";.;8;D;a;l;z;", "Target OS: Architecture = [%s]", "CDlpActionImpl > > >::Serialize", "ReleaseMutex", "MoSetupPlatform: Finalize was cancelled!", "ci wyniku na potrzeby telemetrii.%0", "qihoo", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIProductKeyAction@@@@@@", "WindowsSysPartDevice", "Microsoft.Windows.101.X20-30283_8wekyb3d8bbwe", "%ws\\%ws", "924ebe8d-6c4a-d702-1653-b371f72a9606", "0cbcf224-2c22-37cd-3869-61bcb6f1ae25", "01253fcf-21e3-cd34-4c1f-857cd2bb8848", "29f83457-72f8-e84d-dc97-ee739919bb96", "CreateSetupPlatform", "The existing WIM file became corrupted", "NQKWP-F47YJ-V43H4-QPCX7-DRR76", "WPN2V-T7CXK-XKK33-G7MW4-F6T89", "GM2HV-PNMX9-7KF44-HWB79-BKQH2", "(NamespaceURI == 0) || RtlIsLUtf8StringValid(NamespaceURI)", "Microsoft.Windows.49.X19-99515_8wekyb3d8bbwe", "Microsoft.Windows.50.X18-87819_8wekyb3d8bbwe", "1a1beab4-2e0c-0ec8-0042-783e1ab7fb9f", "r ikke portet kompatibilitetsskanning for ", "ProductKey: Validating Product Key for Image.", "44RPN-FTY23-9VTTB-MP9BX-T84FV", "76N4H-7M4D3-QKDMR-4KKH3-BG9Q6", "Der Benutzer hat sich entschieden, den Lizenzvertrag zu k", "tykuormatiedostot olivat vioittuneita.%0", "9C9H9j9o9", ".tls$ZZZ", "3KNVR-PXJFJ-MXRQY-KKQH7-YY6QH", "Scan result at : %s", "Microsoft.Windows.126.X21-83281_8wekyb3d8bbwe", "SetupCore::UpdatePaths", "Microsoft.Windows.50.res-v4333_8wekyb3d8bbwe", "DriversReflect", "Microsoft.Windows.161.X21-03401_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-98830_8wekyb3d8bbwe", ".?AVCDlpActionGetWebSetupUserInput@@", "Microsoft.Windows.121.X19-98666_8wekyb3d8bbwe", "7VW9N-8C48X-J6442-J3KM6-FVTM9", " umowy EULA w wymaganym czasie.%0", "0W0~0W0_0", "1.2f2", "Microsoft.Windows.171.X21-24736_8wekyb3d8bbwe", "ywany w ", "header version mismatch", " essere attualmente riparato.%0", "CDlpActionSummary::IsPowerPluggedIn: System's AC power is online.", " fjernelsesfunktionen forbliver aktiv.%0", "kleme devam edemiyor.%0", "FileDescription", "a4df3354-8f64-1b6f-3e6a-0e757572089b", "378ef8f9-bf4d-560e-b701-df76f547288b", ">.>4>H>U>", "f9XBt", "_XcptFilter", "NJP6C-K7R7D-BP23D-KQWVW-K2FC4", "ProductKey: Product key block found. [%d]", "B99Q2-NV9CP-GYQF2-2F3QV-M4G4Y", "59c89b11-85e2-68e2-6ce5-be2c981b5b07", "Microsoft.Windows.161.X20-00860_8wekyb3d8bbwe", "ID de version d", "4P5|5", "Log: Cannot convert ansi->unicode.", " funkcja finalizacji nie mo", "ivatel nep", " klienta agenta aktualizacji.%0", "afabc496-f907-e437-7146-1bf35f5926cd", "3MWP6-DKNRJ-GG2RC-Y8VR8-4VWH4", "2?u?", "PRIV_INSTRUCTION", "The user has chosen to cancel for advertisement.%0", ";$;D;L;T;`;", "PN3KR-JXM7T-46HM4-MCQGK-7XPJQ", "Microsoft.Windows.121.X21-03403_8wekyb3d8bbwe", "Microsoft.Windows.4.X19-99690_8wekyb3d8bbwe", "CXmlCursor::XmlAlloc", "MediaLocation", "1-242", "Microsoft.Windows.80.X21-83750_8wekyb3d8bbwe", " poistotoiminto odottaa yh", "Compatibility: Entering PerformResolveCommand", "CDlpActionCompat::ExecuteDownloadReqScan", "Microsoft.Windows.50.X21-83789_8wekyb3d8bbwe", "RtlInitUnicodeStringEx", "CheckDiskSpace: Error reporting telemetry for OSPARTITION_REQUIREDSPACE: [0x%X]", "H3DNW-WTYJT-MVQFM-M4YTV-KHJXC", "xboxnativeos", "Catalog", "959]9s9", "4795094d-0434-c3db-f4f3-c9e338904b10", "el kontrolou kompatibility p", "811eabb3-e364-8868-2bdc-ba3e67ed6a9f", "Um script de falha n", "MoSetupPlatform: Getting default SetupAutomation object...", "shez.%0", "ms-MY", "0(0i0", "Target Image: Language = [%s]", "Microsoft.Windows.125.X21-83176_8wekyb3d8bbwe", "$0R0e0", "onecore\\base\\cbs\\util\\cbsutil.cpp", "872ff530-066a-0f8b-da38-88964f035b1c", "\\Microsoft\\Windows\\DiskCleanup", "G<9sTu", "TNWT4-J9899-FX9VF-RDQXR-HQWWR", "MNHR4-M463D-M8943-J783K-6CQDY", "en.%0", "8fa1f2ae-7758-12e5-585c-4d8478735d8f", "onecore\\base\\servicing\\util\\servicinghelper.cpp", "GetFileVersionInfoSizeW", "Microsoft.Windows.101.X20-29684_8wekyb3d8bbwe", "PSWh$V", "WimInitXmlInfo", ";Y;t;~;", "cb7c0db3-c3f0-98b8-80d1-b76d9b1901be", "Von der Setupplattform wurde ein nicht n", ">H?R?z?", "rio n", "1#8,8", "9_0t%", "Microsoft.Windows.48.X20-32150_8wekyb3d8bbwe", "4j j@", "23f15cd4-24f4-6b83-3d94-df3f1c44fff7", "3t4'5a5g5v5", "8f7587f2-abf8-b8a3-d4ce-059bb986778d", "40474Y4`4", "BUCL::Rtl::Add( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)", "CDlpActionFinalizeFactory::CreateInstanceRoutine", "DUSandboxPath", "477da59b-62d1-6543-4935-51753a7ca3d7", "K{m.>4>U>`>w>}>", "uW0~0W0_0", "CDlpActionImpl > > >::GetState", "7YFMF-NHXBD-4HD26-GW2TQ-T6Q8T", "f8c6cd98-085d-51a9-9736-f827871a514f", "CDlpActionDU::ExecuteDUImage", "ac3421b6-09c1-2bba-1436-0acc73c95c28", ";l > > >::PreInit", "07da16e4-0035-3157-7990-72ee89bd4088", "VN7GG-XJ738-R6HXV-2CX3F-HQWW6", "9KM4D-NG3DK-9TBK8-6JQ4W-TQ72C", "= >5>n>", "d0b17a07-e409-6abf-34fd-7f141bd5ab87", "7(787<7@7X7h7l7", " on k", "700cbb81-5845-9150-5687-45ea43fd25c6", "4#5N5_5t5", "Microsoft.Windows.7.X18-87817_8wekyb3d8bbwe", "CMicrodomBuilder::EndAttlist", "DUSetup: Initializing payload SetupDU", "SystemProductName", "El proceso de instalaci", "6H2YJ-NY243-VRYBY-DW966-J2QF2", "*Q`L]", ".?AVCDlpActionEulaFactory@@", "*ppObject = State->m_pAllocator->Allocate()", "14f98898-aa40-2486-af47-59076bd22780", "W3NJG-HJ66R-XBQ6V-YRYBJ-K2FDM", "2FPB9-CRNYB-QQK3C-82PMX-4JPY8", "CDlpActionImpl > > >::Restart", ".?AVCDlpActionFinalize@@", "Microsoft.Windows.191.X99-99999_8wekyb3d8bbwe", "Q3XM6-KKG22-7TBBY-76XXK-T77WT", "ovat, proto", " alapfunkci", "ci i wykonywania dzia", "2\"2)252d2x2", "902fa614-d88f-cae1-dc5a-b79cf2ccc1fa", "Microsoft.Windows.49.X19-99727_8wekyb3d8bbwe", "<0<; [0x%X, %d, %s, %d]...", "No se resolvieron los problemas de compatibilidad en el l", "onecore\\internal\\sdk\\inc\\wil/Staging.h", "Microsoft.Windows.164.X21-06157_8wekyb3d8bbwe", "Microsoft.Windows.50.X18-81310_8wekyb3d8bbwe", "NF3Q3-4KTWH-489DP-3YDRW-XW3G3", "Het systeem voldoet niet aan de schijfruimtevereisten voor het installeren van de nettolading.%0", "6632b411-be24-c4f8-57f6-a966606a0c4c", "onnistui tai palautti virheen.%0", "DUSetup: Facilitator DUSetupResult: [0x%x]", "HKFJR-N3H3P-7FCQ7-WDBQM-XBVCK", "?9?Q?g?", "UpdateAndShutdown", "cych miejsca na dysku potrzebnego na pobranie ", "586L6`6t6", "j YQh", "Microsoft.Windows.129.X20-35523_8wekyb3d8bbwe", "6D6w6", "GYYPN-QTM8C-HCKBG-YY394-X2G6M", "GetProductKeyFromResponse: Using automation response.", "CDriverCallback::ValidateDriverPackage: Driver Package Exit {B416FA3D-8490-4221-9A9B-A8ED9DD4C914}", "?,?:?", "GetModuleVersion", "*ppObject = State->m_pAllocator->Allocate()", "68a1978e-99f8-426b-8d65-996f10c0c84d", "Microsoft.Windows.48.X20-25155_8wekyb3d8bbwe", "WriteEncryptedFileRaw", "r die Installation des Updates nicht erf", "0G0w0", "STATUS_BUFFER_OVERFLOW", "8:9E9S9}9", "StringId < m_Entries.Length", "CDlpActionRecovery::ExecuteRoutine", "MoSetupPlatform: GetUserPreferenceAccentColor: Using default color...", "Microsoft.Windows.4.X19-99680_8wekyb3d8bbwe", "amd64", "ZwTranslateFilePath", "$Docs", "Actions", "Microsoft.Windows.122.X20-29557_8wekyb3d8bbwe", "BcdGetElementDataWithFlags: Failed to open elements key.Object: %ws Status: %x", "K4GTR-NTMW9-DG63T-G9R7W-CPQFR", "Microsoft.Windows.162.X21-43639_8wekyb3d8bbwe", "Microsoft.Windows.27.X21-03403_8wekyb3d8bbwe", "hrend der ausf", "rjade uppdateringen.%0", "n iniciada anteriormente.%0", "zh-tw", "HD3VD-G4NG6-QV8KD-8M783-DV7Y2", "7ace4a20-28e2-95b0-ab8f-a59b7dd261e6", "GetSecurityDescriptorSacl", "XT9TP-N6M8P-R4PYD-MHB6X-FRG4C", "9916d417-bbd0-687c-f7a3-427618c04fe7", "Identity missing language.", "EducationN", "CDlpResponseImpl > > >::UpdateState", "Microsoft.Windows.27.X20-00862_8wekyb3d8bbwe", "ttes ikke.%0", "Microsoft.Windows.98.X20-20963_8wekyb3d8bbwe", "R!s4Z", "QQhX%", "CDlpActionImpl > > >::CheckUninitialized", ",4Gmw+eeeEnQbwZEJX2lc0W+MbNuI+2wC/SpC23ubbb0=0Z", "9X`v^j", "CDlpActionDataMigrate::MigrateWebSetupESDImageLocation", "AllowUninstall", "ProductKey: Getting index from response.", "Microsoft.Windows.145.res-v4316_8wekyb3d8bbwe", "3HDCN-87G3V-FPCDF-C6HTB-79Q3X", "2`2{2", "Not-null check failed: Root", "CFQFT-XNTXF-VJ4MC-3DDXV-94R9P", "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...", "bitlocker ", "::RtlIsUnicodeStringValid(String)", "PsfSourceName", "DNCTQ-PJ8RY-99WYF-TDTY4-W8HWP", "VWj j", "7B6NC-V3438-TRQG7-8TCCX-H6DDY", "WinSatDiskScore", ":\":9:C:I:^:h:n:7 [%s]...", "et-EE", "^6e0R", "Setting element %08x", "NFCDV-7XHPJ-9J2V2-4J8W7-X7636", "8w8~8", "The download diskspace issues were not resolved within the required time limit.%0", "3&4-4g4", "dtak meg a hat", "ProductKey: Offer Default.", "C;X`s", "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\MAJOR", "Generating compat report.", "charger.%0", "bo-CN", "a6e27a02-4d32-9316-49c8-b0d90fb2d1ae", "CDlpActionProductKeyValidateFactory::CreateInstanceRoutine", "> >,>A>", ".?AVCDlpActionPackageMigrate@@", "f61de926-d23b-9de6-5e58-ae85517cd9d0", "<)=k=", "RestoreSecurityDescriptor", "50a009bb-9fe7-897e-1737-ab173bf5961f", "STATUS_REVISION_MISMATCH", "43TBQ-NH92J-XKTM7-KT3KK-P39PB", "CDlpActionCompat::PopulateTargetInfo", "212D2d2", "::;f;", "SilentCleanup", "Los problemas de espacio en el disco de descarga no se resolvieron en el plazo requerido.%0", "6 6(606@6H6P6`6h6p6", "ra vonatkoz", "Microsoft.Windows.189.X22-09605_8wekyb3d8bbwe", "Annetut automaatiotiedot olivat virheelliset.%0", "6\\6b6h6q6", "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x", "6&7R7`7v7", "?#?P?Z?", "ARCH_64", "aa28561e-34b7-103c-8d09-6b125fb53c94", " Microsoft Corporation. T", "aae6e3f5-777f-7754-b5fb-9d0e71fe580f", "FODPath", "VX84N-JDYBF-V79VF-P6YPK-MG9RX", "CDlpActionImpl > > >::UpdateState", "X6J7D-TN6P6-BRPVD-DFDQM-XBT33", "Le processus d'installation a ", "ts ov", "9\\$$v", "PN3YY-92KRG-DDVBJ-2GW7K-WT3GQ", "0e4ed02f-0e2c-ad61-f1c4-c426cc54dd9b", "ProductKey: Matching Install Wim For Exact Editions", "2'3k4", "4a782de7-a01e-a3fe-1844-27cb3955c6ec", "768M8h8", "ERROR_REQUEST_OUT_OF_SEQUENCE", " avbryte for annonsen.%0", "1(1Q1m1", "fc017d80-f651-1abd-1b80-9ba51136bb2d", "Kompatibilitetsproblemene for minimumskravene ble ikke l", "Uno script di preinstallazione non ", "%hs!%p: ", "Het installatieproces is be", "6079bde1-b609-1fa6-8b46-364609d716eb", "CMicrodomBuilder::Initialize", "CDlpActionDiskPartition::GetDriveLetterFromResponse", "Microsoft.Windows.122.X20-29558_8wekyb3d8bbwe", "jligt.%0", "Language[*]", " cancelar el proceso porque el sistema no cumple los requisitos m", "9(90989D9d9l9x9", "lemi gerekli s", "Failed to determine source edition type! Error: [0x%X]", "t$ RP", "2E2P2", "FBf;E", "Microsoft.Windows.4.X19-99678_8wekyb3d8bbwe", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::BeginOpenElement", "DiskPartition: Executing Disk Provisioning from Automation.", "KDGFF-N69CJ-DH4F3-JKQ26-H8T2C", "a591cfcd-f875-c80a-615d-a41ee8ce039e", "Microsoft.Windows.99.X20-00916_8wekyb3d8bbwe", "cktes. Verifiera paketinneh", "En nyare version av installationsprogrammet startas f", "k nem old", ";H;R;};", "9ecdb325-14c2-0597-db93-f8578ef88690", "XYVDB-NTPFD-4CG33-WHDP6-3V66R", "09b433be-521a-748e-ae9a-198a56925ad4", "Microsoft.Windows.171.X21-24724_8wekyb3d8bbwe", "062a6de0-45d2-8550-8cc7-7c35cfcf78e6", "mes de compatibilit", "fr-RE", "GetOverlappedResult", "d41f55d0-564d-0328-4e86-42dcfeafbdcf", "5(5H5P5X5`5l5", "2c0404c7-741e-931d-77d9-99087f6ea7c6", "ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo", "e3032f8c-22c1-7bf5-925d-3acc1b115376", "DataMigration: Queue preservation of downlevel os build number into Target OS...", "8BNTP-P8BGH-Y9KQ6-T7K2T-WXDFY", "2=2U2~2", "Microsoft.Windows.165.X21-06174_8wekyb3d8bbwe", "rozatlan hib", " zako", "CDlpResponseAutomation::InitializeRoutineSummary", "4TNKC-664XB-XDYF8-CR74Y-HT9RF", "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)", ".?AVCDriverCallback@@", "CBasicNodeType::EncodeLUtf8String", "7K8[8g8", "9J9x9", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute", "CoreConnectedN", "6A6_6", "QKN2D-TFQD7-9Q469-RBMGX-4JT2G", "1/0-0", "DUOptInDefault", "%s /f \"%s\"", "8#8I8N8X8b8l8v8", "Microsoft.Windows.48.X20-24587_8wekyb3d8bbwe", "Microsoft.Windows.48.X19-99489_8wekyb3d8bbwe", "MicrodomImplementation::CDomLayoutCache::DecodeElementCounts", "MCT\\Catalogs", "=K=`=q=", "NXCTR-YXXWC-TK368-HGGTF-8YB99", "0,0Q0c0", " nem fogadta el a hirdet", "NtClose", "52575Q5W5z5", "DiskSpaceInstallReq: Initializing ActionList Path: [%s]", "Napotkano nieoczekiwan", "Microsoft.Windows.161.X21-43627_8wekyb3d8bbwe", "o para instalar o SO.%0", "WKVBF-F226X-NR2XW-3WW93-2WF9V", "t$ WV", "%SINGLE_LANGUAGE%", "21c77e35-4a7e-7a61-e865-1915f3e2976a", "2;2p2", "t,h`s", "Microsoft.Windows.7.X17-66958_8wekyb3d8bbwe", "TlsSetValue", "YQH9J-XYNRK-C2FQK-VQDRY-3GPKR", "64411aee-d445-2daa-81b1-4ba7ee3cc8f9", "CompatInstallReq: Initializing Timeout in Mins: [%d]", "7%828^8i8", "4*4D4a4m4", ".?AVbad_alloc@std@@", "UuidToStringW", "|q}CQ", "9E9P9}9", "334:4H4", "false", "Microsoft.Windows.172.X21-24723_8wekyb3d8bbwe", "Microsoft.Windows.27.X20-46577_8wekyb3d8bbwe", "PNDGK-PM26G-BDG9X-J69CQ-TCQGY", "CDlpActionFactoryImpl >,class CDlpActionDUFactory,class CDlpActionDU>::GetActionId", "CDlpActionSummary::SerializeRoutine", "PreFinalize: Initializing Driver reflect path: [%s]", "Y84VV-NBK6Q-TYTM7-F9PTC-Q3Q2J", "SVWj2", "_onexit", "G^{P&a", "serverarm64", "\\\\?\\GlobalRoot", "Server Workstation", "Microsoft.Windows.48.X20-29665_8wekyb3d8bbwe", "PerformSilentCleanup: SilentCleanup task not available.", "DiskSpace: Rollback Disabled via detection.", "Objects", "4B4M4", "505G5s5", "JH8W6-VMNWP-6QBDM-PBP4B-J9FX9", "jHXPd", "Client Workstation", "kseen asennuksen poistovaihtoehdon aktiivisena.%0", ":*;e;", "e v syst", "A rendszer nem felel meg a v", "CDlpActionDiskSpaceReq::PerformTriggerStorageCleanup", ">~>#?", "Install", "CDlpResponseAutomation::InitializeRoutineSelectImage", "057d9554-de71-3860-9365-c6f27c09c3e0", "Microsoft.Windows.48.X20-29662_8wekyb3d8bbwe", "!|$<9}", "Microsoft.Windows.99.X20-29710_8wekyb3d8bbwe", "CDlpActionEula::DeserializeRoutine", "ritystiedosto on tyhj", "el kontrolou za", "liversion tunnus on tyhj", "<(7?V?o?", "8adaa30d-f0ea-a200-3994-64ebf2df4ce0", "Microsoft.Windows.100.X19-98663_8wekyb3d8bbwe", "owym argumentem wiersza polecenia.%0", "Microsoft.Windows.98.X19-99659_8wekyb3d8bbwe", "Microsoft.Windows.164.X21-22361_8wekyb3d8bbwe", "4*5U5v5", "%s, DLPLOG: [0x%X] [%s] [%s]", "rt innen tidsfristen.%0", "Microsoft.Windows.164.res-v3800_8wekyb3d8bbwe", "NYJVK-8TTVJ-C68BC-RMW29-P373M", "STATUS_SUCCESS", "+0>0Q0", "ProductKey: Product InstallChannel = %s", "DiskPartition: Selected Drive letter from response [%c]", "tzm-Latn-DZ", "Nie znaleziono pliku wykonywalnego instalacji.%0", "ProductKey: Valid product key found = [%s].", "RtlDisownModuleHeapAllocation", "nds i en testmilj", "67e525d0-3ecb-626f-ea30-b0f3d441e59c", "0;3I3P3>4E4", "7K7h7", "Zu1A;", "DiskSpace: Required disk space is [%ld] MB without using external drive", "DataMigration: skipping EULAAccepted...", "STATUS_SXS_COMPONENT_STORE_CORRUPT", "$`2X`F", "rnek karma e", "F09{ u", "Microsoft.Windows.48.X19-98854_8wekyb3d8bbwe", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART", "uZSW3", "M0K0I", "Microsoft.Windows.98.X19-99590_8wekyb3d8bbwe", "GJTR7-XN3D4-QJF73-KP8K9-WTYP4", "SETUP360_LOW_COST_DEVICE", "tte, da f", "Microsoft.Windows.126.X20-35463_8wekyb3d8bbwe", "Y7FPN-7XMB9-MHP4H-X64GB-X4R7T", "GetFileVersionInfoSizeExW", "rifiez le contenu du package.%0", "949D9H9L9P9T9X9\\9h9l9p9t9x9|9", "6 797c7o7z7", "BootNext", "H2WVQ-N82CJ-VHGPK-J77MJ-K2FBQ", "??1type_info@@UAE@XZ", "Asennuksen m", "o passou a an", "!D$P9t$Xt", "ZwUnloadKey", "ZwQueryKey", "*g(W@b", "75542ec6-6af5-087a-ec85-794b3fbf9f65", "Il sistema non ha superato l'analisi del dispositivo per l'installazione dell'aggiornamento.%0", "b143aa49-afab-09aa-201d-a58102ff19da", "ProductKey: Looking for product key in Host OS.", "f5fec609-c2e0-5360-02bc-7576effbe7b5", "0D0g0o0w0}0", " image se nena", "31ac2903-ed34-7dba-e98e-b61a525e3245", ";9 > > >::InitializeRoutine", "ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT", "2D3PN-8MMQ3-TGYJR-4KPDF-7H64X", "Microsoft.Windows.8.X21-83717_8wekyb3d8bbwe", "MigChoice: Auto Response has a valid answer: [%ld]", "ProcArch", "1b63b03a-7986-a87c-71ea-d7a2b2137cc5", "ltend", ".edata", "Wow64RevertWow64FsRedirection", "t1f9;t,", "MoSetupPlatform: Calling SetupPlatform::INewSystem::Finalize...", "DRDNB-GPC7W-M8T7C-GQTFB-YWRCT", "CheckDiskSpace: Error reporting telemetry for OSPARTITION_MINIMUM_REQUIREDSPACE: [0x%X]", "CoreN", "GetWebSetupUserInput: Edition=[%s]", "multi(%d)disk(%d)rdisk(%d)", "ff053126-dd5c-aa71-4189-bf1f86e342a4", "13d98b40-ece1-1c81-e8d6-465611594ff7", "RtlNtStatusToDosErrorNoTeb", "serveressentialmanagement", "s reciente del programa de configuraci", "3G4i4", "779a3fa2-2554-152a-ab78-b15745e548fc", "TempElements.Allocate(NewCapacity)", "GetFileInformationByHandleEx", "Assert failed to build string.", "628042f6-8f4a-939e-6905-8cecef69fec0", "e obnovit d", "323G3T3q3z3", "Cette version de l", "Systemet uppfyller inte minimikraven f", "Microsoft.Windows.101.X20-36694_8wekyb3d8bbwe", "CDlpActionDiskSpaceReq::SuspendRoutine", "a463d63f-604c-e343-a8ac-b8454598b045", "CDlpActionPreFinalize::CancelRoutine", "e560a056-e17c-a903-251e-8ca043c8f3fa", "Microsoft.Windows.171.X21-24739_8wekyb3d8bbwe", " nebyly v po", ": :@:H:P:\\:|:", "f0b2cc90-343b-979f-10b2-b3d8dfef8fe7", "SerialBaudRate", "523382ee-e463-a07e-f452-d462689b38c1", "Saved InstallReq scan result at : %s", "3 4h4q4", "R2CNT-9XPV2-M4PRH-G7D97-XD72C", "0~0Y0", "1%141D1K1W1j1q1}1", "DiskSpaceInstallReq: Initializing AllowPartitionChanges: [%s]", "FACILITY_HID_ERROR_CODE", ".?AV?$CZeroInit@VCDlpActionProductKeyValidate@@$00@@", "CDlpActionImpl > > >::ExecuteRoutine", "ResExtractToFile failed", "s az eredm", ", zostanie uruchomiona nowsza wersja instalatora", ": {0}", ".00cfg", ":B:U:_:k:", "CDlpActionDiskPartition::SerializeRoutine", "JRWYN-6M9J7-CP2FC-KQ47P-6JF8K", "CDlpActionUpdateMedia::DeserializeRoutine", ", mert m", "INT_DIVIDE_BY_ZERO", "2f9116b4-6b25-933a-1b1d-fae1c2bf6f11", "4N8VT-7Y686-43DGV-THTW9-M98W7", "CDlpActionProductKeyValidate::GetIsFreeUpgradeOfferActive", " iniciada para continuar a instala", "Target OS: Feature -> [LowCostDevice]", "he-IL", "MK6DN-DMTMR-J7TF7-XHHF6-9KXQR", "ImageDeploy: Installation drive cleaned.", "dka, kter", "Microsoft.Windows.22.X18-81296_8wekyb3d8bbwe", " Microsoft Corporation. Tous droits r", "KT4VW-NR4D6-87QD6-8VTHC-P92H7", "PSSSSSSh ", "F;w$r", ":=:U:s:", "JTN9B-QXPJK-DFDY7-WV82J-VH7KQ", "ncel bir s", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "c0b6ed6b-62b5-62a6-1dc7-429d4aefd27c", ";&j=e=", "72348616-e7e1-304a-bc31-d81b41f7256d", "1 2'2", "9CRJN-CHQPC-G36KV-QG9MD-3PG33", "Fail to update the WIM header", "9t$(tS", "242c7c20-ff91-57ff-23ab-8a71b37203bd", "b1f69e28-4546-6336-c29c-036e676d75de", "operation not permitted", "CDlpActionFactoryImpl >,class CDlpActionCreateMediaSuccessFactory,class CDlpActionMediaCreationSuccess>::GetActionId", "FVHHX-GFNGX-PJJHM-H6KTM-B4G36", "QRDJF-N7QCC-CCJH4-GBJXD-T6H4M", "ar-TN", "lemedi veya hata d", "7b26c0d4-f56e-394c-4767-8927687d0b57", "::RtlIsLBlobValid(Data)", "nl-NL", "KJ3FR-NJFPH-RMYB4-KVBH7-QPG2M", "it reklamu.%0", "dv-MV", "ProductKey: Product key found in Pid.txt file.", "FFDJH-N7B4Y-V94KY-B7CF8-F3PH7", "102F2\\2", "Bir ba", "CDlpActionImpl > > >::Serialize", "L'installation ne peut pas continuer, car une op", "Das System erf", "YGMXY-HRNYX-HBBVY-MC4YV-9BT42", "vel assistir o Ambiente de Recupera", "FPBG8-NQ6F2-PBG2X-73GBC-KW3XC", "H6G89-NQVMR-V9QDD-BHJPM-8FHCM", "ring ikke kan gjenoppta tidligere startet oppdatering.%0", "Exception", "Microsoft.Windows.49.X19-98867_8wekyb3d8bbwe", "CDlpActionImpl > > >::PrepareRoutine", "MoSetupPlatform: Setting Correlation vector", "Microsoft.Windows.162.X21-43656_8wekyb3d8bbwe", "9 94989<9T9X9\\9`9d9h9l9p9t9x9|9", "hsb-DE", ".?AVCDlpActionAdvertise@@", ";#;8;A;P;l;", "CDlpActionImpl > > >::SetProgress", "Microsoft.Windows.145.X21-83696_8wekyb3d8bbwe", "fbf52a0e-96ad-c3a7-ec57-b2d415f3cdc4", "5%5?5G5S5a5", "0$0(0D0H0d0h0", "4N6B6-2XBB7-38FK2-YVR3C-76F9H", "A rendszer nem felel meg a Windows helyre", "BNG7W-CCTQ9-HP93Q-TJWT7-G6PKM", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual", "B8W89-NFC8F-C782R-6G7HM-39MWW", "4ed7f321-c3d3-a8f1-36e5-eb9fa9d752d2", "InitializeSecurityDescriptor", "b194b4ed-9f26-4fe9-0459-5bf127ea69de", "1e48cc88-9544-aa77-5fdf-1d4b2ff96d57", ":3:Q:b:i:", "Microsoft.Windows.100.X20-29645_8wekyb3d8bbwe", "7f821b6e-fb99-83e6-7c39-8533f6e64b36", "got ledigt diskutrymme kvar.%0", "PackageMigration: Initializing ActionListPath: [%s]", "Microsoft.Windows.101.X19-99540_8wekyb3d8bbwe", ";B > > >::GetActionId", "Failed to add product.", "MediaCompDBPath", "5baed8a6-6b76-cbfc-9b94-fa955a8b5075", "<==S=s=", "Microsoft.Windows.165.X21-06178_8wekyb3d8bbwe", "GetSupportedDriveLetters: Removable drive found [%s]", "QMNY4-DG2PG-X94QM-TXYHM-39QFP", "CDlpActionActivation::CancelRoutine", " la configuration minimale requise pour r", "Description", "F8PXD-G9NM6-YR8FR-6TMYQ-BG9Q6", "Microsoft.Windows.98.X20-29634_8wekyb3d8bbwe", "message_size", "CDlpActionCompat::ExecuteMigChoiceScan", "fe70cf25-dc7f-a412-21e3-0d5ba0627ae3", ">\">B>^>p>", "iu-Cans-CA", "\\EFI\\Microsoft\\Boot\\bootmgfw.efi", "6bf81fb3-1746-02aa-4301-bc2449003d63", "tt.%0", "OneSettingsEnabled", "indigd tijdens het uitvoeren van een actie in de compatibiliteitsfase.%0", "Element", "Microsoft.Windows.126.X21-83274_8wekyb3d8bbwe", ".CRT$XIZ", "STATUS_DISK_FULL", "BootFinalize: Initializing Enterprise Attribution: [%s]", "elem testov", ".?AV?$CZeroInit@VCDlpActionCreateMediaSuccessFactory@@$00@@", "833b999c-4958-6bd4-b220-a59a2d84ff70", "PANTHER_ENABLE_TELASSERT", "pToRemoveFrom->Element != 0", "Kompatibilit", "Microsoft.Windows.48.X20-32147_8wekyb3d8bbwe", "Microsoft.Windows.48.X19-98800_8wekyb3d8bbwe", "73c5cf99-5995-de44-ba16-828f052b1605", "si platform meghat", "9t$Pt", "6O7e7", "O processo de instala", "Microsoft.Windows.4.X19-98703_8wekyb3d8bbwe", "H9VNF-3MFR9-MHFKK-FKHHD-WQPKK", ";5;I;z;", "<- >,>4>h>x>", "o de configura", "SetFilePointerEx", "Microsoft.Windows.101.X19-99534_8wekyb3d8bbwe", "totta a folyamatot, mert a rendszer nem felel meg a Windows helyre", "VWh($", "sk-SK", "sen.%0", "PayloadFileName", "5 6U6", "a676736b-5e20-c7fc-6736-191d34bc8621", ">*?I?o?", "N78Q7-C2CCM-2RPCK-9WHYY-2PR77", "rio recusou os termos de licen", " ke sta", "si folyamat kiszolg", "Not-null check failed: pContents", "CDlpActionProductKeyValidate::DeserializeRoutinePkeyValidate", "StartedFromDownlevel", "CreateProcessW", ":MdSpt", "too many symbolic link levels", " 9w >,class CDlpActionCreateMediaSuccessFactory,class CDlpActionMediaCreationSuccess>::SetActionId", "b35c7b1c-1dd7-c586-caa6-c8e0773daeac", "4!5k5", "ProductKey: Rejecting Key from SkuLib since the Machine is not Active.", "CDlpActionFactoryImpl >,class CDlpActionPreFinalizeFactory,class CDlpActionPreFinalize>::GetActionId", "Microsoft.Windows.101.res-v3260_8wekyb3d8bbwe", "Microsoft.Windows.121.X20-29551_8wekyb3d8bbwe", "ProductKey: Initializing Search locations: [%ld]", "278dabe0-f0c8-bce7-aabd-148006868f9a", "ndigen.%0", "Microsoft.Windows.165.X21-06169_8wekyb3d8bbwe", "o aprova os requisitos de espa", "ringsalternativet.%0", "CDlpActionImpl > > >::ExecuteRoutine", "Compatibility: Resolve Action complete. Notify Task", "CDlpActionImpl > > >::PreInit", "FLT_DENORMAL_OPERAND", "00a30030-f5de-0c9a-9452-440112835780", "ci miejsca na dane do pobrania.%0", "9Kdt_", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNS", "f72e9233-86eb-e460-18e7-8ecdccbd6ac6", "Unstaged Image", "CDlpActionDiskPartition::GetBitLockerFromUI", "CDriverCallback::ValidateDriverPackage: Override answer - migrate this package", "767s7", "imi i", "Microsoft.Windows.126.X21-03403_8wekyb3d8bbwe", "DiskSpaceInstallReq: Initializing SafeOS Image Index: [%d]", "e6286801-6574-9420-2a69-2148558c9f6d", "CDlpActionProductKeyValidate::ExtractDataFromEICfg", "3-3~3", "Microsoft.Windows.99.X20-23528_8wekyb3d8bbwe", "ndaren har valt att avbryta eftersom systemet inte godk", "ljuk a rendszer telep", "4628b519-8008-91e7-ed8c-ee9222261a4e", "d342f4b1-c80a-64d3-fa33-106736148236", "Not-null check failed: fHasAttributes", "647L7c7", "DataMigration: Queue preservation of custom scripts into Target OS...", "Microsoft.Windows.4.res-v3289_8wekyb3d8bbwe", "ProductKey: Product key using host OS edition = [%s].", "t$T+t$", "2KJ8Y-NJ78C-CKMJH-HQ93F-DJ3XC", "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem", " opera", "8 8(80888@8H8T8t8|8", "me n'est pas conforme aux exigences d'espace disque pour t", "MVBNC-DB8WB-96B63-QK44V-WK9F7", "onecore\\base\\xml\\udom_xmlwalker.h", "t$DWh", "LocationHeader->Signature == ('cLdM')", "76WN9-FYMPD-D4D2F-8V3JG-FVXRD", "si folyamatot tesztel", "EventSetInformation", "7Q8i8", "YNF2T-4KM28-YBHHT-FY8FY-DPG4P", "4afcab54-4170-d0c7-7de6-a0f725f16eaf", "tAh 8", "QNVKK-4TW4H-VGPHW-7MPTQ-PYT36", "r annonsering.%0", "Asennusprosessi lopetettiin odottamattomasti.%0", "Loaded hive at BCD%08d", "isvaatimuksia.%0", "ERROR_ALREADY_EXISTS", "Microsoft.Windows.98.X20-29579_8wekyb3d8bbwe", "e93fa8ad-2126-91d0-3ec0-35732ea5f425", "MYQYY-DNY4T-C2FYR-JCHCC-YKQD3", "3T6XG-9ND39-RBXH6-8J9W3-7VCKD", "4>5Q5", "ImpersonationCountInit", "_vsnwprintf", "GetSysVolRefNodePath", "PostUpgradeFreeSpace", "sre haszn", "CDlpActionDU::GetProcArchStr", "isvaatimusten mukainen.%0", "es de compatibilidade protegida n", ";';:;\\;", "2=2N2k2", "9/959X9", "051B1", "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT", "ConstructPartialMsgVW: MALLOC failed", "XR4ND-QXFBP-3GHF8-YFPYH-FJTB8", "64Q9N-WR2KJ-8XXP6-HQGWP-YKHBB", "Nessun pacchetto da scaricare.%0", "XMM3V-NYK4X-V8V44-TGQBV-GCQFM", "Microsoft.Windows.49.X19-99510_8wekyb3d8bbwe", "basebrd.dll", "CDlpActionDiskSpaceReq::PerformSilentCleanup", "ddddb9e2-a8ee-6cab-5414-4480c77e8a69", "D$$4m", "DUImage: Initializing LangPacks Path: [%s]", "BR2Q9-FN6VT-D6JFM-BRCP7-KHJXT", "Systemet best", "QVNHR-WWCDT-72RDW-XDFV6-XQCRT", "re den kj", "3075c661-de02-1c8f-1d48-1369ed2a5bef", "MoSetupPlatform: Calling SetupPlatform::INewSystem::RequestCancelOperations...", "cb23e1f7-bcd4-f79c-4119-73feade9d270", "54a5c4ce-6d11-684b-ce23-b2e93250dc7f", "060w0", "RtlExpandEnvironmentStrings", ":> > > >::Cancel", "n encontr", "0E1s1", ".?AUIDUDownloadProgress@SetupPlatform@@", "eHe}T", "Microsoft.Windows.121.X19-98891_8wekyb3d8bbwe", "DUSetup: Loading Facilitator.dll", "65a4f206-c212-4609-09af-4db1a8ae6057", "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName GetSystemDirectory() failed : Err=%d", "Not-null check failed: NodeList", "5)5l5", "STATUS_NO_MORE_FILES", "Microsoft.Windows.125.X21-83258_8wekyb3d8bbwe", "VNMM9-9DMCX-4FT94-KYDTP-W2Q2V", "fc668f10-9dab-b578-f330-8371daaea691", "Microsoft.Windows.49.X20-29602_8wekyb3d8bbwe", " nejde prov", "VGXTQ-WNTR4-KXCPV-8CM4M-6VJVH", "en-029", "Microsoft.Windows.49.X20-00861_8wekyb3d8bbwe", "sente pas l'espace disque requis pour l'installation de la charge utile.%0", "GetUserDefaultUILanguage", "429dd58f-e149-f248-b552-e43cae3bb514", "CMicrodom", "CDlpActionImpl > > >::PrepareRoutine", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@", "DownloadFileSizeX86", "Aiempaan asennusyritykseen liittyv", "rbare filen GatherOsState.%0", "3&4-4B4I4z4", "text file busy", "8)8X8k8", "\\Device\\%s\\Partition%lu", "BRANDING_REQUIRED_RESOURCEID_MAP", "fe592e76-0d20-7ca1-9f29-b6c101672099", "6%6G6P6V6m6", "serverstandardacor", "edchoz", "La plataforma de instalaci", "80e7d6e1-fe77-a576-3468-ccceb7481653", "MinorVersion", "86B93-BNKGR-8MYM7-V83BD-XHJWD", "ERROR_INTERNAL_ERROR", "MoSetupPlatform: Retrieving default boot entry...", "D$d9C", "Harddisk", "c95f37f7-ef55-757f-b603-81883665b83f", "EncodingSizer != 0", "1bed36be-9029-aad2-1bb3-82e562836936", "2\"2)282?2z2", "ynnist", "Not-null check failed: pUpdateCookie", "Microsoft.Windows.101.X20-24585_8wekyb3d8bbwe", "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X", "08d8c097-34d2-39a8-abfc-63b09d8045e4", "YR229-NB77P-JFKKK-JV8VC-P9XQR", "Uma vers", "Installasjonsprosessen brukes i et testmilj", "xHj1^", "ar-SY", "Microsoft.Windows.98.X19-99584_8wekyb3d8bbwe", "Impossible de cr", "GRFBW-QNDC4-6QBHG-CCK3B-2PR88", " informace o automatizaci byly neplatn", "8GTN9-WP4GG-33HFG-7J66H-4C4CT", "RQWPj", "+ZLY{", "A let", "['`OUL", "f8f888c4-bad1-3079-9e14-6fc0129829d1", "na kontynuowa", "DataMigration: Request skipping OOBE.", "=d>k>", "3QP4N-RC9JQ-XD9MD-7Q647-HXQB9", "Microsoft.Windows.49.X19-98826_8wekyb3d8bbwe", "Compatibility: Hardblock found. InstallReq polling starts...", "shez sz", "668224d2-b0c3-b634-b2c1-b04a7689f3c8", "6DC8J-PBCRB-C3VPW-94H3W-8R8B8", "Havaittiin odottamaton versio asennusymp", "t)h@2", "Microsoft.Windows.99.X20-29695_8wekyb3d8bbwe", "FACILITY_TERMINAL_SERVER", " soubor GatherOsState se nepovedlo prov", "quc-Latn-GT", "Microsoft.Windows.101.X20-25154_8wekyb3d8bbwe", "PackageMigration: skipping GDR packages...", "UpdateMedia: Box download path is [%s]", "Microsoft.Windows.175.X21-41295_8wekyb3d8bbwe", "2!202", "PGGM7-N77TC-KVR98-D82KJ-DGPHV", ":=:i:", "Microsoft.Windows.27.X21-03401_8wekyb3d8bbwe", "5399250b-c74d-1092-c313-35249ccfaeeb", "tuPh0p", "8I8`8", "f2254766-4f44-4cee-1ba9-144752240d5e", "CDlpActionProductKeyValidate::SearchForValidProductKey", "CertVerifyCertificateChainPolicy", "CDlpActionImpl > > >::PrepareRoutine", "4%4=4y4", "ba50230f-c816-781b-89aa-8d1101ec4546", "nika dla wielu architektur.%0", "L'installazione non pu", "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp", "OfferPackage", "ActionListParser::ParseRemovePackage", "NtCreateFile", ".?AV?$CUnknownImpl@VIProductKeyAction@@@@", "4e2169ce-1366-f46d-e29e-25af7dd82cd1", "tta eftersom slutf", "r kompatibilitetsskanningen for ", "ekilde sonland", "8&8-8d8", "230ced95-6f70-0cb1-1c07-d621fc5e9415", "t>9w > > >::CheckUninitialized", "Microsoft.Windows.49.X19-98862_8wekyb3d8bbwe", " byla po", "k a beavatkoz", "DebuggerOptions: Initializing Target: [%c]", "CDlpActionProductKeyValidate::DeserializeRoutineGetEdition", "Kurulumun ilk a", "j+hx~", "d55d4c2b-9488-7f95-b68d-d6373e767a98", "06b08a7b-9e54-ed2a-3ad4-03d3b280c0a4", "RtlAcquireResourceShared", "Microsoft.Windows.101.X20-00898_8wekyb3d8bbwe", "33RR8-NYH78-T8DJ4-PCQK6-CGYK4", "XRW2Y-N9949-GXYBH-KFDJH-94MRK", "Systemet uppfyller inte kraven f", "dceeb57c-911c-7bc6-3d14-eb395d17b01b", "<*<8 > > >::GetActionName", "CompatInstallReq: Initializing Driver Install Path: [%s]", "anie, poniewa", "r nedladdningen av nyttolasten.%0", "CDlpActionImpl > > >::Restart", "FveOpenVolumeW", "Microsoft.Windows.122.X19-98687_8wekyb3d8bbwe", " skanowania zamkni", "function not supported", "CDlpActionImpl > > >::GetResults", "en-AU", "tzt.%0", "FFGDT-8TNGF-QW4D7-367BJ-6MVKD", "L'analyse de compatibilit", "GetProcAddress", "Microsoft.Windows.48.X20-32151_8wekyb3d8bbwe", "5>5I5v5", "5 5@5H5T5t5", "FindClose", "e67a77f9-d990-630b-d7f4-fc8f8e2a3220", "FltCommStubRename", "CMicrodomBuilder::CFourStringIdTable::Initialize", ";GW>s>", "BCryptCreateHash", "Microsoft.Windows.101.X20-24578_8wekyb3d8bbwe", "tirme Arac", "t9h@q", "uGjHW", "851e5deb-4d30-0fa2-f08a-d3b7eccb91e2", "9$939?9\\9c9o9v9", "5c5b12ee-102e-18c1-27b5-ce47f51ec109", "27b17d1d-497a-1933-db83-ce7508961a74", "Microsoft.Windows.99.X19-99573_8wekyb3d8bbwe", "Q3FT7-64NXV-924XG-RBRT2-JB48R", "STATUS_ACCESS_DENIED", "onecore\\base\\xml\\isolib_parser.h", ".?AVIActivationAction@@", "Microsoft.Windows.7.X21-83185_8wekyb3d8bbwe", "_peg0", "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)", "MoSetupPlatform: Releasing SetupAutomation object...", "result out of range", "n bu s", " Microsoft Corporation. Alle rettigheder forbeholdes.", "Microsoft.Windows.136.X20-43107_8wekyb3d8bbwe", "9d929f52-59e3-3939-e85c-a6584b248c13", "f0d76ba3-fa6e-2bee-75cb-465e931697c8", " il sistema non soddisfa i requisiti minimi per il download dell'aggiornamento.%0", "W93uH3", "Microsoft.Windows.99.X19-98664_8wekyb3d8bbwe", "Microsoft.Windows.49.X20-00859_8wekyb3d8bbwe", " demand", "CDlpActionProductKeyValidate::SelectImageFromSkuLib", "CreateMutexW", "MediaBasedUpgradeUsingLocalCompDB", "086b6b71-d38d-26a0-6d76-0081219ba443", "4N96H-6GK4Q-Y6CFF-7XMTD-7VCF6", "Q9N3Y-9RMD7-7BF4J-TY7RG-XP7BB", "1c2df123-57f9-d28e-8fd8-969b5f77f441", "Nie mo", "\\O#]`", ";,;4;<;D;L;T;\\;d;l;t;|;", "Microsoft.Windows.122.X19-98682_8wekyb3d8bbwe", "Microsoft.Windows.125.X21-83256_8wekyb3d8bbwe", "1H2O2s2\"3", "9KdtL", "Microsoft.Windows.48.X21-83178_8wekyb3d8bbwe", "610a4ae6-7b5c-a525-c926-4e7657673d28", "3XFYC-YN792-HV76R-P93XR-MWRBY", " !\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@O", "Se ha encontrado una operaci", "%hs: couldn't get host edition id", "6 686|6", "7&7X7z7", "TX72N-9YCF8-V9382-CT8KG-H8RB4", "2*2K2c2B3^3l3", "Der Benutzer hat den Vorgang abgebrochen, da das System den Compat-Scan f", "Index out of bound.", "85b838e4-661c-ed3e-bcff-31feac8e442b", "standalone", "jH^VR", "ivatel pou", "Il sistema non soddisfa i requisiti minimi per il download dell'aggiornamento.%0", "`1XL0!q", "1b6c72e6-1ef5-057b-660e-3dc31461b355", "ndaren har valt att avbryta eftersom systemet inte uppfyller minimikraven f", "NTFS ", "Azioni base installazione", "01148e89-8414-0a41-73eb-5069a2e2d347", "JVVVS", "T8RV8-G9NDF-P3KYY-6QQB7-94R7V", "ERROR_FAIL_REBOOT_REQUIRED", "GetWebSetupUserInput", "1[1t1", "aad433ae-1674-6860-0467-b23b3bca7876", "Microsoft.Windows.101.X20-35490_8wekyb3d8bbwe", "JGDN9-WKM9H-7RKXC-73PKD-FM49Q", "7C2NP-7MHC9-DD62H-JJQDH-2R4BJ", "EulaFilePath", "too many files open in system", "d4ec72f2-a95d-a6d6-7742-5442843f9efb", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface", "X20-29592;X20-32145", "WriteDataCallback", "Microsoft.Windows.49.X19-98834_8wekyb3d8bbwe", ".?AV?$CZeroInit@VCDlpActionSummaryFactory@@$00@@", "BitLockerMode", "? ?p?", "PostOobeArgs", "45381008-b4ce-e66e-77a8-ed7b52e980f5", "CoTaskMemFree", "tsphase beendet.%0", "isvaatimusten ongelmia ei ratkaistu aikarajaan menness", ".?AV?$CZeroInit@VCDlpWimInfo@@$00@@", "9e22eb3d-cc9e-8968-106c-c1295221f9ea", "fFound", "NotificationUIShown", "SqmOptInDefault", "HQG3W-RVNYW-7MV7T-T6C2M-TXXR2", "Microsoft.Windows.4.X20-46571_8wekyb3d8bbwe", "Failed to generate the compat report [0x%X]", "95:t:~:", "O utilizador optou por cancelar o contrato de licen", "NOTATION", "0(010:0C0L0U0^0g0", "1b73b638-ecf7-bb1d-8741-20fe7647db44", "ServerComputeCluster", ">??w?", "SOFTWARE\\Microsoft\\WindowsUpdate\\CommitStatus", "Microsoft.Windows.27.X21-03400_8wekyb3d8bbwe", "P9NHK-M44VD-96RBX-DGX2F-X2G2C", " Windows", "t-j._f;9u", "MoSetupPlatform: Loading ReAgent module...", ";0;4;L;\\;`;d;l;t;", "e6c69f2e-f45f-c3a9-b6e5-2d3ce248cec1", "6a47536b-b0c7-f78c-b9cf-66cbffbf25c3", "CDlpActionFinalize::SerializeRoutine", "Microsoft.Windows.48.X20-32156_8wekyb3d8bbwe", "6BY82-GNQ24-DMTP3-X9VQD-VXQB9", "7N7s7", "There was no offer found that matches the required criteria.%0", "ae7161e3-580a-e3c9-ca18-2089d55bccec", "Installasjonen kan ikke fortsette fordi en n", "DataMigration: Request skipping ZDP.", "Deleting element %08x blocked by secure boot policy.", ">4>@>`>h>x>", "Microsoft.Windows.180.X21-83668_8wekyb3d8bbwe", "MoSetupPlatform: New installed image should be used for recovery. Setting option to not install a separate PBR image.", "Microsoft.Windows.49.X20-29563_8wekyb3d8bbwe", "setup.exe ", "j YWPS", "Byla zji", "*41;D$TotalCount)", "Microsoft.Windows.126.X21-83268_8wekyb3d8bbwe", "c69c6746-94f4-1b79-2ea0-2c4fd5505e08", "No se pudo ejecutar un script de aciertos o se devolvi", "RestoreFileMetadata: RestoreHardlinks failed", "9FNHH-K3HBT-3W4TD-6383H-6XYWF", "Der Installationsprozess wird in einer Testumgebung verwendet.%0", "4b6a0d5e-4f4c-1a25-7102-f50c0b688f97", "3NFXW-2T27M-2BDW6-4GHRV-68XRX", "JR9RG-GKNM3-GBW8C-X9893-2WF8F", "m limitu smlouvu EULA.%0", "in kullanmad", "ndaren valde att avbryta eftersom enheten inte har tillr", "_^[+P", "2@3G3", ":\":G:]:{:", "o do Windows n", "RtlQueryWnfStateData", "lineen tietojen lataamisen ja purkamisen levytilavaatimuksia.%0", "1(131X1c1~1", "a6881fdf-8268-6915-7206-0b9a38f31430", "8cbc17af-95c5-ce44-21f2-00ef4c6c6330", "Compatibility: GenerateHardwareCompatFile: IDUPackageCollection is empty. Not generating DuHwCompat file.", "\\??\\PhysicalDrive%d", "Sleep", "WTTFN-W2MVP-H2DB9-R7XRD-PYWV3", "52595H5`5w5", "Microsoft.Windows.48.X20-29668_8wekyb3d8bbwe", "Microsoft.Windows.121.X19-98676_8wekyb3d8bbwe", "stes inte innan tidsgr", "*ppObject = State->m_pAllocator->Allocate()", "S$[_^", "RegEnumValueW", "1.4.1", "CDlpActionPackageMigrate::DeserializeRoutine", "SetupCore: Registered DISKSPACE_DOWNLOADREQ action", "R6VGT-8N4QF-CH23Y-D2F22-RVXPG", "Microsoft.Windows.48.X20-23596_8wekyb3d8bbwe", "Microsoft.Windows.122.X19-99471_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-99513_8wekyb3d8bbwe", "D$(P3", "Microsoft.Windows.122.X19-98691_8wekyb3d8bbwe", "TTYX6-G2NDY-H3HRB-MQP77-9BWYQ", "GetTraceEnableLevel", "> >0>4>8>@>D>X>\\>`>d>h>l>p>t>x>|>", "(NewName == 0) || RtlIsLUtf8StringValid(NewName)", "F48BJ-8NX82-MRVY9-PF8BW-HMHY2", "03ab2d81-d02e-e041-f49a-7576176c5d61", ";D$ >,class CDlpActionProductKeyValidateFactory,class CDlpActionProductKeyValidate>::CreateAction", "4HNYR-F9BXF-TC2CH-H7MR8-VH7MQ", "NtQueryInformationFile", "13668f4d-065a-6636-0a9f-9b559c92c8c9", "Failed to allocate process ID buffer.", "SelectedMigChoiceLocation", "#,|6d", "onecore\\base\\servicing\\actionlist\\lib\\cactionlist.cpp", ".CRT$XIA", "NDATA", "1#1)1@1J1P1l1r1R2", "Microsoft.Windows.126.X21-83278_8wekyb3d8bbwe", " Windows ", "o no momento.%0", "tIVS3", "CDlpActionCompat::ExecuteInstallReqScan: Enter", "7586800e-55d1-6c15-5a6a-9aab7d786933", "::RtlIsLUtf8StringValid(String)", "66f15731-250a-1407-0f3d-37dcea5e3a3b", "zh-CN", "Microsoft.Windows.48.X19-99644_8wekyb3d8bbwe", "Microsoft.Windows.98.X20-29638_8wekyb3d8bbwe", "TlsAlloc", "Een foutscript kan niet worden uitgevoerd of heeft een fout geretourneerd.%0", "Failed to coerce string.", " avbryte installasjonsprogrammet for ", "Le processus d", "T7TMJ-6RNKP-Q8VX2-82JT9-KQBPF", "tWSW3", "ActionListGDRPaths", "PackageMigration: No. of FODs to be removed: %d", "G QQVP", "6QGCQ-NDBF6-QVG9Q-4B799-RM47V", "NT9F9-FXQ3D-6VJRX-YBRC3-BG9R2", "VirtualFree", "already_connected", "rfiler uppt", ".?AVIDiskPartitionGetBKeyAction@@", "es-PY", " l'hash di istanza non ", "r dieses System gefunden.%0", "FindFirstFileW", "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]", "e80ad046-7bb0-3318-5c2c-87083cac529a", "Instalace nem", ":1:K:\\:", "1M2`2", ".?AV?$CZeroInit@VCDlpActionFinalizeFactory@@$00@@", "Microsoft.Windows.7.X21-83403_8wekyb3d8bbwe", "08d05996-24c0-88e4-45f8-0fa748f6b4f9", ";D$4uV", "State.m_WalkCursor.IsUtf8()", "AppScanResultPath", ".text$di", "Microsoft.Windows.101.X19-98872_8wekyb3d8bbwe", "strcpy_s", "FindWindowExW", "7Z8|8", "68cde49c-3add-500f-5f8c-2cbe1eb0b109", "82TGN-T7VPQ-RBFRF-WGCP2-RVVX6", "Microsoft.Windows.121.X20-29610_8wekyb3d8bbwe", "Microsoft.Windows.99.X20-29690_8wekyb3d8bbwe", " kalmad", "'", "j3VWh", "F>T>", "16a750f3-e141-f8b4-a55e-846c599fa843", "Microsoft.Windows.122.X20-00861_8wekyb3d8bbwe", "MoSetupPlatform: NewSystem object resurrected!", "FMRXN-7HQ8Q-QGPRR-4QVMG-HFV4F", "c5fe3113-59e7-7853-15d1-bce21b878744", "Failed to query processes. Status: %x", "Microsoft.Windows.121.X19-98889_8wekyb3d8bbwe", "525d2a53-8a70-e416-8541-2cf9bac779e3", ".?AV?$CUnknownImpl@VIFCDiagnostics@@@@", "MediaCreationSuccess: Entering execute.", "az-Latn", "4WX3D-NPGJF-F4X7B-X9PRX-V24CB", " /MediaEdition %s", "5F5K5", "95f000a1-bfce-1d41-a6bc-d6706ab61b91", "W6X2Q-NDHPF-F9PTD-496HM-8FCQK", "9RNQV-3KMXY-9FFM9-WVXYM-88F8R", "se-FI", "Not-null check failed: Out", "t+Qh0N", "H3RNG-8C32Q-Q8FRX-6TDXV-WMBMW", "Microsoft.Windows.8.X21-83706_8wekyb3d8bbwe", "UseDigitalKey", "c42a2c3e-80e6-09fa-0148-71f2ac4157a5", "terst", "Microsoft.Windows.49.X20-46575_8wekyb3d8bbwe", "StorageTiering not supported", "Microsoft.Windows.48.X19-99495_8wekyb3d8bbwe", "pl-PL", "4fe354e4-a03b-d56e-fbc6-ba56b30c084a", "Microsoft.Windows.48.X21-03401_8wekyb3d8bbwe", "CDlpActionDiskPartition::GetResultsRoutine", "X3VPN-YDJDD-VQ3YY-Y23QB-2PQGP", "moh-CA", "kningen f", "PRC3N-RPM29-FF7JV-9V3HK-HCFBG", "@t[9\\$", "Microsoft.Windows.48.X19-99478_8wekyb3d8bbwe", "2df6f31c-18d2-fd0b-267e-a27bd6aab9b6", "VRVD4-J8NQT-D73PB-B8HQD-VXMK4", ":-:G:e:", "nschte Migrationsoption nicht.%0", "3%3=3E3", "r portet kompatiblitetsskanningen til ", "NTHVR-CXRP6-RPHCC-JXW7W-KY9XD", "ProductKey: Matching Install Wim For Compatible Editions", "0n06RP", " zgodno", "Microsoft.Windows.99.X20-00905_8wekyb3d8bbwe", "CDlpResponseImpl > > >::InitializeRoutine", "792C8-N4TPB-JTPKW-BFT8W-J8BTM", "IsEnterpriseGSKU", "%BASE_KN%", "Microsoft.Windows.99.X19-99572_8wekyb3d8bbwe", "HomePremium", "N69G4-B89J2-4G8F4-WWYCC-J464C", "450d145f-1eab-7644-84e1-3b40d2b9a932", "L$d_^[3", "3NJKG-28PB8-XMC64-QHMX2-FYBJT", "ZwEnumerateBootEntries", "J43QF-MNFC2-8YX8Q-H8VKV-94R7Q", "TV9QN-3DF2G-6QBCH-M6DWG-BP222", "Installationsprocessen kr", "MicrodomImplementation::CMicrodom::GetElementsByTagName", "8CNY3-CWY7D-F8MFX-8QKHK-HCD94", "ndelser.%0", "< <,<< > > >::GetState", "serverstorageexpresscore", "Microsoft.Windows.48.X19-99484_8wekyb3d8bbwe", "az-Latn-AZ", "o. %0", "97f94f8f-1743-7135-dd92-5a4e05b8afda", "HKLM\\System\\Setup\\Upgrade", "b3d1f512-384b-1246-5ee8-1a2274e5cbe6", "Microsoft.Windows.101.X20-29682_8wekyb3d8bbwe", "r die Installation des Updates nicht bestanden hat.%0", "ZwOpenSymbolicLinkObject", "N6WXW-FBTF4-T87CB-KXMRC-W2R9H", " gestita per l'installazione dell'aggiornamento.%0", "Microsoft.Windows.99.X20-15862_8wekyb3d8bbwe", "NJ4MX-VQQ7Q-FP3DB-VDGHX-7XM87", "GetWIMBootWIMPathInternal", "D$tHP", "Microsoft.Windows.146.X21-43660_8wekyb3d8bbwe", "N9BYX-9TGXH-XCGG2-GKCR8-BWRBW", "instance ne correspond pas.%0", "CDlpActionImpl > > >::GetActionName", "Microsoft.Windows.99.X20-29721_8wekyb3d8bbwe", "Sonland", "SetupBranchName", "10d2b9a4-ae42-00c8-c3c7-72c65823cd0a", "PreFinalize: Initializing Driver install path: [%s]", "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]", "Microsoft.Windows.48.X20-29663_8wekyb3d8bbwe", "CMicrodomBuilder::ConsumeEntityDecl", "29N8G-XMMD7-8PTV2-6FF7F-TVJ48", "6984817d-beb4-b545-a3e2-8562a0b9956f", "InstallFeature", "re nem.%0", "rios da Plataforma de Configura", "ProgressTotal", "Microsoft.Windows.48.X19-98840_8wekyb3d8bbwe", "Microsoft.Windows.48.X20-35543_8wekyb3d8bbwe", "DMRN9-MH9B4-XYKKF-4C7PK-66RBD", ".idata$2", "5\"6}6", "CDlpActionCompat::ExecuteFinalizeReqScan", "Activation: Error reporting telemetry for bActivationBlockSkipped: [0x%X]", "1I2_2|2", "@\\jdPQ", "7 7$7<7@7X7\\7t7", "de6311aa-794d-62bf-3328-f5476cb92bfc", "2f3m3", "5<5B5\\5v5", "De momento, n", "68dadf84-96cc-028c-fb12-a6fc4fb11a2f", "Opening object %s", "Bugcheck driver downloaded", "Microsoft.Windows.98.X20-29588_8wekyb3d8bbwe", "vel tentar novamente.%0", "ek0B}", "73654780-d0f0-d91e-3a3f-8c9546ef8750", "EditionID", "L'utilisateur a accept", "Microsoft.Windows.100.X19-99455_8wekyb3d8bbwe", "tdjah", "6P7`7\"8)8", "Optional", "Installationsprocessen blev afbrudt.%0", "DiskSpaceReq: Checking disk space req without storage reserves", "6PWN4-9D86H-G47W8-J9VFJ-HMHYG", "PackageMigration: Initializing LXP paths [%ld] [%s]", "3df6c8c1-847a-2fd6-17dd-de1454272f4d", "Die Installation kann nicht fortgesetzt werden, weil eine erforderliche Aufgabe fehlt.%0", "6557c980-c132-299b-1d1a-9572816e4b7b", "res requis n'a ", "business", "El sistema no cumple los requisitos de espacio en disco para descargar la carga.%0", "r enhetsskanningen for ", "919N9k9", "DUSetup: Initializing DU Channels Flag: [0x%X]", "let probl", "9NJCK-3BFY8-TCXGJ-VYPHH-7QWWB", "3PFM8-GN437-GW6KP-FVXXK-YDYM8", "Opening system store. Flags: 0x%x", "PackageMigration: Initializing LXP License Count [%ld]", "FMGHT-G2NBT-7QXYM-GX8BJ-CPQXB", " > > >::CheckUserInterrupt", "gung steht.%0", "ImageFinalize: Initializing Target: [%c]", "cc308cc1-0306-41ce-4f7e-32ac61f571ee", "C(;C$", "Microsoft.Windows.100.X19-99446_8wekyb3d8bbwe", "jlok s", "Microsoft.Windows.4.X19-98714_8wekyb3d8bbwe", "Could not move source file", "a2ce01f8-d348-0edb-b156-0e4547c97a37", "da7bc061-4e48-141c-9f92-8cfff153e2e5", "1E1]1", "Microsoft.Windows.101.X19-99527_8wekyb3d8bbwe", "PayloadType", "D$DPj", "1F1O1T1_1d1", "ProductVersion", "Microsoft.Windows.162.X21-43640_8wekyb3d8bbwe", "CDlpActionDataMigrate::MigrateCustomScripts", "HJWRN-H7DPH-CJDQ9-R487F-JHVYG", "Konfigura", ".?AV?$CSetupObject@VCSetupCore@@VISetupCore@@@@", "0g0W0_0", "o aceitou o EULA dentro do limite de tempo necess", "osan puuttumisen vuoksi.%0", "Microsoft.Windows.165.X21-06176_8wekyb3d8bbwe", "585F5b5", "Microsoft.Windows.188.res-v4363_8wekyb3d8bbwe", "7b551831-c4a3-c878-59c3-09cd4760a6d0", "Tato verze n", "n hajautusarvoa ei l", "Microsoft.Windows.101.X20-29680_8wekyb3d8bbwe", "o pode continuar porque o sistema est", "VirtualAlloc", ";S too long", "BitlockerDeviceAvailable", "CDlpActionImpl > > >::Suspend", " dotycz", "Microsoft.Windows.100.X20-29711_8wekyb3d8bbwe", "Zu)A;", "CDlpActionImageDeploy::GetResultsRoutine", "Success,", "3JMPN-B7BMV-6WHBF-WQT32-6JHWY", "202@2P2`2d2x2", "oikeussopimusta aikarajaan menness", "Actions principales du programme d'installation", "0?0F0", "7MND6-J7F4G-F887Y-99XMG-2373G", "professionalembedded", "0E0f1", "6%7H7", "ccf8b249-28ac-6078-a2bc-170646877213", "zane w wymaganym czasie.%0", "6C3Q3-3NFYH-YYYXW-3TQMJ-WB6GC", "PreFinalize: Initializing FullUpgrade: [%s]", "af-ZA", "6D6{6", "8PCMT-WNMRK-7MF6V-PFHXJ-7FTF8", "ny kivonata nem egyezik.%0", "Microsoft.Windows.125.X21-83243_8wekyb3d8bbwe", "setup.exe", "6N7k7", ".?AUIDriverInstCallback@SetupPlatform@@", "CDlpActionDiskSpaceReqFactory::CreateInstanceRoutine", "67fdad5f-4038-ae22-977d-ee0b74d73881", "CDlpResponseImpl > > >::CheckUninitialized", "Nenhum pacote a ser baixado.%0", "N3TDW-CW7TP-69FJC-RT2WD-QRR9M", "1+2<2i2", "GetSetupPlatformVersion", "O0M0K", "\\StringFileInfo\\%04X%04X\\%s", "WIMCloseWIM", "Microsoft.Windows.48.X20-21798_8wekyb3d8bbwe", "ini do", "ho programu je pr", "De installatie kan niet worden voortgezet omdat er al een voltooibewerking is aangevraagd.%0", "90u69", "0,131:1A1H1O1", "Failed to query boot options. Status: %x", "Microsoft.Windows.49.X20-29591_8wekyb3d8bbwe", "ZwUnloadKey2", "STATUS_DIRECTORY_NOT_EMPTY", "Microsoft.Windows.101.X19-99650_8wekyb3d8bbwe", "The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows.%0", "mn-MN", "HB6YC-3NYTP-3RRW4-HXPPT-683DY", "Automation: Registered Update Media Response", "4f8fe235-b28a-6de9-ff82-600a8e2e46d0", "9DN2B-8B4HC-YFKWM-TCPW9-TF672", "Microsoft.Windows.49.X19-98817_8wekyb3d8bbwe", "2VQHK-NR3BF-H9R4D-RFKRT-8T3D3", "rios de Plataforma de Instala", "Recovery: Offline Language: [%s]", "CDlpActionDiskSpaceReq::DeserializeDownloadReq", " rencontr", "IMAGE", "HKN62-QMXYP-F982Y-KB9Q8-GVKWJ", "Microsoft.Windows.171.X21-24738_8wekyb3d8bbwe", "76WDM-TN9D3-JTBH4-FCR4R-3DDFR", "Deleting boot entry 0x%x", ";G;p;w;~;", "7f1428be-3639-614f-3708-d385dbdf407a", "Microsoft.Windows.49.X21-03402_8wekyb3d8bbwe", "Installationen kan ikke forts", "C6R9P-FVN2Y-MT2GY-M99DK-Y7XRH", "ddffd099-d250-c0f1-a899-5828fe665d99", ">K>n>", "3838C-9YXM9-8X6MC-D7HF2-27QWV", "Den angitte automatiseringsinformasjonen var ugyldig.%0", "GY7H2-PND3J-RDVPM-3WG74-2KDH8", "Microsoft.Windows.48.X20-32153_8wekyb3d8bbwe", "NetGetJoinInformation", "Microsoft.Windows.161.X20-00861_8wekyb3d8bbwe", "777\\7", "QQVWh", " faltando um componente do sistema.%0", "Microsoft.Windows.121.X20-00860_8wekyb3d8bbwe", "CompatFinalizeReq: Initializing Server Image: [%s]", "33878a30-7ac2-fe4d-5103-6ab38d97e553", "ACCESSDENIED-fel p", "='=5=<=C=P=a=e=i=m=q=u=y=}=", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", " el hash de la instancia.%0", "fb2813e2-1f9f-21fd-9692-72fd2736a975", "A Plataforma de Instala", "041404B0", "Recovery", "DiskSpaceInstallReq: Initializing SSU Count [%ld]", "Microsoft.Windows.4.X19-99684_8wekyb3d8bbwe", "Finalize: updated the EnableNarratorOnProgress flag to %d", ";C;I;\\;b;m;t;y;", ":V:x:", "FACILITY_DRIVER_FRAMEWORK", "KKYWJ-2NK8Q-BXBKM-Q886G-HFVWP", "Microsoft.Windows.4.X21-05124_8wekyb3d8bbwe", ">*>1>>>E>M>T>", "3H3|3", ">(>4>@>L>X>d>p>|>", "XYFDK-VNWHK-YWQDB-MTKHY-F9C6K", "99fcefc4-6fdc-3e74-40ca-769c06cc64ad", "Not-null check failed: Blob", "CDlpActionImageDeploy::ResumeRoutine", "Microsoft.Windows.48.X19-99490_8wekyb3d8bbwe", "38b6fb05-2259-ea22-a0d3-2062c8641c16", "Finalize: Error updating the setupplatform on narrator status: [0x%X]", "Microsoft.Windows.161.X21-43630_8wekyb3d8bbwe", "e finaliza", "1cdcc723-b458-5346-a7f4-ee04616c5529", "1*2E2]2", "AssertWithArgs", "sit.%0", "256eca39-c6be-a521-40d7-059073b547cd", "Installasjonaprosessen ble avbrutt.%0", "GetSystemDirectoryW", "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME", "STATUS_INTERNAL_ERROR", "ae26e3d1-adf3-27ae-2551-56de7ffbfd88", ".rsrc$01", "UpdateMedia: Initializing IsServer: [%s]", "9e5e1c13-0e88-d5cd-7b6e-a463a9e1ee22", "CDlpActionImpl > > >::SetParameters", "nyekkel kapcsolatos kompatibilit", "428036db-2760-5fe3-6518-6fc610ab2067", "KCNVV-DVG9M-R93RQ-KVMD4-QGP48", "21728b26-b270-8961-3981-960fa4319074", "7)7>7]7", "j/fzz", "168b880d-693f-de5e-d378-cd7f9072c51b", "a04a7c51-85a7-4750-7de0-b15fee3b1b04", "Microsoft.Windows.100.X19-99435_8wekyb3d8bbwe", "Bekleyen OU geri alma i", "Microsoft.Windows.8.X21-83711_8wekyb3d8bbwe", "fr-CH", " podm", "GeoAvailability", "Operation", " Microsoft Corporation. Alle rechten voorbehouden.", "8PTT6-RNW4C-6V7J2-C2D3X-MHBPB", "8%9P9", "Store %s is the system store", "04f70e48-a7b1-0802-5294-91b45b144f46", "o foi poss", "CDlpActionCompat::GetResultsMigChoice", "sakad", "D$(QQPh", "t. %0", "BiCreateEfiEntry failed %x", "CDlpActionDebuggerOptions::InitializeRoutine", "=V?~?", "Microsoft.Windows.48.res-v3507_8wekyb3d8bbwe", "Microsoft.Windows.162.X21-03403_8wekyb3d8bbwe", "onecore\\base\\xml\\udom_writer.cpp", "5ac8689a-b199-fc56-beed-59768748cc8f", "40474Z4g4", " plik", "5!646N6s6", "Failed to set wof data for file backed by wim file", "Problemet ned nedlastingsplass p", ">)?b?", " warto", "Microsoft.Windows.98.X20-29580_8wekyb3d8bbwe", " faltando uma tarefa obrigat", "Satellite", ".?AVCDlpActionEula@@", "061<1w1}1", ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIProductKeyAction@@@@@@@@@@", "%ARCH_64%", "se-SE", "lama nesnesi olu", "ab500eab-a8e2-ab24-3e95-849ff6109770", "Kapatma blok iletisi olu", "Microsoft.Windows.48.X19-98797_8wekyb3d8bbwe", "PerformSilentCleanup: TriggerStoragePolicies not supported.", "DUSetup: OsBranch: [%s]", "%hs [HRESULT = 0x%08x - %hs]", "Compatibility: Resolve(WICA_DISMISS_ALL_RESOLVE_STRING) returned: [0x%X]", "Microsoft.Windows.172.X21-24719_8wekyb3d8bbwe", "2d1f632b-8b03-0757-00f0-4bc348331c53", "6C6{6", "8982db08-55fb-af98-d239-b573cea09554", "Un script a d", "ratlanul le", "wimgapi.dll", "t:SSSj", "Microsoft.Windows.4.X19-99707_8wekyb3d8bbwe", "Microsoft.Windows.99.X20-00902_8wekyb3d8bbwe", "Il processo di installazione ", "RR77N-QRRM8-KJTGV-HFT8G-BP2KD", "4$4)4", "\\Device", "Plik konfiguracji instalacji jest pusty.%0", "0f7c9d3e-bb2f-f3a4-9398-fd91073192f2", "e7d2e2a7-24ee-40fc-6d4c-6efc6bbb54da", "6BN8P-W446Y-G7BK6-Q34X9-HCFBG", "ration, car le syst", "\\>w,nf", "es-CU", "%hs(%d) tid(%x) %08X %ws", ":M:X:", "ta-IN", "Microsoft.Windows.172.X21-24712_8wekyb3d8bbwe", "6dd2eb3f-8342-02a6-f6a8-23566dbeb748", "2-282e2p2", "5A5H5", "Microsoft.Windows.4.X21-05133_8wekyb3d8bbwe", "Microsoft.Windows.100.X20-35497_8wekyb3d8bbwe", "5!5K5Q5W5]5b5l5", "f228369b-da91-0f01-69f8-5d085b7889de", "Microsoft.Windows.48.X19-98804_8wekyb3d8bbwe", "lls var ogiltig.%0", ".?AVISetupObject@@", "GetFileSystemFlags", "Microsoft.Windows.100.X19-99442_8wekyb3d8bbwe", "cution de l", "Finalize: Error reading narrator reg key: [0x%X]", "TRUST_E_FAIL", "1<2V2`2", "CDlpResponseImpl > > >::Serialize", ", az oper", "zis sor", "uYf9s", "Eula: Eula File Url From Online Store: [%s]", "Finalize: Error reporting real result(ASMV): [0x%X]", "EnterpriseN", "Microsoft.Windows.172.X21-24718_8wekyb3d8bbwe", "KJ6VV-CNFYK-FDHQV-PTJDQ-97Y8G", "68WP7-N2JMW-B676K-WR24Q-9D7YC", "RtlCreateMicrodom", "ti-ER", "Das Installationsimage wurde nicht gefunden.%0", "Source OS: Host SKU Info: Edition = '%s', Edition Type = '%s', Installation Type = '%s', Product Name = '%s', Arch = %s, StationType = %s, Stage type = %s", "rio.%0", "amalar", "Microsoft.Windows.145.X21-43659_8wekyb3d8bbwe", ".?AVCDlpActionProductKeyValidateFactory@@", "CDlpActionDiskSpaceReq::IsDriveLetterSupported", ";>[>w>", "1(1K1_1", "817fa0b9-709b-f42b-7ce6-f54f31fd73fa", "PackageMigration: Removed FODs [%ld] [%s]", "HYVNT-498GD-3FHKT-76HDV-M4G4R", "CDlpActionCompat::GenerateInstallReqCompatReports", "uk-UA", "60646L6\\6l6|6", "8,888X8`8h8t8", "999X9c9", "4\\5k5", "8VN4T-VT6KF-JTTPV-BJMH7-QPFCB", "03b3c0b9-0e93-31b5-e0be-132bd51a1e29", "RegUnLoadKeyW", "d-Nbk", "%s: Leaving Response Execute Method", "CDlpActionFactoryImpl >,class CDlpActionDataMigrateFactory,class CDlpActionDataMigrate>::GetActionId", "26e0dfc6-90c8-82f0-f7d1-483b4de2aa52", "ProductKey: Product key is a default key.", "ZwCreateKey", "=hK2/;", "Microsoft.Windows.121.X21-83178_8wekyb3d8bbwe", "Microsoft.Windows.122.X20-29555_8wekyb3d8bbwe", ">8?N?p?w?", "DiskSpaceInstallReq: Initializing LangPacks Path: [%s]", "0aee978b-6f2d-28fd-a479-01c3435fcaea", "%s\\%s\\%s.mui", "GetFileNodeFromPath", ":A;V;k;", "CRYPT32.dll", "Microsoft.Windows.8.X18-87816_8wekyb3d8bbwe", "o atende aos requisitos para a op", "2!212A2M2S2y2", "Microsoft.Windows.165.res-v3801_8wekyb3d8bbwe", "afafd1dc-7365-5f4b-d5a4-b79a15a12e5b", "fd4c4c82-f219-2a0b-75aa-aa384644d452", "<,<0 > > >::GetProgress", "Microsoft.Windows.48.X21-03402_8wekyb3d8bbwe", "n hajautusarvo ei t", "8X8o8|8", ".?AV?$CZeroInit@VCDlpActionDataMigrate@@$00@@", "CDlpResponseImpl > > >::GetResultsRoutine", "Source.Length >= 2", "FFMT6-KWNBD-K3B3C-JYG4H-B7V2Y", "STATUS_RM_NOT_ACTIVE", "9KKNJ-YRMWP-R7K4K-Y2B94-JHVY6", "DTN2J-TRR4K-QJXC9-84QTV-462RV", "FacilitatorURL", "R27HM-9NV6R-6D9CY-9M3BJ-6MT6P", "professionalsn", "\\\\.\\Z:", "3b7a4b42-6198-a4f4-bda0-88b7edc08395", "GetWebSetupUserInput: Language=[%s]", "5adef52d-8a0d-e0cb-ed3e-5accf1b3234b", "iotenterprises", "adunku by", ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@", "AcquireSRWLockExclusive", "9MdHdt", "es-PA", "startere", "6a25f386-4fd8-97c8-586d-045f353c9413", "Les informations d'automatisation fournies ne sont pas valides.%0", ";#;.;6;@;Q;d;", "BootFinalize: Initializing Mode: [%d]", "CSetupCore::UpdateLoggingPath", "?*?R?h?q?{?", "Microsoft.Windows.8.X21-83685_8wekyb3d8bbwe", "ZwModifyBootEntry", "o iniciada anteriormente.%0", "[%d] %s%s%s%s", "NMB2K-JTQB7-B7GFY-8TXGT-H8T2C", "DiskPartitionDriveLetter", "ec757a4a-42fb-cf80-934f-c62a9911eae9", "Recovery: Offline CompactOS: [%s]", "Microsoft.Windows.162.X21-83176_8wekyb3d8bbwe", "9-9U9p9", "DiskSpaceInstallReq: Initializing PostUpgrade space Max: [%ld]", "Microsoft.Windows.121.res-v3278_8wekyb3d8bbwe", "257cc5b1-238a-a6d0-b86d-a84a8eb253d6", "e hash instance se neshoduje.%0", "HBTND-PFQQ2-6G8VD-CV9XC-MP3JF", "CDlpActionCompat::DeserializeRoutine", "En oprydningshandling fra et tidligere installationsfors", "HK386-DNXKY-J8WX8-DY78C-XTH4F", "CDlpActionFactoryImpl >,class CDlpActionDiskSpaceReqFactory,class CDlpActionDiskSpaceReq>::GetActionId", "Microsoft.Windows.99.X19-99560_8wekyb3d8bbwe", ";F;M;X;", "CDlpActionImpl > > >::Execute", "DecodeChunk", "generic", "u:9N0t", "oikeussopimuksen ehdot.%0", "CDlpActionImpl > > >::CheckUserInterrupt", "ProductKey: Image selection response not found.", "30e66ccf-b124-5ad7-42a6-c29035b43f84", "RtlIsLUtf8StringValid(NamespaceURI)", "vu bloku vypnut", "SLGetProductSkuInformation", "ENTITY", "WIMExtractImagePathAndGetFileHandle", "T$(94", "29b30187-e818-130a-41e0-b469a42632b9", "iu-CA-Latn", ":(:8:<:@:T:X:\\:`:d:h:l:p:t:|:", "SetupBranchHash", "4F5d5", "RaiseException", " on valinnut peruutuksen, koska j", "Automation: Registered PKEY_VALIDATE_AUTOMATION Response", "embeddedautomotive", "6,6H6{6", "RtlStringFromGUID", "Der Installationsprozess wurde angehalten.%0", "totalHits", "NR422-P2BWP-BF987-JHPP2-DDB8Y", "VjdVjd", "0d432f1c-f868-4a56-2edd-eb3ac3492ef2", "G88NP-2HYMW-B4QGH-87K7H-M4HCP", "labilir uyumluluk a", "16a8ce58-328f-4be4-849d-8c9f581f1aa8", "=?=J=v=", "DesktopUpgrade", "PreFinalize: Initiate pre-finalize of downlevel phase", "CheckDiskSpace: Drive [%c] is not BitLocker enabled", "2882fdb4-92a3-8fd3-be25-23e633f7b59c", "6bd79aae-7ffe-7466-9a54-1a5b91843583", "llt die Mindestanforderungen f", "FACILITY_STATE_MANAGEMENT", "Microsoft.Windows.4.X20-29625_8wekyb3d8bbwe", ">.>Q>", "72c0e5a8-ba4a-dfe4-0adc-85a745db260b", "JJ3BH-DN3XW-T2YF7-VMPX3-WQMMY", "ulIndex < UpdateChildNodes.Size()", "o foi terminado durante a fase de compatibilidade acion", "CiXPath", "4\\5i5", "DataMigration: Initializing TrySMode: [%s]", " umow", "0$0+0n0", "r inte att utf", "4TRN3-CJ6MQ-GCYX2-JHVWT-CG3D4", "ReadMetaDataBuffer", "NGD9M-9RKHB-68KVG-2QB8M-HT92K", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet", "*** Source File: %s, line %ld", ">)???", "MoSetupPlatform: Pause already requested.", "CompatFinalizeReq: Initializing BitLockerPremiumAvail: [%s]", "Microsoft.Windows.99.X19-99567_8wekyb3d8bbwe", ";M > > >::Cancel", "o terminou inesperadamente.%0", "5)5~5", "Finalize: Initiate finalize of downlevel phase", "Microsoft.Windows.122.X20-35506_8wekyb3d8bbwe", "809L9S9]9", "3bc06bc5-786b-e3ab-5d16-add8644a867d", "CDlpActionDiskSpaceReq::DeserializeInstallReq", "2D7NQ-3MDXF-9WTDT-X9CCP-CKD8V", "Het installatieproces is niet binnen de gestelde tijdslimiet voltooid.%0", "PreSelectedEdition", "10.0.19041.572 (WinBuild.160101.0800)", "RecoveryImageOption", "::RtlIsLUtf8StringValid(&Sources[i])", "02c57f98-03fa-c96f-e1e1-5888760b2c6d", "d0a44fd8-c2c0-802f-c03c-0d9005c16a3f", "8p8{8", "93899b83-5ade-be4d-8200-9d656bee5c25", "Tel#Sqm", "040604B0", "WFDJK-W9NH6-YYRMD-T3JX8-82QDR", "06a885cd-d7e8-683d-5e14-e2f3f0128b1f", "\\Device\\HarddiskVolume", "DataMigration: Queue telemetry build number into Target OS...", "Microsoft.Windows.50.X18-81308_8wekyb3d8bbwe", "-Tz4q", "address in use", "Es wurde kein Angebot gefunden, das die erforderlichen Kriterien erf", "Microsoft.Windows.100.res-v3276_8wekyb3d8bbwe", "smn-FI", "Microsoft.Windows.4.X19-99701_8wekyb3d8bbwe", "Microsoft.Windows.98.X19-99605_8wekyb3d8bbwe", "a42e3c78-5674-058e-875d-31602909836c", "b971bc34-3057-27b6-a352-6b30a801abf2", "chargement n'ont pas ", ">\">L>r>", "433KJ-8N6G7-6D8FV-XT6KF-2KFFF", "f;D$Pu", "GetWebSetupUserInput: Selected MultiArch = [%s].", "Microsoft.Windows.126.X20-35532_8wekyb3d8bbwe", "Microsoft.Windows.145.X21-83751_8wekyb3d8bbwe", "M7XTQ-FN8P6-TTKYV-9D4CC-J462D", "6:6U6i6", "261019185142Z0", "Microsoft.Windows.4.X20-29627_8wekyb3d8bbwe", "2b2ba0e9-60a6-9886-e374-5b654bc6d77f", "DUImage: Loading Facilitator.dll for latent acquisition", "849MD-N9J4D-282Q4-CVC3Q-RJT37", "ben l", "MicrodomImplementation::DecodeXmlCharacterToUcsChar", "9Y2N2-RF983-M8DXX-QGV6V-KHJX2", "303H3`3x3", "Microsoft.Windows.101.X20-24586_8wekyb3d8bbwe", "ProductKey: Error reporting telemetry for dwFoundLocation: [0x%X]", "J3QFK-NTXB9-VM699-JT2FB-KD72F", ".?AUIGenericProgress@SetupPlatform@@", "onecore\\base\\lstring\\lblob.cpp", "070B0n0y0", "^*g(W", "Failed to add boot entry. Status: %x", "XPNYG-6MVR2-RYPPM-J6CKC-DC69F", "in Kurulum", "Compatibility: No error in scan", "Finalize: Reading Shutdown Value: [%s]", "MoSetupPlatform: Releasing resurrected Setup Platform object!", "Microsoft.Windows.48.X19-98855_8wekyb3d8bbwe", "STATUS_NOT_SAME_DEVICE", "?/?s?", "Microsoft.Windows.98.X20-29585_8wekyb3d8bbwe", "565P5b5", "Not-null check failed: Writer", "Failed to load actionlist from {0}", "QQRNR-MM8WD-X3C43-VWVMD-DV67B", "Microsoft.Windows.126.X21-83265_8wekyb3d8bbwe", "Microsoft.Windows.50.X21-83786_8wekyb3d8bbwe", "Microsoft.Windows.98.X19-99593_8wekyb3d8bbwe", "1 1L1W1|1", "_wcstoi64", " ACCESSDENIED ", "CoreConnectedSingleLanguage", "RWMRW-NQ787-92WMM-HWFJF-MWT33", "ce4e4149-d2c9-a488-7ecd-a235565b889e", "AdVPj", "CAutomationManager::Register", "Microsoft.Windows.122.X19-98692_8wekyb3d8bbwe", "CDlpActionProductKeyValidate::FindMatchingImagesInternal", "vel executar um script de ", "ntar fortfarande p", "File[*]\\Size", "N7XX3-MK2WP-J74DP-4MJK2-BTFFK", "d6d48d40-a33c-45ac-c0fb-9af2e219607f", "Palvelimen vastauksen muoto on virheellinen.%0", "KWG2N-RKXPK-FHHF9-QPFXM-RC3MX", "The user has not accepted Eula within the required time limit.%0", "Microsoft.Windows.8.X21-83712_8wekyb3d8bbwe", "4#42494", "CDlpActionImpl > > >::Deserialize", "lise compacta para instalar a atualiza", "StorageUsage.dll", "5af5cb23-53a1-20e8-802e-f674838c28eb", "pToInsertInto != 0", "TDGXG-2NPXR-4QYG9-PDMVW-6MWYY", "FX6NY-MGFWM-VK6TH-XPMPF-FC3M6", "G62PN-6BKV7-YY39J-YVPG4-W8GPX", "CDlpActionUpdateMedia::DownloadMediaCreationTool", "serverwinfoundation", "849f45d9-36d8-1084-d9ed-1bb7c22e065e", "6%6/696g6q6{6", "o inesperada do cliente do Agente de Atualiza", "757L7S7y7", "Soubory datov", "1 2f2", "$0/0`0k0", "DiskSpaceInstallReq: Initializing SafeOS paths [%ld] [%s]", ";|$Xt", "o foram resolvidas dentro do limite de tempo necess", "Microsoft.Windows.101.X19-99557_8wekyb3d8bbwe", ";A'?B?Z?", "WATSON_MODULE_NAME", "e2d5e4a5-4907-ea6b-d1cf-79bb2913220b", "si felt", ":MdLct", "DUImage: Initializing Wim Ref paths [%ld] [%s]", "53281836-fe1a-c499-3436-267def680542", "DiskPartition: Getting drive letter from Automation.", "Microsoft.Windows.121.X19-98667_8wekyb3d8bbwe", "c81e3f3e-6fb7-17c1-b997-0c109e1692fe", "nea de comandos setup.exe para hacer el examen ", "professionaln", "me et l", "CDlpActionFactoryImpl >,class CDlpActionDebuggerOptionsFactory,class CDlpActionDebuggerOptions>::GetActionId", "o para este sistema.%0", "Directory", ".rdata$zETW2", ".?AVIDlpError@@", ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@", "6NMRW-2C8FM-D24W7-TQWMY-CWH2D", "F6QCD-BNYYR-K7HCJ-X9B34-F6YQG", "Microsoft.Windows.4.X20-35514_8wekyb3d8bbwe", "r van egy kor", "<+=n=", "Konfigurationsfilen ", "Microsoft.Windows.99.X20-29701_8wekyb3d8bbwe", "a8891535-b8dc-d034-3f10-483fb69d3096", "Brukeren har brukt Setup.exe-kommandolinjen for ", "RtlAllocateAndInitializeSid", "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).", "CDlpActionFactoryImpl >,class CDlpActionCompatFactory,class CDlpActionCompat>::SetActionId", "D$$Pm", "93PP7-NJXDM-TPQWM-YJV39-TF6B7", ".?AVIDlpResponse@@", "Kompatibilitetsproblemerne i forbindelse med minimumkravene blev ikke l", "CDlpActionFactoryImpl >,class CDlpActionDiskPartitionFactory,class CDlpActionDiskPartition>::GetActionId", "NodeMap != Windows::Microdom::Rtl::NamedNodeMap::InvalidValue()", "g0M0j0K0c0_0K0", "Microsoft.Windows.8.res-v4304_8wekyb3d8bbwe", "DataMigration: Queue telemetry test id into Target OS...", " gereksinimlerini kar", "9f1d0b61-78e3-3329-5d6f-9b08df4d228c", ";+;A;^;m>s>", "Microsoft.Windows.121.X19-98670_8wekyb3d8bbwe", "f90c0208-dab7-70ce-e865-483bd0983c44", ".?AV?$CZeroInit@VCDlpActionEula@@$00@@", ";&;k;", "Microsoft.Windows.101.X19-99548_8wekyb3d8bbwe", "Finaliz", "STATUS_OBJECT_TYPE_MISMATCH", "Podstawowe akcje Instalatora", "3.373L3S3", "00a335b7-bbf9-3339-d8c0-4dcc163aea2a", "K98BW-7NY2F-XRKVV-VKW8J-33XWJ", "Creating object. Version: %d. Type: 0x%08x", "ad81dc8b-5d43-e5c2-57dc-7dbc36080883", "8FF7X-7NV38-8YXYT-23WH4-CR4BD", "QPWQQQV", "Microsoft.Windows.99.X19-99654_8wekyb3d8bbwe", "d23d1b73-3519-ec43-e066-9eee4ecd6459", "Ett skript kunde inte k", "FACILITY_VIDEO", "VVVVh(", "3J3x3", " on peruuttanut k", "syr-SY", "InitializeRoutine: MOSETUP_ACTION_IMAGE_FINALIZE", "= =,=8=D=P=\\=h=t=", "f2236229-7899-22ca-e2ab-b915400b941e", "o de finaliza", "Die Probleme mit den Mindestanforderungen an die Kompatibilit", "mes d'espace disque d'installation n'ont pas ", "serverstorageworkgroupeval", "242[2", "CDlpActionCompat::Resolve", "Microsoft.Windows.27.X20-35528_8wekyb3d8bbwe", ".?AV?$CMoSetupActionImpl@V?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@@@@@@@", "7>7N7^7}7", "CDlpActionImpl > > >::GetActionId", "0b3e5ef6-8050-abb2-f42b-2920903281af", "Microsoft.Windows.98.X19-99603_8wekyb3d8bbwe", "En rensnings", "c6a32e7e-6811-fdee-d434-24efe0cf68dc", "7aec8726-6a62-2898-2e8b-86a74bbbfc44", "CoreCountrySpecific", "9\\$`t", "Microsoft.Windows.48.res-v3622_8wekyb3d8bbwe", "DMWTN-T4MT3-T4FV6-9RGC2-HH8VT", "Entity.Length != 0", "MoSetupPlatform: LXP packages count doesn't match the licenses count!", "STATUS_DELETE_PENDING", "CDlpResponseAutomation::ExecuteRoutine", " GatherOsState.%0", "8'939>9", "YN9TR-MCTJK-82M3Y-DV7TV-VT9R2", " riprendere l'aggiornamento avviato in precedenza.%0", "W9{HuI", "Target OS: Detected Source Arch = [%s]", "BCryptHashData", "CERT_E_CHAINING", "ProposedExternalDriveLetter", "FX2TT-HGNTQ-2XFKR-FBY67-RGDFQ", "df24871c-03a6-e6b9-f275-e4681e8f772e", "3NBT8-F7YTB-DJQDK-PF3V9-YDWWP", "installation a ", "Aktualnie nie mo", ".?AV?$CZeroInit@VCDlpActionUpdateMediaFactory@@$00@@", "QYNMC-WQFWF-73V68-CG2FH-GCRJC", "Failed to open key for all object's elements. Status: %x", "7fa78efe-5e50-acfa-0241-2a100e5680a5", "res requis n", "4L5V5", "DiskSpace: Space released after install from SP: [%llu] MB", "DataMigration: Queue Request for data file migration", "94a7cd5a-59fd-b56f-d249-d088d81e25a3", "a0409e96-7222-6de6-fba6-494ca0f9fc44", "Microsoft.Windows.98.X19-99581_8wekyb3d8bbwe", "coresystemserver", "yle kar", ", lisans s", "0k0P}", "a82e9877-3637-f060-b2f0-565119f609b8", "wsc:wica:UninstallAllHBApp", "ac6d4e55-b379-d575-7ce1-ba738630c926", "YNMGQ-8RYV3-4PGQ3-C8XTP-7CFBY", "Microsoft.Windows.84.X19-98772_8wekyb3d8bbwe", "Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}", "ben van. ", "8X6NF-4Y9YF-VRGD4-46PJJ-78RW8", "Duplicate install action item or out of memory. KeyForm: {0}, Id {1}", "NW6C2-QMPVW-D7KKK-3GKT6-VCFB2", "Setup360", "CDlpActionCompat::ExecuteDownloadReqScan: Enter", "ActivationIssuesFound", ":d:n:", "a394b096-4dab-c92c-f145-1f122f171d00", "Se encontr", ".?AV?$CUnknownImpl@VICompatAction@@@@", "FMVRD-WNQVD-D6QPB-RT88T-QYH3J", "ba1aeca5-8cd3-78eb-4bed-33b39aa65d7f", "unknown", "DP3NW-RXVQ6-79BFR-VBX83-TCQT8", " una versi", "6-6D6T6Y6", "Geen pakketten om te downloaden.%0", "ExecuteDownloadReq: Error reporting telemetry for szAutoSupportedDriveLetters[dwIndex]: [0x%X]", "CMicrodomBuilder::ConstructAndWriteMicrodom", "2 2R2]2", "1<2C2Q2", "KM4GN-DQFRK-DXYDC-MVWPX-PBBM4", "5Z5d5n5x5", "Microsoft.Windows.121.X20-35463_8wekyb3d8bbwe", " stato terminato.%0", "Microsoft.Windows.125.X21-83177_8wekyb3d8bbwe", ";X;_;t;", "tta installationen", "6V2XT-NYHDP-FX4G6-B663R-X2G4D", "R7MNG-P4B9K-YGFXV-9G7WY-PR48J", "ltunk let", "ndirme i", "ProductKeyInfoSet", "8 9p9", "1U1e2", "CDlpActionFactoryImpl >,class CDlpActionProductKeyValidateFactory,class CDlpActionProductKeyValidate>::SetActionId", "leg elkezdett friss", "RtlAddAccessAllowedAceEx", "3-333b3k3", "SetupDiGetClassDevsW", "_initterm", "5b6ea02c-eb57-53da-37b2-185361e04b70", "R24N9-QH8VH-WQ3Y7-QY7K2-8XCKT", "4N7JM-H4DHH-RHQ9M-TT9VP-KW3XD", "5.6F6g6", "SystemManufacturer", "8e33394a-8663-7aa9-db98-c627f730a56e", "3c3k3{3~4", "Microsoft.Windows.126.X21-83264_8wekyb3d8bbwe", "IoTEnterprise", "9L$(s", "1$1T1", "Installationsprocessen blev stoppet midlertidigt.%0", ">2>a>", "ovat v instalaci.", "BMNYP-GKTD4-PPFJB-CYK6V-462RK", "PreFinalize: Initializing OnlineRollback Arguments Sys: [%s]", ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceAction@@@@@@@@@@", "9,90949L9P9h9l9", "serverrdsh", "gameos", "4'41474Q4}4", "oK0D$\"<", "7J8t8", "N7HMH-MK36Q-M4X93-76KQ2-6JHWR", ".rdata$brc", "Microsoft.Windows.146.X21-83755_8wekyb3d8bbwe", "d ACCESSDENIED. Mo", "CMicrodomBuilder::GetXmlDomSize", "MX7FN-8KYH2-834Q4-V3YBY-92F8D", " istenen s", "Er is een onverwachte versie van de Update Agent-client aangetroffen.%0", "DCYNY-GFW6C-28PR9-HXVQR-JHV3P", "SYSTEM\\Setup\\SetupWatson", "Microsoft.Windows.130.X20-35521_8wekyb3d8bbwe", "%s: Entering Prepare Method", "ERROR_INSUFFICIENT_BUFFER", "fwprintf", "BCryptFinishHash", "Microsoft.Windows.49.res-v3318_8wekyb3d8bbwe", "\\Boot\\BCD", "313G3", "T9NFT-HQJ3J-YXFJ8-977DX-WT2M2", "Microsoft.Windows.126.X21-83177_8wekyb3d8bbwe", "22ea551d-3b87-c22e-aefb-64144b647012", "<,=\\=", "t wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0", "Fant ventende OS-tilbakerullingsoperasjon.%0", "nyeket.%0", "TNRHX-C7XKY-TXB6F-WWK42-BTDXC", "RtlAppendLBlobToLBlob", "::CreateTearoff", "ProductKey: Matched %s with %s", "Microsoft.Windows.4.X20-29623_8wekyb3d8bbwe", "Microsoft.Windows.146.res-v4317_8wekyb3d8bbwe", "Installationsprocessen avbr", "03080Z0s0", "Nie odnaleziono obrazu instalacji.%0", "9/959H9`9", "GetWebSetupUserInput: Entering execute.", "Microsoft.Windows.27.X20-00861_8wekyb3d8bbwe", "&", "\\\\?\\GLOBALROOT", "Det g", "ProductKey: Initializing Wim Ref Count [%ld]", "professionalcountryspecific", "1X1_1z1", "Systemet inte klarar kompatibilitetskontrollen f", "80979K9R9n9", "DiskSpaceInstallReq: Initializing Critical Path: [%s]", "Asennusta ei voi jatkaa, koska viimeistelytoiminto ei pysty jatkamaan aiemmin aloitettua p", "io error", "StorageReserveFlagForDownload", "313H3d3", "embedded", "DataOnly_FailForward", " grund av att en systemkomponent saknas.%0", "GH37Y-TNG7X-PP2TK-CMRMT-D3WV4", "CDlpActionCompat::SerializeInstallReqScan", "ResAddFromFileAndHandle", "CDlpActionProductKeyValidate::InitializePkeyValidateRoutine", "EventWrite", "ActionListParser::ParseDownloads", "Microsoft.Windows.8.X21-83716_8wekyb3d8bbwe", "Microsoft.Windows.188.X21-99374_8wekyb3d8bbwe", "3#4.4<4V4t4", "4CBNB-73RKJ-VD7YH-H4J6C-9P677", "The user has chosen to cancel because the system does not pass the gated compat scan to install the update.%0", "rio optou por cancelar porque o dispositivo n", "sources\\unattend.xml", "ERROR_SXS_IDENTITIES_DIFFERENT", "121u1", "J8KYN-XVH8C-MC8HD-RWRKJ-7FTPY", "wcscpy_s", "CDlpActionImpl > > >::DeserializeRoutine", "FirmwareVariable", "Locals.Allocate()", "2I2|2", "Q@Phh", "D$(PW", ".?AVCDlpActionImageDeploy@@", "GetSystemTimeAsFileTime", "memset", "4,5?5F5T5", "Ta wersja narz", "b72a0ac2-8708-194b-eef9-90dd1c565954", "protocol_not_supported", "829366b3-0f0b-eea4-738f-826ff1d5aa60", "DG2GN-G3Y26-6VH26-F7JVP-9QDGQ", "RN6T7-3GV49-43DQJ-89RQM-MY49M", "RN8J9-272YP-DX3XR-Y798C-XTP3R", "Microsoft.Windows.162.X21-43650_8wekyb3d8bbwe", "O ID do Piloto est", "operation canceled", "DependsOn", "d3ef5910-53ee-e11d-070e-23a7b12691eb", "<6=b=", "WXHTN-3Y3RJ-BWP6P-TGBDQ-9778G", "o atende aos requisitos de espa", " per i requisiti minimi non sono stati risolti entro il limite di tempo richiesto.%0", "Bugcheck module", "PKeyLocation", "Microsoft.Windows.100.X20-39263_8wekyb3d8bbwe", "5,5a5", "4FNRT-B4VXV-JCWDT-TTRVQ-DV66Q", "CDlpActionGetWebSetupUserInput::DeserializeRoutine", "Problemy z miejscem na dysku przeznaczonym na pobierane dane nie zosta", "Microsoft.Windows.49.X20-00860_8wekyb3d8bbwe", "Q27W6-FJBV9-4DFRT-N9WV8-RX8XH", "DUSetup: Initializing DU Sandbox Path: [%s]", "Found pending OS rollback operation.%0", ";b;m;", "6,6L6r6", "NodeIndex < m_pTargetObject->m_LayoutCache.TotalObjectCount()", "#0<0Q0X0k0", "Compatibility: No MigXml present", "Microsoft.Windows.122.X19-98839_8wekyb3d8bbwe", "ExternalDriveLetter", "Ett f", "Microsoft.Windows.98.X19-99660_8wekyb3d8bbwe", "VerifyFileByHandle", "Microsoft.Windows.99.X20-39252_8wekyb3d8bbwe", "no link", "2PNKX-78KYP-B24X8-BQYF6-9KXRV", "85361d4f-a9b5-bbb7-3274-a10ae7eb35f5", "CompatFinalizeReq: Initializing BitLockerDevEncrAvail: [%s]", "CFN49-BR4B6-9KCJK-KVY6X-FRG6G", "6RDKC-FNJ4G-FV3F9-WXVYF-844BK", "digt.%0", "lisis de compatibilidad para la instalaci", "Microsoft.Windows.147.X21-83759_8wekyb3d8bbwe", "BiBindEfiNamespaceObjects failed %x", "ND8Y2-Y3FKK-6Q7FJ-9WXGM-KD9TM", "CDlpActionCompat::ExecuteDownloadReqScan: Exit", "FNW8H-JCWQD-CJM8H-BR4F3-RJTB2", "1(1/161", "Target Image: Version = [%d.%d.%d.0]", "fa72d556-3042-7edd-f7a5-dbe7034a2ab0", "Yhteensopivuusraporttia ei voi n", "CDlpActionProductKeyValidate::SearchForKeyInDigitalMarker", "ProductKey: Failed to report Host OS channel to telemetry.", "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de compatibiliteitsscan voor het installeren van de update.%0", " >,class CDlpActionPreFinalizeFactory,class CDlpActionPreFinalize>::CreateAction", "te9w:E:", "06acf7a6-2c14-c6bc-072c-151b081ec62e", "ReportId", "GetSecurityDescriptorGroup", "4221964b-ff44-21a6-7547-18f585697257", " soubor instala", "Microsoft.Windows.48.X20-32154_8wekyb3d8bbwe", "6\"6N6Y6j6q6|6", "bec6c6fc-48fd-1ea8-c79a-bdeed95e0359", " Operativsystem", "> >=>d>", ";](s?", "CheckDiskSpace: Error reporting telemetry for OSPARTITION_TOTALSPACE: [0x%X]", "1fa5dd31-9b26-a520-ccef-15e1774f773d", "D$8G;}", "08ce069e-0ef4-bdaa-8abd-99d5ea08eebb", "dffd9550-f456-9101-a8e6-7603f72504b4", "Microsoft.Windows.50.X21-83781_8wekyb3d8bbwe", "BcdOpenSystemStore: Failed to acquire BCD sync mutant.Status: %x", "Volume:MAK", "s folytat", "GetPrivateProfileStringW", "Target OS: Product Name = [%s]", "MNXKQ-WY2CT-JWBJ2-T68TQ-YBH2V", "DiskSpaceInstallReq: Initializing GDR Path: [%s]", "SkipOobe", "ImageBasedPBR", "Microsoft.Windows.49.X19-99511_8wekyb3d8bbwe", "XmlParserGenerator::ReportError", "526K6", "191023231914Z", "65725c92-d1d4-31e6-cc5a-146e7db75754", " Microsoft Corporation. All rights reserved.", "CompatInstallReq: Initializing Wim Ref Count: [%ld]", "o requer que o usu", "DUSetup: DCAT offer not found", "4 4$4(404H4L4d4t4x4", "6$7X788q8", "Microsoft.Windows.98.X19-99588_8wekyb3d8bbwe", "$ProgData", "CDlpActionImageDeploy::PopulateImageInfo", "The compatibility report cannot be displayed due to a missing system component.%0", "Microsoft.Windows.49.X19-98816_8wekyb3d8bbwe", "Compatibility: Cancel was requested", "eb1efc76-f01c-3070-3896-1dab30d8eba9", "ndigungen zu stornieren.%0", "ration de restauration de syst", "666@6F6Y6", "NH9MT-6368J-TT4XY-4BGCW-9TPHF", "03868fdd-7c34-2e36-4aad-eb30efb04cee", "Microsoft.Windows.48.res-v3310_8wekyb3d8bbwe", "2\"2*2=2m2", "6K3GQ-N2KF9-84J97-K4FVC-YKMPF", "3ef3be69-5ace-63f7-85c8-325a50883566", "KQNHM-C2RTJ-Q6JJY-M483Y-39PJP", "enterprisesubscription", ";GInputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)", "Microsoft.Windows.7.X21-83402_8wekyb3d8bbwe", "D6RD9-D4N8T-RT9QX-YW6YT-FCWWJ", "Microsoft.Windows.48.X20-29658_8wekyb3d8bbwe", "5Qh\\`", "DUImage: Initializing Wim Ref Count [%ld]", "ProductKey: Using existing image selection response (product key unchanged).", "8f590583-3540-a68a-810f-fd08f54da7d3", "Action", "TYNHW-PQ6GK-6T847-DCJQW-YP2KG", "def2e685-e537-f9b4-bdce-0acfde233b17", "Microsoft.Windows.96.X99-99999_8wekyb3d8bbwe", "adavky pro po", "n ett tidigare installationsf", "7-7i7", "Y7YJC-NKRQ6-D3VPG-GTX96-KTP2V", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceAction@@@@@@", "Microsoft.Windows.7.X17-36798_8wekyb3d8bbwe", "coresinglelanguage", "Finalize: Error reading Update and Shutdown Value: [0x%X]. Using default value of [%s]", "Microsoft.Windows.100.X19-99448_8wekyb3d8bbwe", "RtlFreeUnicodeString", "SPMinorVersion", " EULA", "LangPack", "El entorno de recuperaci", "CDlpActionPreFinalize::PauseRoutine", "Eine neuere Version von Setup wird gestartet, um die Installation fortzusetzen.", "091e1p1", "SourceEdition", "Stato dell'installazione del server non disponibile.%0", " raportu zgodno", "b975d5e5-09ad-77f9-b55f-b7343fe3a60f", "n por parte del usuario.%0", "Microsoft.Windows.7.X21-83411_8wekyb3d8bbwe", "YNDMB-2QCFC-HTFBP-JF9HC-FX849", "=!>W?k?x?", "7(757@7K7k7", "Microsoft.Windows.4.X19-98706_8wekyb3d8bbwe", "db45ec72-7adf-a2fe-9e45-d8e06e801ce1", ";E;[;a;y;", "<4=>=T=Z=", "GenerateGenuineTicket", ">+>T>p>", "4O5V5\\5u5", "klemek i", "MigChoice: Initializing Target Edition Id: [%s]", "Target OS: Detected Source Edition = [%s]", "Microsoft.Windows.101.X20-35486_8wekyb3d8bbwe", "(ulElementType == (0x2)) || (ulElementType == (0x3)) || (ulElementType == (0x5)) || (ulElementType == (0x1)) || (ulElementType == (0x6)) || (ulElementType == (0x7)) || (ulElementType == (0x4))", "24RGN-K2YXT-Y4QB2-4Y29V-94PMD", "Microsoft.Windows.27.X19-98761_8wekyb3d8bbwe", "a4b5462c-7dff-e15d-8e9a-e5a0ab9f18f9", "Microsoft.Windows.99.X20-39249_8wekyb3d8bbwe", "BuildInfo", "CDlpActionDiskSpaceReq::CallTriggerStoragePolicies", "6=6\\6", "545m5", "cd05a480-e384-ca4b-9986-96e8ea0094e6", "4!4+424C4J4n4", "JQ6CR-JNV8R-J6VFC-YR39V-G6PHF", "NtEnumerateBootEntries", "The GatherOsState executable has invalid signature.%0", "<0!?C?R?_?", "DataMigration: This is a data-only migration. Attempt to acquire locale info", " opakov", "X19-99485;X19-99482;X19-99498;X19-99499;X19-99508;X19-99520;X20-30039;X20-30040;X20-30049;X20-30047;X20-30050;X20-30053;X20-30051;X20-30052;X20-36699;X20-36700;X20-36702;X20-36701;X20-36693;X20-36696;X18-15587;X18-15584;X18-95491;X18-95458;X18-15577;X18-15575;X18-95498;X18-95466", "il v po", "e65a144b-b2ea-bedb-08df-b3c92450205c", "3c88328a-7c1e-aa8a-72e7-edca5665b405", "<+<;ulTotalSize == m_MicrodomDataBlob.Length", "8+8V8]8", "2d88564b-e4b1-86b2-7ae6-b0b81cd5bdba", "Il sistema non soddisfa i requisiti di spazio su disco per l'installazione del payload.%0", ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@", "#document", "MoSetupPlatform: Failed to enable ETL tracing. [0x%x]", "Voor het installatieproces is vereist dat de gebruiker akkoord gaat met de gebruiksrechtovereenkomst.%0", "o encontrada. Verifique o conte", "Kullan", "Target Image: Edition = [%s]", "vel localizar uma letra de unidade de destino. %0", "o pretendida.%0", "9#9|9", "jnhP|", "H74JJ-7FNDK-FKBT6-RF7XD-YBH3B", "Microsoft.Windows.8.X18-81312_8wekyb3d8bbwe", "CDlpActionDiskSpaceReq::GetResultsInstallReq", "r valt migreringsalternativ.%0", " nur zum Scannen und nicht zur Installation des Betriebssystems verwendet.%0", "cfa33a25-3505-dd6f-4a09-c92b7c09edee", "CMicrodomBuilder::InsertDefaultAttributes", " prov", "QQQQj", "tFWj;P", "=&=5=;=", "Microsoft.Windows.98.X19-99598_8wekyb3d8bbwe", "VHJVF-HYNDP-F99W3-V7M4F-K4R7T", "2,2024282@2X2h2x2|2", "CDlpActionImpl > > >::GetState", "4354ba24-4d71-5345-f92c-1d58e54349f1", "NtQueryInformationProcess", "9!:(:{:", "7c3d1878-6d96-4688-59e4-87f64c5cb5d3", "DHWP9-NWWKH-G72RJ-CQ49T-P7JXM", "WjdWjd", "Microsoft.Windows.99.X20-35493_8wekyb3d8bbwe", "Det oppstod en feil, og resultatverdien m", "RegCreateKeyExW", "STATUS_DUPLICATE_NAME", "vede kriterier.%0", "cych instalacji aktualizacji, a u", "Microsoft.Windows.175.X21-41300_8wekyb3d8bbwe", "ff8eda5f-d166-a8c8-05ad-8b37de17574f", "Ein fehlerhaftes Skript konnte nicht ausgef", "Microsoft.Windows.22.X18-81294_8wekyb3d8bbwe", "UpdateMedia: Scenario not supported for media update", "9t$8tJ", "n previa o se devolvi", "B4CRN-GXQVV-79THX-9QYVB-DPFTR", "DUImage: Searching for LangPack updates...", "CDlpResponseAutomation::InitializeRoutineDiskPartition", "De gebruiker heeft ervoor gekozen om te annuleren voor de advertentie.%0", "o. Verifique o conte", "425f5", "101Q1", "Microsoft.Windows.101.X19-99546_8wekyb3d8bbwe", "The installation process was launched with an unknown command line argument.%0", "Y9YPN-6X7VH-HD3JW-T8V6P-DDBPC", "7N6PP-MYR7R-YMPX3-K3B7W-WB6P4", "<@ > > >::PreInit", "Microsoft.Windows.50.res-v4330_8wekyb3d8bbwe", "CFCPayloadDUCallback: OnProgressChanged [%d]", "222M2g2x2", ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@@@@@", "RtlRegisterFeatureConfigurationChangeNotification", ".?AVCDlpActionRecoveryFactory@@", "f5712222-d93a-8d77-6019-b6ffaf0cc828", ":9>G>", "Microsoft.Windows.122.X19-98690_8wekyb3d8bbwe", "network reset", "CDlpActionSummary::DeserializeRoutine", "60b1e949-cd25-347a-dc12-87c24cc0991e", "El sistema no ha aprobado el an", "3 383<3T3d3h3l3", "CDlpActionUpdateMedia::InitializeRoutine", "Brugeren har valgt at annullere, fordi systemet ikke opfylder kravene i enhedsscanningen til installation af opdateringen.%0", "<%<, >,class CDlpActionDiskPartitionFactory,class CDlpActionDiskPartition>::CreateAction", "847K2-NHK4Y-J48Y9-MK8GD-TCQPP", "NWQBX-QDCCJ-GWWXV-H8J9T-FVVYG", "Ein Vorinstallationsskript konnte nicht ausgef", "compresser le support multi-architecture. %0", "t(j\\W", "72734d2e-d8e0-741e-9d49-ea4857ad0b62", "DMXJN-DCCMP-MKYJT-44W9W-TQ73D", "SetupCore: Registered DU_SETUP action", "si lemezter", "Target OS: Feature -> [%s]", "CDlpActionProductKeyValidate::SelectImageFromResponse", "homepremiume", "NtOpenFile", "fr-029", ": :,:8:D:P:\\:h:t:", "Microsoft.Windows.99.X20-00907_8wekyb3d8bbwe", "homebasic", "Proces instalacji zosta", "4Z5p5", ":w:~:6;=;", "\\imagehlp.dll", "1$101;1X1", "owe.%0", "D$ 9D$", "file corrupted in block at offset %p", "CP7V3-KFC9F-DBV2R-TVHBW-4P9GM", "El usuario rechaz", "24282P2`2d2l2p2t2x2", "Failed to find a key to load store %s. Last attempted key: %ws", "ResNodesSort", "400f4a5e-0e8d-1c2a-b565-46668a21627c", "serverstandardcor", "b-Nbk", "Aby kontynuowa", "PerformSilentCleanup: Performing silent disk cleanup.", "T)R(uq}", "Microsoft.Windows.100.X20-00904_8wekyb3d8bbwe", ":a:q:}:", "hi-IN", "nkami se nevy", "ProductKey: EI.cfg file contained an edition Id.", "ivityksen asentamisen v", "nimos no se resolvieron en el plazo requerido.%0", "SystemLanguage", "SetupCore: Registered SUMMARY action", "Microsoft.Windows.121.X20-35502_8wekyb3d8bbwe", "ste startas om.%0", "r att beh", "GGR2P-Y9NDD-K8WGP-FCTBP-W2R42", "HMNXT-HFMD2-KGXHP-JVCJR-FC2R8", "es-MX", "Microsoft.Windows.48.X20-23597_8wekyb3d8bbwe", "7D7N7X7b7l7", "l dostat upozorn", "ReadWimHeader", "PerformSilentCleanup: Failed to call PerformCleanupTask", "Tel#Asmv", ";01D1i1p1v1", "NewEntityDecl = this->AllocateStreamObject()", "PWWWWWWS", "8o8|8", "5&6A6i6", "Microsoft.Windows.48.X20-23649_8wekyb3d8bbwe", "647v7", "zu-ZA", "d\\OL0~0`0", "o pode continuar porque a finaliza", ".?AUICompatibilityDataProvider@Compatibility@ConX@@", "6MFNB-H2K7D-8QCBM-DGB8V-R9CKT", "CheckDiskSpace: Error reporting telemetry for EXT_DRIVE_REQUIREDSPACE: [0x%X]", "4%464?4K4k4r4", "GetSupportedDriveLetters: Drive [%c] bIsHotPluggable = [%s]", "Microsoft.Windows.161.X20-00859_8wekyb3d8bbwe", "tapes initiales de Configuration - Nouvelle tentative possible.%0", "DiskSpaceInstallReq: Initializing GDR Count [%ld]", ",SVW3", ".xdata$x", "5X5_5", "Det gick inte att k", "tirilmesi gerekiyor.%0", "ca3cca74-75e9-d541-0a0e-424ffff27dc4", "Microsoft.Windows.122.X19-98685_8wekyb3d8bbwe", "Microsoft.Windows.125.X20-00859_8wekyb3d8bbwe", "OnlineRollbackArgsSys", "pu instalacji jest niedost", "Microsoft.Windows.8.X21-83698_8wekyb3d8bbwe", "dtak meg a sz", ">1>E>", "%CLIENT_K%", "CDlpActionImpl > > >::GetActionName", "enterpriseneval", "MR7Y6-N3FX9-M269R-BK6WH-6XRW6", "The installation process was terminated during the actionable compatibility phase.%0", "Sistem, Windows kurtarmak i", "invalid argument", "N6PP2-2BMR3-8CBJ4-7JFWD-9D73M", "PreSelectedArch", "3KHY7-WNT83-DGQKR-F7HPR-844BM", "Microsoft.Windows.8.X17-36778_8wekyb3d8bbwe", "NJ699-4WWMC-39RH9-TXD7J-QDBW2", "24c37526-ebf5-e6af-4cbb-ad62c47d8133", "ddf6b4eb-bb04-f6fd-c062-05d5b399c722", "rio optou por cancelar porque o sistema n", "0(0,0004080<0D0\\0`0x0", "Microsoft.Windows.101.X20-36691_8wekyb3d8bbwe", "9A:H:x:", "ja-JP", "Microsoft.Windows.100.res-v3275_8wekyb3d8bbwe", "2d2d0114-d610-577b-4069-16f661c4ccee", "inden iptal etmeyi se", "DUImage: OsArchitecture: [%s]", "184460aa-9ca8-057e-fde0-30ddc3131ec5", "o especificado.%0", "CDlpActionCompat::GetResultsGated", "Microsoft.Windows.8.X21-83687_8wekyb3d8bbwe", "ExecuteInstallReq: Error reporting telemetry for szAutoSupportedDriveLetters[dwIndex]: [0x%X]", "QDTCN-F22MP-3FPD9-XY3VD-97639", "a544d16e-8932-9395-89a6-69c5a6fea205", "f806a9f8-7645-ed31-212a-bb7527f467b3", "RtlLengthSid", "7RNMY-8K82B-FCX9M-PBM6M-88F8P", "9s8uh", "Microsoft.Windows.99.X19-99652_8wekyb3d8bbwe", "Microsoft.Windows.101.X20-29691_8wekyb3d8bbwe", "Server Core", "ufhLE", "7G7b7}7", "CDlpActionGetWebSetupUserInput::SerializeRoutine", "=(=,=<=@=P=T=l=|=", "El usuario ha usado la l", "CDlpActionImpl > > >::Suspend", "RtlWriteMicrodomXml", "PrivacyConsentStatus", "Microsoft.Windows.121.X19-98890_8wekyb3d8bbwe", "Microsoft.Windows.49.X20-39273_8wekyb3d8bbwe", "DataMigration: Failed to read Reserve Manager Active Scenario Key Hr=[0x%X].", ".?AV?$CMoSetupPlatformT@V?$CUnknownImpl@UIUnknown@@@@@@", "a2c43d41-2c69-5bbd-6201-7e6966c03320", "Microsoft.Windows.99.X20-29694_8wekyb3d8bbwe", "<,<4<@<`'?I?", "Target OS: Detected Source Version = [%s]", "Et feilskript kan ikke kj", "befb80d8-d96f-5cd6-b7a0-09c1bc9e8002", "no message", "2(3S3", "NetApiBufferFree", "Microsoft.Windows.27.X21-83178_8wekyb3d8bbwe", "=A=N=", "RtlCopyLUtf8StringToLUnicodeString", "Hiba t", "0-0F0[0Y1", "Microsoft.Windows.4.X21-03401_8wekyb3d8bbwe", "%Microsoft Windows Production PCA 2011", ":$:+:8:?:F:", "DiskSpaceInstallReq: Initializing SafeOS Count [%ld]", "1 1(1A1F1N1V1^1f1~1", "8FD96-KNCQ6-M26FY-T38CP-Q3XC3", "o de revers", "4C5h5", "SerialPort", "1127ca49-468c-b5ec-08ab-8efb30b6c9f9", "11181{1", "QSVWj\\", "CDlpActionImpl > > >::PrepareRoutine", "TargetEdition", "Microsoft.Windows.165.X21-04956_8wekyb3d8bbwe", "8$808<8H8T8`8l8x8", "SetupVersionBuildNumber", "4/4k4", "SPMajorVersion", ".text$x", "\\EFI\\Microsoft\\Boot\\BCD", "0a39b7c1-0dd4-b12e-414d-6d4f6b4223a0", "10151404-158e-9a2b-2e26-7629d05547eb", "Microsoft.Windows.48.X20-29670_8wekyb3d8bbwe", "4'404=4F4c4m4", "Installasjonen kan ikke fortsette fordi det ikke er nok diskplass p", "CDlpActionCompat::ExecuteInstallReqScan: Exit", "CDlpActionDiskPartition::InitializeRoutine", "setupcomplete.cmd", ":;;Y;h;", "H4MND-KF7J8-PWBTV-2P3JG-BP4FC", "Microsoft.Windows.7.X17-36795_8wekyb3d8bbwe", "L$L_^[3", "tk-TM", "NY48Y-K9DDM-VT896-8VW3H-6X2JT", "DeletePath: [%s] doesn't exist as a directory; nothing to delete.", "XMW6N-FC76F-HMK9T-MW3W6-WXCJP", "Failed to shred identity.", "enterprisegn", "adnika systemu.%0", "m minim", "installation, car une t", "Microsoft.Windows.189.res-v4368_8wekyb3d8bbwe", "7C7Y7", "VFN72-MT369-966D8-XVGDF-W8F86", "tzm-Tfng", ":$:>:e:~:", "522c8dde-ce27-056b-e4bb-567d419dda14", "turulmad", "D$,@n", "5%5:5D5J5", "9$:/:a:l:", "f9696172-fcfa-c40d-2c87-b81feffff0e8", "MoSetupPlatform: Opening BCD store...", "Summary", "la.%0", "150ba3b7-4f8d-cb60-41f9-32cb4e27aa94", "nn-NO", "imlendirilmi", "Microsoft.Windows.98.X19-99592_8wekyb3d8bbwe", "Enumerate_Editions", "RestoreStreams", "CDlpActionCompat::SerializeMigChoiceScan", "6MQMH-2M9TJ-69JQN-JKKCM-PR42H", "CDlpActionImpl > > >::CheckUserInterrupt", "N7JY7-R7WX2-8FX4J-YVP4G-XQDCC", "failed to extract file from reference extension", "VarFileInfo", "r inte att skapa eller f", "7Q2BN-4JVQ4-76M8H-D3QF7-XD7YB", "Microsoft.Windows.125.res-v4249_8wekyb3d8bbwe", "Setup360DownlevelTime", "CXmlNamespaceManager::Initialize", "OutputLString.Buffer = static_cast(Allocator.ReserveBytes(BytesRequired, alignof(WCHAR)))", "Client.OS.RS2", "pProcessResFileBackedByWim", "829<9", "EnterpriseS", "YRNM6-H6F6D-9B36P-4QGPG-GMVM7", "28b7ffab-71ae-ec74-c4f7-236e5543b02f", "JDCKB-7VNPD-QD376-MMRQJ-JFG6Y", ">$>F>T>m>|>", "DeleteCriticalSection", "d928019e-ee40-3037-ecde-d6571d4d7d2c", "Microsoft.Windows.184.X21-83659_8wekyb3d8bbwe", "6NCT3-8HGPG-VY8H7-843W6-683GT", "415A6^6d6", "u*9~(t h", "Der er ingen pakker, der skal downloades.%0", "ca-ES-valencia", "Microsoft.Windows.136.res-v4361_8wekyb3d8bbwe", ">!>;>B>x>", "3XFBN-WY2B8-DQ4FJ-TQHJV-7QWXQ", "Microsoft.Windows.126.X20-35531_8wekyb3d8bbwe", "8547f92c-2bd5-7bc7-9e63-c83e61395372", "5>6E6P6", "AdjustTokenPrivileges", "Ultimate", "66fb1378-9746-19da-24ad-7b112418c92b", "1!2B2S3", "CMicrodomUpdateContext::CreateVirtualAttribute", "7PMGW-KN2K8-JXP2D-XJ98Y-X4TP3", "d2948d8f-5739-6cfb-d430-79e6466b31d8", "o, porque j", "SetupDiGetDeviceInterfacePropertyW", "CDlpActionImpl > > >::Restart", "pa-Arab", "BASE_N", "b3a2f25b-7590-24d8-4b23-bf0d2f2841a5", "En mer oppdatert versjon av installasjonsprogrammet startes for ", "itli uyumluluk sorunlar", "CQ89X-NPB2V-FYDKC-6VDKC-DDBPB", "@PPhP", ";'<3uElementType == ucObjectType", "professionalworkstationn", "7:7B7j7r7", "NVGV6-J6FGM-7TFK7-VC9DP-8XCJM", " gereksinimlerini ge", "ZwQueryBootEntryOrder", "ExecuteInstallReq: Error reporting telemetry for DesiredPostUpgradeFreeSpace: [0x%X]", "vs.%0", "Microsoft.Windows.165.X21-06171_8wekyb3d8bbwe", "T3QCY-BND4M-CXJFF-6QBG7-94R7T", "STATUS_ACCESS_VIOLATION", "Microsoft.Windows.48.X20-32159_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-98833_8wekyb3d8bbwe", "5,535:5A5H5O5", "CompatInstallReq: Initializing Driver Reflect path: [%s]", "RtlXmlDetermineStreamEncoding(&TokenizerState, &EncodingLength)", "VirtualQuery", "ProductKey: SelectImageIndex: Only one image found. Selecting default.", "Microsoft.Windows.165.X21-39884_8wekyb3d8bbwe", "Eula.rtf", "N4W9V-KBQWC-XQM46-MJYDJ-33WVT", "Microsoft.Windows.98.X20-00910_8wekyb3d8bbwe", "1333fbf1-b52b-55ab-743d-0a14c4515095", "NMK6H-DQGYD-R6WQ6-XGCYP-HH66Q", "Microsoft.Windows.162.res-v3924_8wekyb3d8bbwe", "Failed inserting element to cbs array at index %lu", "-consolida", "sa nem siker", "9&9F9", " odzyskiwania systemu Windows.%0", "do dentro do limite de tempo necess", "Microsoft.Windows.100.X20-29712_8wekyb3d8bbwe", "CDlpActionImpl > > >::Resume", "adavk", "CheckDiskSpace: Not enough free disk space on [%c] drive", "P4Q9B-KN4TJ-W464W-67F2D-2WHWT", "GetUILanguageInfo", "e2849aa8-6c5b-08aa-33a9-270857bcac0f", "Microsoft.Windows.48.X20-29672_8wekyb3d8bbwe", "liwe jest ponowienie pr", " les termes du contrat de licence. %0", "1)272s2", "842e2bf0-e58a-e202-569a-4cf9df9760d1", "849s9", "gsw-FR", "28f6467f-33e2-2529-126b-9b2561a0ee11", "Could not open file {0}", "=2=@=\\=", "in yeterli disk alan", "*g~b0R", "CERT_E_INVALID_POLICY", "8#828b8", "Microsoft.Windows.101.X19-99552_8wekyb3d8bbwe", "?M?S?h?o?~?", "A resposta do servidor tem um formato incorreto.%0", "4B98P-WP9HN-XKDDP-HWCTM-KD73H", "Microsoft.Windows.131.X20-57726_8wekyb3d8bbwe", "en-HK", "Der Benutzer hat die Lizenzbedingungen abgelehnt.%0", "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\SPBUILD", "iostream", "9\\9i9", "ee7e5ab1-1389-ac0a-7e8c-418b9732e4f3", " verze bin", "CDlpActionDU::ExecuteRoutine", "a74dc9b9-e3d6-91c0-cd52-d94d7136e4c7", "STATUS_INTEGER_OVERFLOW", "CheckDiskSpace: Not enough free disk space on system drive. Available: [%llu] MB", "f8c3940c-33b2-3a24-d617-180cf22a4ea0", "ReadChunk", "Microsoft.Windows.8.X18-87818_8wekyb3d8bbwe", "onecore\\base\\xml\\udom_modify.cpp", "Failed to query \"%ws\" variable. Status: %x", "0Y0`0", "Target OS: Detected Source DomainName = [%s]", "MoSetupPlatform: Queuing FOD %s for removal Failed Error: [0x%X]", "ChunkWriterEnqueue", "=#=.=7=G=R=`=g=n=u=|=", "sd-Arab", "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X", "Il sistema non ha superato l'analisi della compatibilit", ";I;d;", "263e9fd2-d65e-3631-a0b8-dedb51d3faa5", "44PQX-NFXFH-XD9QY-38JVR-844DM", "VMHQW-YDN62-2RW7J-VDGY7-2R66P", "Og0M0~0[0", "DuplicateTokenEx", "3ce6b60a-05f7-c463-3d81-e127e1cf0668", "Microsoft.Windows.101.res-v3571_8wekyb3d8bbwe", "Spustiteln", " verze klienta agenta aktualizace.%0", "DataMigration: Queue Request for data migration - data only upgrade scope", "Microsoft.Windows.122.X21-83177_8wekyb3d8bbwe", ".?AVCDlpResponseAutomation@@", "PYHNX-QGQFG-GTCV8-CGDY9-GJGQF", "adavky na voln", "304C4r4y4", "Microsoft.Windows.164.res-v3792_8wekyb3d8bbwe", "km-KH", "Microsoft.Windows.101.X19-99536_8wekyb3d8bbwe", "Parallel chunk decode queue empty; switching to synchronous decode", "ulWhich < TheMap->Length", "CompareStringOrdinal", "9QKPB-NV4XR-H3JD7-F336F-BY48D", "The user has chosen to cancel for license agreement.%0", "Os problemas de compatibilidade n", "Microsoft.Windows.110.X18-94212_8wekyb3d8bbwe", "Microsoft.Windows.172.res-v3858_8wekyb3d8bbwe", ".CRT$XCA", "CDlpResponseImpl > > >::Suspend", "b64bfd3a-f9ef-e457-3344-cbaa2683ab1c", "81927c7a-5d01-d2ce-0a31-456734837ffd", "10ea416b-3e31-778a-fe93-a4e15a50b1ff", "H0f0D0~0Y0", "=$>X>", "CXmlLogicalState::Initialize", "Microsoft.Windows.98.X20-39258_8wekyb3d8bbwe", "CDlpActionImpl > > >::GetResultsRoutine", "ActionListLXPPaths", "SetFilePointer", "Impossibile trovare una lettera di unit", "RQ7PN-WDGCC-VTD2Y-FRC6B-FF8YT", "cf0d2263-8a80-5e26-7bfa-d37645429cb1", "ExecuteDownloadReq: Drive [%c] has enough free disk space", "vel apresentar o relat", "DiskPartition: Supported Drive letters [%s]", "SystemCpuDescription", "GetSupportedDriveLetters: Failed to CheckHotPluggableDriveEx on drive [%s]. Error: [0x%X]", "pienia.%0", "bucketArgument1", "<+Comment.Allocate()", " Microsoft Corporation. Todos los derechos reservados.", "D$8PS", "tFhH+", "CDlpActionDU::SerializeRoutine", "SLGetLicensingStatusInformation", "5#5*5U5", "MoSetupPlatform: Resurrecting NewSystem object from [%s]", "8:8X8a8\"9H9O9^9q9", ".?AVCDlpActionImageDeployFactory@@", "CDlpActionDataMigrate::MigrateProductKey", "DiskSpaceReq: Migrating GDR packages from [%s] into Target OS...", "1m1y1", "NK2FB-XR23F-JJTTJ-62QWW-J8F7H", "RtlMatchLUtf8StringAgainstPointerList", "RtlCompareMemory", "CDlpActionCompat::ExecuteGatedScan: Exit", "Target OS: Remapping [%s] -> [%sCore]", "RegDeleteKeyW", "MicrodomImplementation::CMicrodom::FindObject", "DiskSpaceInstallReq: Initializing SSU paths [%ld] [%s]", "3<4p4", "CDlpActionMediaCreationSuccess::InitializeRoutine", " jour d", " en raison d", "SetImpersonationCount", "PPPPRj", "=(>/>N?i?~?", "570bb52b-4907-f269-8819-7ae17484f3cb", "Systemet oppfyller ikke diskplasskravene for ", "u6VVhD", "250701214655Z0|1", "Nem folytathat", "Failed to open key for element %s. Status: %x", "%04d-%02d-%02d %02d:%02d:%02d", "CDlpActionActivationFactory::CreateInstanceRoutine", "YFF6N-MPKKJ-WXQ8H-2WWG7-RGDDV", "Microsoft.Windows.98.X20-00900_8wekyb3d8bbwe", "\\ArcName\\", "DiskSpaceInstallReq: Initializing LXP Count [%ld]", "j\\h(U", "bs-Latn", "ussite n'a pas pu ", "067dba2a-26e2-679a-2b74-78ae52d7c1a0", "RaiseFailFastException", "2KMWQ-NRH27-DV92J-J9GGT-TJF9R", ".?AV?$CZeroInit@VCDlpOSInfo@@$00@@", "ydy. %0", "Komut dosyas", "Microsoft.Windows.48.X20-35533_8wekyb3d8bbwe", "7X7m7", "CheckDiskSpace: Drive [%c] is good for scratch space", "PKN2F-3MXJX-PB3WJ-X7Q9X-V22JB", "0aeaff95-f11d-56bf-7251-2f1f95c54301", "dku.%0", "w h8+", "Not-null check failed: Params->Source.pIStream", "GetWebSetupUserInput: HostOs Architecture=[%s].", "Microsoft.Windows.101.X19-99531_8wekyb3d8bbwe", "7+898l8z8", "Scripts", ".?AVCDlpActionRecovery@@", ":B:q:", "5&5V5", "STATUS_FILE_CORRUPT_ERROR", "4N4~4", "=[=b=w=", "YN47Q-6C9WV-2JH87-X7HCQ-H22JR", "::BUCL::Rtl::Add( *pcElements, 10, NewCapacity)", "Microsoft.Windows.49.X20-29599_8wekyb3d8bbwe", "5X537|7", "DUImage", "CDlpActionCompat::GetResultsDownloadReq", "ExecuteDownloadReq: Error reporting telemetry for bExtDriveUsed: [0x%X]", "fr-HT", "566_6~6", "DebuggerOptions: Enabling serial debugging -> [%d, %d]...", "Microsoft.Windows.49.X20-35545_8wekyb3d8bbwe", "040404B0", "c2f85eda-c79f-ccae-5420-2246ec2bc3d1", "35c6e5dd-867e-7a37-daf1-a8b5fd76a0fd", "e71da907-ec59-239f-ebbd-0372b00180d1", "Microsoft.Windows.48.X20-32152_8wekyb3d8bbwe", "Le serveur de progression d'installation n'est pas disponible.%0", "STATUS_RESOURCE_TYPE_NOT_FOUND", "6@6L6Z6y6", "Microsoft.Windows.162.X21-03402_8wekyb3d8bbwe", "=$>+>1>A>G>O>V>[>", "WATSON_DRIVER_INF", "JMCNR-7YBB8-4C7H3-8YGF9-66PKQ", "56e72537-f757-e94f-0e10-b188bd1495e2", "5[6b6u6", "FveDeleteAuthMethod", "SSWh@", "Microsoft.Windows.99.X19-99569_8wekyb3d8bbwe", "aYd(z_C", "DiskSpaceDownloadReq: Initializing ExtDrive space req: [%ld]", "dc43701b-4fd6-77cc-5aba-35a5ae4f23e2", "#comment", "6MPNQ-BMVQQ-KK99H-J947Y-F9DM6", "<9;", "CheckDiskSpace: Error reporting telemetry for OSPARTITION_FREESPACE: [0x%X]", "4i5u5", " SVW3", "Microsoft.Windows.175.X21-83765_8wekyb3d8bbwe", "Microsoft.Windows.48.X19-99505_8wekyb3d8bbwe", "o foi criado. Eventos n", ";E;_;", "228d8cea-af15-d1e6-065d-30e1537a6aaa", "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem", "ServerDatacenter", "tzm-Arab-MA", "Sunucu yan", "7g7{7", "Microsoft.Windows.100.X20-30048_8wekyb3d8bbwe", "Washington1", "RtlDestroyHeap", "4QN62-H8C7F-JDW9V-YQ6V7-9BT4X", " z minimalnymi wymaganiami nie zosta", "bW0~0W0_0", "Microsoft.Windows.4.X19-98698_8wekyb3d8bbwe", "1&2c2", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIProductKeyAction@@@@@@@@", ", lemezter", "RtlReallocateLUnicodeString", "Failed to load hive into key %ws from %s. Status: %x", "4#4c5n6", "RegLoadKeyW", "5f159708-28c6-c5f6-eec8-662fac29a969", "homepremium", "8(8C8h8", "BUCL::Rtl::Add(DataLength, OldLength, TempSize)", "9 9@9H9T9t9", "ProductKey: Initializing WIM Path: [%s]", "3NGVC-W8MG2-THR8Q-YTDDH-G6PJD", "8(8,808H8X8\\8t8x8", "DP982-GN4MH-D8PCP-6RJBH-4C2HT", "Not-null check failed: String", "wcstoul", "fr-MC", "RtlpSmartLBlobWritingContextResizePolicy", "corecountryspecific", "CDlpActionDataMigrateFactory::CreateInstanceRoutine", "db2eaf60-a8db-9f1d-2cf1-b286ca551b80", "Microsoft.Windows.48.X19-98806_8wekyb3d8bbwe", "lt, vagy hib", "<=Signature == ('pSdM')", "CDriverCallback::ValidateDriverPackage: Returning the proposed answer. {99C48B3D-E7C1-4EF1-9AC4-14E62176B70F}", "95834d35-b228-0ca0-6319-30edb0ab0e79", "Microsoft.Windows.99.X20-36695_8wekyb3d8bbwe", "f24032a6-e9e1-a10e-c183-ccdf7206a057", "GetProductKeyFromResponse: Defer product key prompt.", "The user has chosen to cancel because the system does not pass the requirements for desired migration choice.%0", "Microsoft.Windows.7.X18-78292_8wekyb3d8bbwe", "56554ae2-cdcb-08c2-d4d3-b9cc8bb64790", "Die Speicherplatzanforderungen zum Herunterladen der Nutzlast werden vom System nicht erf", "6c7'8", " by odpov", "ProductKey: Initializing Region: [%s]", "570b0111-1c30-5440-4272-a93e3dfec0e0", "o em disco para instalar a carga.%0", ">-><>U>w?", "(system)", "89a2b749-5f4b-87a6-ba36-f459fdc199bc", "%hs: Failed opening Narrator registry key ; Error = 0x%x", "Microsoft.Windows.122.X21-04949_8wekyb3d8bbwe", "Compatibility: Leaving PerformResolveCommand", "nse.%0", "Finalize: Error retrieving compat instance: [0x%X]", "STATUS_ENTRYPOINT_NOT_FOUND", "t&QPj", "Microsoft.Windows.101.X20-29633_8wekyb3d8bbwe", "CDlpResponseImpl > > >::SetResponseName", "DUImage: Downloaded %d critical updates.", "o foi interrompido para efeitos de teste.%0", "9ef3fe04-1835-8170-e40c-3931c86cded5", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "9J364-N6P64-CRFC4-D4C9T-FVWGJ", "GlobalFree", "424G4s4", ".idata$6", "404@4D4H4L4P4T4X4\\4`4d4h4p4", "CDlpResponseImpl > > >::GetResponseId", "VXN7G-4G9P9-F6GKT-CF422-MP2KQ", "< <$<(<,<0<4<8<<<@ > > >::PrepareRoutine", "ppipro", "Microsoft.Windows.126.X21-83270_8wekyb3d8bbwe", "Microsoft.Windows.48.X20-29654_8wekyb3d8bbwe", "tre lanc", "m_pTargetObject->IsNamedNodeMapValid(NodeMap)", "TrySMode", "j\\Xf;", "$OEM$", "CDlpActionDiskPartition::ExecuteRoutine", "_errno", "ExportRepository", "J3DNW-3RDWM-8WHBX-YCX3X-RM49D", "?.?@?V?h?~?", "=)>J>`>m>z>", "4XGR7-PNCKM-XYHV8-CH4W2-GQ3JC", "WIMCommitImageChanges", "lemi sonland", "Microsoft.Windows.146.X21-83748_8wekyb3d8bbwe", "m Microsoft", "9L$0s!", "8&848[859<9H9^9", "DUImage: Initializing FOD Path: [%s]", "CDlpActionImpl > > >::Restart", "CERT_E_EXPIRED", "NDDBP-M3KRG-6HHBX-GFHRD-BHCHT", "k let", "8 9C9|:", ":L;-<|<4=", "7RQHC-MNTBD-2CK49-B4JCF-PPJYQ", "699ba6b3-5892-d515-1869-3523d85733bb", "CabFileName", "Microsoft.Windows.100.X20-29642_8wekyb3d8bbwe", "\\Program Files", "0b5a9a9f-4f98-96df-f3e0-59ad1e2fbfb8", "Microsoft.Windows.121.X19-99465_8wekyb3d8bbwe", "GatherOsState y", "HNM8K-CK43C-JR9D9-PTGV3-JTYK8", " harddisken ble ikke l", "97519e88-5133-455d-6855-61dd9aa17fc7", "EtwEventEnabled", " installere nyttelasten.%0", "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()", "MoSetupPlatform: Current disk space required: [%I64u]", ">&?3?", "< @?G?", "Microsoft.Windows.49.X19-98827_8wekyb3d8bbwe", "UD;UD", "Professional", "lemi test amac", "it zpr", "??1exception@@UAE@XZ", ";%= 3", "5#6-6W6a6", " in uso in un ambiente di test.%0", ">)?4?X?d?", "ba7864c4-bb4d-2e71-6f39-5c1861ad3473", "4$4,444<4D4P4p4x4", "sta.%0", "NFKHD-4MFXJ-V8DMX-V8XC2-DDDD4", "`V@Pj", "GC9GD-N2YRX-2FRPT-M7XWT-QYH3M", "Recovery: Image Product Name: [%s]", "1b8f41f5-248e-5eb6-01e0-629899ecf5fe", " stata richiesta un'operazione di finalizzazione.%0", "my-MM", "GetTempPathW", "Configurar acciones de n", ";9@@@?456789:;<=@@@@@@@", "Microsoft.Windows.8.X21-83710_8wekyb3d8bbwe", "Nie znaleziono ofert pasuj", "Microsoft.Windows.49.X19-99724_8wekyb3d8bbwe", "7b9b9348-c142-09be-2d7c-fba4dd44b833", "DUImage: Initializing Critical Path: [%s]", "zh-CHS", "Installasjonsprosessen er stanset for testform", "Locale", ", sistem g", "A vers", "WKVNQ-M8TFY-72JB7-DGDP3-PYT4F", "f0266271-84be-bde7-ced7-003d485315ce", "tencent", "Denne installation kan ikke forts", "Microsoft.Windows.49.res-v3559_8wekyb3d8bbwe", "7,7J7", "666=6B6O6w6~6", "a88ab526-6550-210a-9b4f-9c94d63ace52", " jednotky. %0", "Hedef s", "2(2[2", "CompatDownloadRequirement", "A diagnosztikai objektum nem lett l", "f082a061-3834-0de6-d28f-f386995c01a5", "ration de nettoyage d'une pr", "The compatibility issues for download were not resolved within the required time limit.%0", "GetWebSetupUserInput: Execute: Download file hash X64 = [%s].", "mite de tiempo de espera.%0", "MigrateHostSettings", "NHF4B-PC2H9-B8F3T-JCGTC-9QB3B", "rnyezetet jelenleg nem lehet kiszolg", "danej opcji migracji.%0", "CDlpActionImpl > > >::InitializeRoutine", "Microsoft.Windows.145.X21-83686_8wekyb3d8bbwe", "SetupCore: Registered ADVERTISE action", "YHMNQ-PPQW2-P8PGP-32643-C372T", "Microsoft.Windows.4.X19-99687_8wekyb3d8bbwe", "3,fTidTq ,>gEB;", " miatt a kompatibilit", "041904B0", "adb32380-40ec-40d8-b8da-bf6ca61a7cb2", "0b56ef24-79da-8c3a-a4c1-3062b08d7521", "L'analyse du p", " aktualizace.%0", "N6CD6-3QB8V-G3JM6-JDHRF-6Q72T", "directory not empty", "UpdateMedia: Error reporting telemetry for UpdateMediaNotSupported: [0x%X]", "373J3s3", "Microsoft.Windows.48.X19-99719_8wekyb3d8bbwe", "Range", "2K3i3", "o pode continuar porque a hash da inst", "rdi ikke blev fundet.%0", "lamad", "O utilizador optou por cancelar porque o sistema n", "PPPPPj", "Asennuksen levytilaongelmia ei ratkaistu aikarajaan menness", "4B4I4", "0.0g0n0|0", "sXhH/", "RtlAllocateHeap", "7097a850-51ba-985b-db6e-109bbcd6afae", "na neo", "NGKG3-4JWK4-JRHMT-BDB2P-KW4FJ", "Microsoft.Windows.48.X20-00860_8wekyb3d8bbwe", "9.;;;", "9GPBN-9CRWD-X4893-6WPC7-VT9RY", ">'>.>4>U>r>", "Microsoft.Windows.50.X17-54015_8wekyb3d8bbwe", "D$ Z;D$ r", "8#9w9", "45d955cf-6757-52d4-177f-d1500a3746b8", "tre desservi pour le moment.%0", "ivityst", "5*5F5b5", "DiskSpaceReq: skipping critical update packages...", "O utilizador recusou os termos de licenciamento.%0", "=5=<=B=d=k=q=", "Microsoft.Windows.98.X20-24583_8wekyb3d8bbwe", "Microsoft.Windows.180.X21-83666_8wekyb3d8bbwe", "do dentro do prazo necess", "MTPN6-JVPFW-H778D-PB8FY-DPG4K", "CDlpActionCompat::DeserializeSysReqScan", "F0C;X", "52b5ed11-8d5f-a972-cd30-5ef3693f1f04", " soubor nebyl nalezen.%0", "ProductKey: Product key did not successfully pass validation.", "F2Y9N-DW82B-BK2W3-49WJ4-4X9FH", "nt kommandoradsargument.%0", "Microsoft.Windows.49.X19-98822_8wekyb3d8bbwe", "f44158e5-5a68-ba93-b86c-c173bf0d1207", "Der blev ikke fundet et tilbud, der matcher de kr", "Failed to get object identifier. Status: %x", "Microsoft.Windows.7.X21-83744_8wekyb3d8bbwe", "Microsoft.Windows.162.X20-00859_8wekyb3d8bbwe", "En uventet versjon av bin", "o foi iniciado com um argumento de linha de comando desconhecido.%0", "755fc079-55b6-b32b-20a4-1bd92209cf0d", "1829436f-38dc-f9f8-a40d-68d02b960197", "526<6", "serverforsbsolutionsem", "9%9P9[9", "Microsoft.Windows.125.X21-83238_8wekyb3d8bbwe", "21292g2", "Microsoft.Windows.48.X20-17626_8wekyb3d8bbwe", "Systemet opfylder ikke kravene i enhedsscanningen til installation af opdateringen.%0", "545<5D5L5T5\\5d5l5x5", "CDlpActionCompat::ExecuteGatedScan: Enter", "InstallLanguage", "BUCL::Rtl::Add( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)", "<8=d=", "RestoreMountStub: error creating destination file", "FveAuthElementFromRecoveryPasswordW", "MoSetupPlatform: Requesting install of dynamic updates from [%s]...", " vuoksi tulosarvo on liitett", "nimos para recuperar o Windows.%0", "ImageDeploy: Initializing Alt Storage Path: [%s]", "515L5", "address_not_available", "c198a2c7-6e87-a03a-7fa9-9e85597ef074", "CDlpActionImpl > > >::CheckUninitialized", "Microsoft.Windows.48.X21-83176_8wekyb3d8bbwe", "hoz elind", "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))", "RN4QM-C93P4-7G7W9-2V8BK-7XMPT", "s4hpq", "fc05c171-fb47-6afb-dcb2-2090710a436e", "Windows::uDom::Rtl::RtlDestroyMicrodomUpdateContext", "GetWebSetupUserInput: Selected Offer:", "Microsoft.Windows.162.X20-00862_8wekyb3d8bbwe", "RtlInitUnicodeString", "Microsoft.Windows.99.X20-37914_8wekyb3d8bbwe", "061w1~1", "7:7D7q7{7", "1^1f1", ">->7>A>K>", "MoSetupPlatform: Disk provisioning info not found.", "q@boA", "ee6b595e-beb0-c788-2dd2-ab0c71007019", "[u0A;", "P8MNP-VBFY9-2PGQT-3FBV6-722JP", "Microsoft.Windows.80.X17-53881_8wekyb3d8bbwe", "MH7XR-N4T8K-2F6CQ-D4GMV-QPFBG", "Microsoft.Windows.121.X20-29613_8wekyb3d8bbwe", "rdas.%0", "5$5?5_5", "HKLM\\SYSTEM\\Setup\\MoSetup\\Volatile", "3%3:3L3R3o3y3", "4(4F4", "D$$PSSh", ".?AVIDlpActionFactory@@", "Microsoft.Windows.100.X20-39261_8wekyb3d8bbwe", "PX437-ND23X-QY7GV-G8FCV-8HV2B", "ria.%0", "ac6e7ff8-dc99-1e5f-3f23-5fb404fc5099", "El servidor de progreso de instalaci", "quz-BO", "Eula: Failed to report online store version to telemetry.", "MoSetupPlatform: ExecuteCurrentOperations reported failure!", "ProductKey: Entering execute.", "serversolution", "2a7b0629-c5bb-5ca6-4f6c-bab25485ae7b", "O servidor de progresso de instala", "3N66Q-GFMWG-98BD3-M36CW-9TQMX", "m limitu vy", "Panther\\GenuineTicket.xml", "STATUS_OBJECT_NAME_COLLISION", "u7WVh", "ProductKey: Returning Skulib values for results", "4b75bf19-808d-4e1f-33aa-239e63213a07", "CDriverCallback::ValidateDriverPackage: Failed. HRESULT = [0x%X]", "n no puede continuar debido a que ya se ha solicitado una operaci", "UpdateNotificationButton", "LCMapStringW", "Microsoft.Windows.48.X20-23595_8wekyb3d8bbwe", "serverweb", " s nezn", "Duplicate remove action item or out of memory. Keyform: {0}", "NewCData = this->AllocateStreamObject()", "F;t$ ", ">Q>X>_>t>~>", "DataMigration: Initializing ReportId: [%s]", "Removal", ".?AVCSetupCore@@", ";H;l;", "Microsoft.Windows.101.X20-29675_8wekyb3d8bbwe", ";; > > >::SerializeRoutine", "Microsoft.Windows.49.X20-35601_8wekyb3d8bbwe", "WindowsUpdateExit", "o podem ser relatados.%0", "K6NQ4-2RDX4-PPH2B-CWRK9-RM6QG", "Microsoft.Windows.7.X18-81316_8wekyb3d8bbwe", "8cc436d1-3f70-ded7-7dad-6e20317d7ffd", "Microsoft.Windows.189.X22-09603_8wekyb3d8bbwe", "NewTempBytesRequired > TempBytesRequired", "\\KernelObjects\\BcdSyncMutant", "Microsoft.Windows.4.X19-99710_8wekyb3d8bbwe", "DataMigration: Not requesting oobe.cmd file migration.", "RegGetValueW", "Proces instalace se pou", "6 6(60686H6l6t6|6", "DataMigration: Queue Request for InstallType: [%d]", "<$<0<< >,class CDlpActionDataMigrateFactory,class CDlpActionDataMigrate>::SetActionId", "6928cef0-eb51-1ed0-cade-5298425c97e7", "ar-LY", "tIh(\"", "IsDriveLetterSupported: Drive [%c] is not supported", "eb75c530-5cc0-1a7c-397a-96db92282305", "CriticalDownloadPath", "Het installatieproces is vastgelopen.%0", "UpdateMedia: Initializing SystemLanguage: [%s]", "9GNTV-CRPWR-6BDMW-WTHGH-T3BPC", "BCD%08d", "5#6f6m6", ".?AVCDlpActionDiskSpaceReqFactory@@", "WimStrDupe", "Microsoft.Windows.49.X20-21796_8wekyb3d8bbwe", "homebasice", "CDlpActionImpl > > >::GetResults", "Der Installationsprozess wurde w", "De gebruiker heeft ervoor gekozen om te annuleren omdat het apparaat onvoldoende schijfruimte heeft om te installeren.%0", "BrandingFormatString", "embeddedindustry", "3NKG2-H79C3-8W7KK-FFBQJ-33XC4", "H2FN2-F294C-GWT3W-JPDF7-HXMWW", ":w;~;", "WGF3G-P9N2H-WM8XV-FP3HV-JQPMR", "Het systeem voldoet niet aan de minimum vereisten voor de gewenste migratieoptie.%0", "AddCaptureNodeToImage", "Microsoft.Windows.126.res-v4252_8wekyb3d8bbwe", "o parou.%0", "Microsoft.Windows.101.res-v3258_8wekyb3d8bbwe", "ad49b8e0-f771-3654-a436-718d29a6c87d", "NtQueryValueKey", "Microsoft.Windows.122.res-v3285_8wekyb3d8bbwe", "DiskSpace: Creating new system (with ext drive [%s])", "5c3aedf5-484e-4f88-5e4a-8aa65e192e8e", "Fail to update WIM header", "8!838@8P8]8o8|8", ">(?V?i?s?", ":Y:o:';.;9;W;`;t;", "CompatSysRequirement", "Eula: Initializing AcceptEulaDefault: [%s]", "STATUS_NO_MORE_ENTRIES", "Duplicate remove feature. Group: {0}, FMID: {1} , Feature: {2} or out of memory.", "161A1m1x1", "e2b77317-dd0b-5337-79bc-5fd159d133b7", "serversbspremium", "DiskSpaceReq: Starting Wait", "Microsoft.Windows.162.X20-00860_8wekyb3d8bbwe", "%s /p \"%s\"", "4f9af827-9fb4-1d01-b59f-9b3236b9e5b4", ";b;m;{;", "chargement.%0", "CRYPT_E_ASN1_CORRUPT", "FDNH6-VW9RW-BXPJ7-4XTYG-239TB", "DataMigration: Initializing Migrate Custom Scripts: [%s]", "__CxxFrameHandler3", "_wcsnicmp", "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x", ".?AVCDlpActionDataMigrateFactory@@", "uz-Latn-UZ", "Brugeren har valgt at annullere, fordi systemet ikke opfylder minimumskravene til download af opdateringen.%0", "SecureStartupDeviceEncryption", "Microsoft.Windows.48.X19-98810_8wekyb3d8bbwe", "onecore\\base\\lstring\\lunicode_string.cpp", "Q2NKV-98YCF-C6KMW-TKKTJ-2GYQJ", "Un script de d", "ERROR_SERVICE_DEPENDENCY_FAIL", "Microsoft.Windows.48.X20-29656_8wekyb3d8bbwe", "FveCloseVolume", "CompatInstallReq: Initializing Ignore Dismissible Blocks: [%s]", "WIM\\IMAGE[*]\\WINDOWS\\ARCH", "j\\XPS", "Microsoft.Windows.100.X19-99461_8wekyb3d8bbwe", "Microsoft.Windows.161.X21-43632_8wekyb3d8bbwe", "1(0&0", "Microsoft.Windows.161.X21-43623_8wekyb3d8bbwe", "1e8d121c-d254-c780-93a9-aceeab82318a", "FV469-WGNG4-YQP66-2B2HY-KD8YX", "7&838I8g8", "fb318d57-6f7f-d89a-c326-79a2953cdefd", "CDlpActionImpl > > >::CheckInitialized", "__tempErr", "N2434-X9D7W-8PF6X-8DV9T-8TYMD", "DiskSpaceReq: skipping LangPacks...", "DiskSpaceDownloadReq: Initializing Storage Reserve Used: [%d]", "WINDOWS", "7 7R7]7", "kkelig diskplads til at downloade.%0", "G7KPD-PNC9B-C9C72-D7QXH-GCRFQ", "?$?+?W?^?t?{?", "CheckDiskSpace: Error reporting telemetry for DISKSPACE_DATAID_FU_RESERVE_CLAIMED_SPACE: [0x%X]", "Er is een onverwachte versie van de binaire bestanden van het Setup-platform aangetroffen. Controleer de inhoud van het pakket.%0", "?$?0?9>K>r>", "<^<|<", "MigChoice: Initializing Wim Ref Count: [%ld]", "Microsoft.Windows.7.X21-83746_8wekyb3d8bbwe", " lo spazio su disco del sistema ", "%w't%", "NONCONTINUABLE_EXCEPTION", "Microsoft.Windows.119.res-v3304_8wekyb3d8bbwe", "Microsoft.Windows.100.X19-99449_8wekyb3d8bbwe", "CoreSingleLanguage", "D$Pj@j", "aW0~0[0", "7&7-7B7I7X7_7", "CDlpActionCompat::InitializeGatedScan", "3PNGX-M88FX-8K4B3-2G86G-C9YHY", "31e2d15a-4d10-3d06-a583-3f9aaf5f0878", "DiskSpaceDownloadRequirement", "DequeueNextChunk", "=E=O=y=", "BNKG6-96G3C-4HWG8-468M3-GF4BG", "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())", " on peruuttanut mainoksen.%0", "0a68df12-fdcc-8ca9-f719-5511928d494e", "UpdateMedia: Skipping UpdateMedia process due to user selection", "GetProductKeyFromResponse: Using default response.", "deb40d09-fd65-a268-b5d8-cde68e4da3f8", "CDlpActionDiskSpaceReq::GetResultsRoutine", "DYYRT-NY9VP-4CB2F-8VC7H-DRTKR", "CDlpActionImpl > > >::GetState", "2\"3A3", "0%1h1", "B8CMN-PRD7H-JKCWT-6VYBQ-4GDXF", "Q96PD-4NF2H-VJK87-43BWW-BWR8M", "7e7c7b37-26ab-0e2f-8959-9fc1b95a3115", "W3GNW-YXYVB-WCKXH-364FM-G3B87", "DUSetup", "A4;F > > >::Pause", "CreateFileW", "t~j?Yf;", "Microsoft.Windows.125.X20-00860_8wekyb3d8bbwe", "Windows::StringUtil::Rtl::Impl::CalculateEncodingLengthForString", "Microsoft.Windows.100.X20-00903_8wekyb3d8bbwe", "The installation process crashed.%0", "4CDNC-P7DQY-8CM42-3K3Y7-G6RBD", ";s s%k", "Microsoft.Windows.21.X18-81299_8wekyb3d8bbwe", "Setup Core Actions", ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@", "CDlpActionProductKeyValidate::SerializeRoutineValidate", "7b8e7603-9983-b0c2-e758-7512d0f0d321", "=8=i=", "Microsoft.Windows.22.X17-53886_8wekyb3d8bbwe", "399483cc-440e-4245-f944-8fa5d98357a9", "VCB9N-R7JFT-3FG3C-8WJQY-39QFM", "< =7=Y=", "ProductKey: Validating Product Key.", "6NJ93-4YVHJ-C884K-38X3F-DJ3D8", " avec un argument de ligne de commande non valide.%0", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDiskPartitionFactory@@VCDlpActionDiskPartition@@@@", "8F8k8<9", "WIM\\IMAGE[*]\\WINDOWS\\EDITIONID", "ACCESSDENIED-fejl registreret i indledende faser af Installation ", "Installationsprocessen anv", "ImageExit: Unable to resurrect NewSystem object. hr=0x%x", "STATUS_SHARING_VIOLATION", ":/;d;", "NewAttribute = this->AllocateStreamObject()", "r die Installation des Updates nicht bestanden, und der Benutzer sollte nicht benachrichtigt werden.%0", " necess", "5(626|6", "CDlpActionImpl > > >::Resume", "d60592c8-01df-1550-f39d-3b49df079a1a", "Microsoft.Windows.50.X21-83772_8wekyb3d8bbwe", "lemi beklenmedik ", "MNWM3-Y2HKW-H22TJ-D8VG8-JFG6Y", "Windows Genoprettelsesmilj", "f9BPu", ":);3;G;N;\\;", "0j0D0_0", "924202f1-0049-0354-4b0a-3ea2ee0d5145", "CDlpActionImpl > > >::CheckUserInterrupt", "TNJ4M-XQVBB-6DKCF-74FDG-P7JW6", "HDKJD-QGNVJ-YGWJ4-TT3WJ-D9MQD", "The user has chosen to cancel as the device does not have enough disk space to install.%0", "I file di payload erano danneggiati.%0", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "CriticalPath", "IMPLIED", "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize", "tn8^\\t", ".?AVlength_error@std@@", "RtlReAllocateHeap", "Microsoft.Windows.4.X19-99688_8wekyb3d8bbwe", "tIWPd", "PRO_K", "Microsoft.Windows.8.res-v4309_8wekyb3d8bbwe", "=<=S=m=", "cleanInstall", "XFH34-N8YPQ-MQKMB-KTJX8-F3KTT", " minim", "Es stehen keine Pakete zum Herunterladen bereit.%0", "n de limpieza de un intento de instalaci", "fbbc8f26-c337-e366-cd9a-7ece39db5eaf", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionSummaryFactory@@VCDlpActionSummary@@@@", "lt bejelenteni az esem", "<$<,<4<<F>", "J4WNC-H9BG3-6XRX4-3XD8K-Y7XRX", "rlet lehets", "Microsoft.Windows.125.X21-83252_8wekyb3d8bbwe", ":\":::a:m:", "83058434-a2a9-3575-dfcf-9ae8810b7a11", "CheckExcludeMetadata", "Microsoft.Windows.8.X21-83701_8wekyb3d8bbwe", "Konfigurationsfilen til installationen er tom. %0", "faillance n", "TheDocument.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()", "%EDU%", " el anuncio en el plazo requerido.%0", "bec53ec8-d138-88d9-120b-cf47309b016c", "<$<,<4<< > > >::Restart", "c69046c0-2936-08c3-d064-a529f539a077", "CheckDiskSpace: Failed to get free disk space on [%c] drive. Error: [0x%x]", "N7VJK-VHCXC-9CDCH-7YKHR-YTDD9", "4'474D4V4c4u4", "RHDN4-9MKR3-G7WQM-9WKTY-RC28W", "ActionListParser::ParsePayload", "th-TH", "DataMigration: Initializing Mig License State: [%d]", "dek programu setup.exe jenom ke kontrole, ne k instalaci opera", "telep", "Informational,", "DiskSpaceInstallReq: Initializing LangPack paths [%ld] [%s]", "czony w ramach wymaganego limitu czasu.%0", " harfi bulunamad", "GetDeviceNumberFromPath: Drive %s CDeviceIoControl returned Error: 0x%X", "Q0$1p1", "HRESULT_FROM_WIN32(", "ForceDefault", ".CRT$XCZ", "CDlpActionRecovery::GetResultsRoutine", "TQWQJ-9NWJ4-46XRG-MQJX9-C7KRP", "_FC;]", "Failed to open element %ws key for delete. Status: %x", "CRNFH-JP4RJ-6MTJ4-C4XR9-WTY6M", "GetWebSetupUserInput: Checking available disk space for drive=[%c].", "Microsoft.Windows.101.X20-29669_8wekyb3d8bbwe", "embeddedindustryae", "3\"3T3Y3", "WPT3X-RDN87-MBFRP-7DGPG-QYJGM", "SetupCore: Registered COMPAT_DOWNLOADREQ action", "rd kr", "Microsoft.Windows.172.X21-24707_8wekyb3d8bbwe", "be-BY", "Het systeem voldoet niet aan de schijfruimtevereisten voor het downloaden en uitpakken van media.%0", "Bir hata olu", "Spust", "X297P-NVC2F-6P7K9-Y2G2Y-VQXFW", "2,3W3X6r6", "M7FP8-NKP48-B29K3-4YYWJ-XWW22", "Fant ingen tilbud som samsvarer med de obligatoriske kriteriene.%0", "036f4f22-b719-c52a-db4d-cd88dc643c2b", "InitializeRoutine: MOSETUP_ACTION_IMAGE_EXIT", "CFFNG-VMMJQ-VMKKQ-24RPX-TF62B", "Microsoft.Windows.48.res-v3307_8wekyb3d8bbwe", "3DCBV-3N6KK-7YWF4-V9YQ4-QGQ83", "Microsoft.Windows.189.X22-09701_8wekyb3d8bbwe", "Microsoft.Windows.146.X21-83739_8wekyb3d8bbwe", "ti-ET", "?A?z?", "Microsoft.Windows.50.X17-54013_8wekyb3d8bbwe", "33d0387f-389e-2ef1-9c9f-c32e24746151", "ExecuteInstallReq: Using auto selected drive letter [%c].", "9D:_:v:N;f;><^0>8>D>d>p>", "Microsoft.Windows.27.X19-98755_8wekyb3d8bbwe", "bbe4816c-24bb-3f3f-3e14-fab305f41ac7", "Microsoft.Windows.27.X19-98763_8wekyb3d8bbwe", "c7993efe-9203-d80d-b5af-f505daf6513e", "Installationsprocessen gik ned.%0", "7+7T7^7", ">0>M>t>", "CDriverCallback::ValidateDriverPackage: Package is not signed but has signed binaries. Returning DRV_ANSWER_INSTALLDEFAULT. {7EFC331C-A8DD-4DDA-8601-005B2520F06A}", "3ab69ab2-5ba7-dd27-2bf9-079fa4a659a9", "No se pudo ejecutar un script de instalaci", "4$4N4X4", "CacheDisable", "6%7;7H7W7", "GetSupportedDriveLetters: Excluding Drive [%s] because we cannot get free space. Error: [0x%x]", "HNGVG-HGJFG-6BKFM-MDW7K-RM6F8", ".text$yd", "CKWNM-DJK49-QYCWT-VP2R2-4RG36", "WriteData failed", "uU9G0t", "TelemetryAssertList", "PPj PPPSP", "ae3f1be1-82fa-8b02-d345-d13dd84e5a24", "Installationen kan inte forts", ".CRT$XIAA", "Enumerate", "E$j$Z", "CDlpActionImpl > > >::CheckUserInterrupt", "not_a_socket", ".?AV?$CZeroInit@VCDlpActionImageDeployFactory@@$00@@", "PPWGW-8NW9C-J77Q9-8WHB9-QV64W", "JCJ4B-NYGDQ-Y9MHG-XRYT7-2R6FK", "lmeghajt", "MoSetupPlatform: SuspendAndReleasing Setup Platform object...", ".?AVCDlpActionFinalizeFactory@@", "DeletePath: Cannot delete .", "servermediumbusinessmessaging", "CDlpActionDiskSpaceReq::ReportAdditionalTelemetryData", "DataMigration: Migrating WebSetup image location [%s].", "YNCKW-C4B3Y-Q4BWG-37MTX-P38J3", "Advertise", "lidas.%0", "0M1V1d1", ";\";@;G;d;k;};", "830040fa-8411-853d-0319-fd01511a7fd2", "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x", ".?AV?$CZeroInit@VCDlpActionAdvertiseFactory@@$00@@", "Microsoft.Windows.48.X19-98802_8wekyb3d8bbwe", "09a5f165-b6d6-4159-5e7f-fdf5a3ad488e", "NG4WR-HY8H2-MYPYY-RF36P-MP2JH", "Der Benutzer hat sich entschieden, Ank", "j\\Zf;Ty", "Finalize: Reporting total downlevel time: [%d seconds]", "4cb0ac6f-e72a-ff1f-4f49-0d72ab774e9d", "d0785d09-011f-43af-dc53-ded5642a3385", "o falhou.%0", "ActionListLangPackPaths", "CMicrodomBuilder::AddString", "CheckDiskSpace: Error getting FU reserve claimed space: [0x%X]", "The Flight ID is empty.%0", "Channel1394", ":&;S;", "Microsoft.Windows.122.X20-35507_8wekyb3d8bbwe", "ProductKey: Looking for product key in SKULIB.", "CDlpActionUpdateMediaFactory::CreateInstanceRoutine", "r att installera operativsystemet.%0", ".?AV?$CZeroInit@VCDlpActionDebuggerOptions@@$00@@", "Microsoft.Windows.146.res-v4298_8wekyb3d8bbwe", "8@9a9p9}9", "GKDTR-NDC27-Y64GV-J42D6-2373M", "Microsoft.Windows.4.X19-99692_8wekyb3d8bbwe", "VPMWD-PVNRR-79WJ9-VVJQC-3YH2G", "ExecuteInstallReq: DiskSpaceReq polling starts...", "Il sistema non soddisfa i requisiti minimi per il ripristino di Windows.%0", "n de finalizaci", "08cfc710-a63a-a82b-2911-f2571b039d0a", "PerformSilentCleanup", "<*=4=a=k=", "ApplyReparseFixup", ":&:Q:X:", "9H9S9", "0484031c-2983-c6dc-093f-f76ec24424b1", "ReleaseSemaphore", "ProductKey: Populating Image info set.", "GYFHM-NDGDD-YFTWR-XPPT6-8TXB7", "b9f89f1c-4790-7489-7196-bf9428224a50", "Finalize: updated the Enterprise attribution flag to %d", "ActionListParser::ParseOfferPackage", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform", "CDlpActionImpl > > >::UpdateState", "CDlpActionImpl > > >::GetState", "e74e28f4-c1b9-12cb-7b1c-61e5dedff37e", "Microsoft.Windows.129.X21-83262_8wekyb3d8bbwe", "6ND8M-JX7KK-K29VW-H6D88-Q69Q2", "DUSetup: Could not get DoNotConnectToWindowsUpdateInternetLocations value. [0x%X]", "EnterpriseNEval", "it licen", "4g5m5s5", "LanguageCode", "n para este sistema.%0", ".?AV?$CZeroInit@VCMoSetupDUDownload@@$00@@", "8Z8 :y::;x;", "ii-CN", "43HVN-Y6V6C-WC73G-RHMPF-PPQXD", "An error has occured and the result value must be consolidated for telemetry purposes.%0", "(>O>v>", "NPWBB-M6DWX-JGQWH-RRX2W-GVKFM", "QQSVWj", "ro-RO", "0<0Y0", "CDlpActionDataMigrate::PauseRoutine", "K3RTH-NHMX6-T4KK4-WQWXY-XBVCP", "bie instalacji nadal oczekuje na wykonanie. Wymagane jest ponowne uruchomienie systemu.%0", "JMN29-GCVF9-D7C92-M3YD7-T3BPC", ";a > > >::PrepareRoutine", "NM762-99XWX-K47DD-H3668-XW442", "NW7J8-Y88HJ-GCP33-8X623-YBH3G", "si platform bin", "42abc688-9620-cd31-dbc5-61416b157562", "Specifying User MigXml file: [%s]", "39JVP-BN72R-V7YQK-3PD2C-VFR7T", "st inden for den p", "FV4NT-QMCWC-DFXT2-83GKB-QJWKP", "Microsoft.Windows.7.X21-83398_8wekyb3d8bbwe", "5dda4bd0-2934-eb2c-9a07-07e74ebf26ae", "97bf0314-744c-318e-950d-6f667b31cd4f", "t Phx", ":,:4:9:E:S:t:", "K8QVR-GMN3V-HJ3CR-22CW2-GQ7X6", "XP6DX-NRFYJ-HK736-Q2FQD-KKX9B", "YNV7D-VDW9Q-FJDFR-WF94G-H8T4H", "SkuKeyWithoutLicense", "Microsoft Corporation1&0$", "9 9$9(9,9094989<9@9D9H9T9", "cb32c469-a712-b0ad-d7b2-8d199b288554", "CDlpActionImpl > > >::ExecuteResponse", "Microsoft.Windows.8.X18-81313_8wekyb3d8bbwe", "BiExportBcdObjects failed %x", "Systemet opfylder ikke minimumskravene til installation af opdateringen.%0", "ResetEvent", "f6644f98-23f9-ec6c-3490-e161617241ee", " J9\\$$u", "serverdatacentervcore", "qps-ploc", "7 72797K7R7", "MN2TG-DRF79-MY969-498RR-W8HYF", "1(1G1i1", "5%6\\6", "bad allocation", "Failed comparing: {0} and {1}", "nceki bir y", "Le processus d'installation est utilis", "ReleaseSRWLockExclusive", "NX92Y-XF98H-83XKV-4X22Y-88HYK", "Software\\Microsoft\\Windows NT\\CurrentVersion", "WildCard", "5de08b65-8793-71b2-430d-9348511ccade", "The user has chosen to cancel because the system does not pass the minimum requirements to download the update.%0", "7N9T3-P3MKD-BY23G-V7DRJ-RX9C4", "WWWWVP", "Microsoft.Windows.101.X20-20962_8wekyb3d8bbwe", "GBBXB-8DNVD-2X4G6-T863T-9KRWD", "x`h(%", "bs-Latn-BA", "MoSetupPlatform: SetupAutomation object created!", "SetupCore: Registered DU_IMAGE action", "Microsoft.Windows.101.X19-99649_8wekyb3d8bbwe", " avviata una versione pi", "6(727L7|7", " litery dysku docelowego. %0", "9)9o9", "Microsoft.Windows.171.X21-24734_8wekyb3d8bbwe", "97WTN-WY7D4-G8V3T-CHKPW-2GYP4", ">'?8?E?w?", "ProductKey: Matching Install Wim: Found [%d] matching images.", "CDlpActionActivation::SerializeRoutine", "060y0", "R33WN-HYW7C-96YWC-G8YQG-P7KXW", "34383P3`3d3h3l3", "STATUS_SXS_MANIFEST_PARSE_ERROR", "Zu.A;", "GetWebSetupUserInput: Execute: Download Url X64 = [%s].", "N8DYR-QG3CT-KKJYV-4R7VT-68442", "CDlpResponseAutomation::InitializeRoutine", "04eb1a52-f0ec-4e11-579c-0f99b30e8d8c", "::RtlIsLUtf8StringValid(Candidates[i])", "RtlImpersonateSelf", "88be78c2-9430-07c8-1a20-7b0332826f2b", "Microsoft.Windows.7.X18-81318_8wekyb3d8bbwe", "nimos para a op", "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Insert", "Microsoft.Windows.165.X21-22363_8wekyb3d8bbwe", "EqualSid", "SetupCore: Registered DISKSPACE_INSTALLREQ action", "CDlpActionCompat::MigLogMessage", "CDlpResponseImpl > > >::Execute", "hrbare Datei ", "CDlpActionImpl > > >::Serialize", "ACCESSDENIED-fout opgetreden in de initi", "Asennusprosessi lopetettiin toimia edellytt", "268a0537-266f-da71-d667-71496551865e", "CDlpActionImpl > > >::GetProgress", "CDlpActionDiskPartition::ValidateBitLockerKey", "3TQMN-7HFW3-F3DHR-Y9DFM-WHWHY", "a47dcccc-c2f4-6552-3e50-b48aa217ea26", "FACILITY_FVE_ERROR_CODE", "Het uitvoerbare bestand van GatherOsState is niet uitgevoerd.%0", "tirmeyi indirmek i", " pendente. Uma reinicializa", "%s(%d): Result = 0x%X", "SQWhp", "DCATDownloadSuccess", "SetupCore: Registered ACTIVATION action", "KQ6BB-N4K6V-QWDT3-FRGGM-43MPC", "BiBindEfiEntries failed %x", "Kurulumu s", "ImageDeploy: Cleaning installation drive...", "CDlpActionEula::SerializeRoutine", "RestoreFileMetadata: RestoreFileStorageTierClass failed", "@@@@@@", "2&2F2L2k2t2", " contr", "3$4z4", "STATUS_DUPLICATE_OBJECTID", "FIXED", "Microsoft.Windows.4.X19-99681_8wekyb3d8bbwe", "NewBuffer = (*RtlAllocateStringRoutine)(Bytes)", "CreateThreadpoolTimer", "+RjjQ3", "92d1930d-7e28-dd92-c8d0-c0b5cfff55db", "KTRKN-8RCFX-3T47M-VGDT8-JFHCK", "rene.%0", "p!c5Mf", "787X7x7", "R6BTJ-8GNTW-D2M9P-9FD7H-3J3DV", "FACILITY_RPC_RUNTIME", "RTKX8-KN2HT-MKRKG-3BK3X-RM47T", "Microsoft.Windows.121.X19-98680_8wekyb3d8bbwe", "ZwSetBootEntryOrder", "ProductKey: Default Product Key is not allowed.", "IsNarratorAutoLaunchSettingsOn", "727L7^7", "es-US", "VN3YP-Y4PXW-WXM8K-YT9CD-C384H", "977WD-QNC9M-4T6R7-B8D2R-4X9F3", "fe411b51-cecb-8a45-7e29-3b1144572e70", "Installationsprocessen kraschade.%0", "PerformSilentCleanup: Calling TriggerStorageCleanup.", "bbe5dee2-be04-c51f-5ebd-d9e234f6ee21", "Finner ikke m", "Microsoft.Windows.101.X20-39246_8wekyb3d8bbwe", "5ae475ce-4c43-9aa5-332f-7b02b284bbf9", "CERT_E_ISSUERCHAINING", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ReserveManager", "6Q7s7", ">D>\\>v>", "Microsoft.Windows.98.X19-99601_8wekyb3d8bbwe", "CDlpActionFactoryImpl >,class CDlpActionDebuggerOptionsFactory,class CDlpActionDebuggerOptions>::SetActionId", "3TNB2-FBW3G-2M6TH-8RCRV-MBKV4", "Der Benutzer hat den Vorgang abgebrochen, da das Ger", "A 3F ", "Microsoft.Windows.8.X18-81314_8wekyb3d8bbwe", "Microsoft.Windows.101.X19-99555_8wekyb3d8bbwe", "DUSetup: OsArchitecture: [%s]", "XFJNR-BJP8F-CXTDY-CKXVB-XBT3T", "RtlAcquireResourceExclusive", "veletet, mert az eszk", "rw-RW", "t/hx3", "o ser", "BusinessN", "324b4fb7-7224-1094-c79d-c3606dec13fe", "Microsoft.Windows.101.res-v3422_8wekyb3d8bbwe", "STATUS_SMI_PRIMITIVE_INSTALLER_FAILED", "ProductKey: Restored default product key [%s], based on Edition: [%s] and Channel: [%s].", ";>'>s>", "rt verzi", ".?AVIFCDiagnosticsLite@@", "7F7P7", "SetupBuildDate", "T3M8N-WBQ3R-G8WP7-MMCHR-844BG", "uN9{ uI9{(uD9", "GetSystemPowerStatus", "GetWebSetupUserInput: Execute: Target Usb Drive=[%c].", "Microsoft.Windows.171.X21-24732_8wekyb3d8bbwe", "ec5b95fd-0baf-333b-258a-06cc635e2624", " ani zniszczy", "E_POINTER", "Microsoft.Windows.99.X20-39251_8wekyb3d8bbwe", "BRNJ2-P6JVD-QK6RK-CV77Q-XHJVF", "owner dead", "67b26d8a-6840-32f7-01cd-71d4f8fe6219", "DBVQ7-8N2X7-47FG9-GQ9PY-43KRJ", "sto na disku pro sta", "CDlpActionDiskPartition::ExecuteDiskProvisioningFromAutomation", "CDlpActionUpdateMedia::SerializeRoutine", "r ikke portet kompatiblitetsskanningen for ", " foi solicitada.%0", "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x", "STATUS_NAME_TOO_LONG", " SFVP", "%BASE_CHINA%", "zh-HK", "Microsoft.Windows.101.X19-99539_8wekyb3d8bbwe", "TBNX2-VFP7M-JT6GH-FV2FF-GX2KG", "UpdateMedia: Initializing Edition: [%s]", "vel.%0", "T$`@3", "DiskSpaceInstallReq: Initializing Migration Choice: [0x%X]", "3D4T4w4", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@", "PreFinalize: Initializing OnlineRollback Registration Path: [%s]", "d099ffc7-bf2c-9f76-b7de-48bd8b7eb5be", "kleme disk alan", "lai d'expiration.%0", "J24RN-WB323-PCYPT-8J8X4-FC2JD", " zatrzymany na potrzeby testowania.%0", "CompatInstallReq: Initializing LangPack Install Path: [%s]", "H9CNQ-XT3PG-GDFGD-Q983T-KTP2Y", "tta eftersom det inte gick att hitta instans-hash.%0", "GKY2V-BN9DX-436PD-FK3PF-X2FBB", "Microsoft.Windows.50.X21-83788_8wekyb3d8bbwe", "Facilitator.dll", "?9?v?", "<% >,class CDlpActionImageDeployFactory,class CDlpActionImageDeploy>::CreateAction", "MoSetupPlatform: Finalize reported failure!", "Not-null check failed: Target", "2D2l2", "ks-Deva-IN", "Microsoft.Windows.188.X21-99380_8wekyb3d8bbwe", "Brugeren har valgt at annullere, fordi systemet ikke opfylder kravene til det ", "MicrodomImplementation::CMicrodom::GetElementById", ".?AVCDlpActionGetWebSetupUserInputFactory@@", "N2R73-C6TFF-VC8KP-8C2TY-2PR4Y", "Der Installationsprozess wurde nicht innerhalb des erforderlichen Zeitlimits abgeschlossen.%0", "ho syst", "xito ou este devolveu um erro.%0", "Ett failure-skript kunde inte k", "TRUST_E_EXPLICIT_DISTRUST", "GKBNK-C4HDW-VQ3WF-32MCQ-M7V23", "permission denied", "ProductKey: Product key found in Digital Marker.", "r nedladdningen l", "CDlpActionSummary::IsPowerPluggedIn", "Microsoft.Windows.126.X21-83283_8wekyb3d8bbwe", "RG43T-DKYQP-P6TMG-FJY2H-8GC43", "F,j\\P", "5#6C6", "sHhh.", "4NKJY-VJKYH-8MV33-262F8-BWRWR", "20201009085054Z0w0=", "4922beee-d827-1a54-0ed0-77d95f1a95d3", "d87d30a8-d15b-b298-44f2-b50b85c61707", "Systemet tilfredsstiller ikke diskplasskravene ", "Microsoft.Windows.48.X20-35537_8wekyb3d8bbwe", "0fd4124d-dc93-91dd-783f-c0d1e0e0c839", "Could not open {0}", "DataSetting", "NtQueryBootOptions", "_wcsupr", "=$=D=L=X=x=", "Znaleziono oczekuj", "pap-029", "6%7h7", "Microsoft.Windows.48.X20-00862_8wekyb3d8bbwe", "2$202<2H2T2`2l2x2", ".?AVIDiskSpaceAction@@", "DecryptionKeyX86", "Um script de ", " possibile trovare un'immagine di installazione per questo sistema.%0", "CDlpActionImpl > > >::ExecuteRoutine", "e pour l'installation de la mise ", "nns inte i kompatibilitetsgenoms", "SetupCore.dll", "ImageDeploy: Initializing Wim Path: [%s]", "1N1f1", "solus dans le d", "BX;AX", "Microsoft.Windows.49.X19-99525_8wekyb3d8bbwe", "ko-kr", "<-\"?)?", "Microsoft.Windows.171.X21-24728_8wekyb3d8bbwe", "t akce.%0", "0d93e431-afba-e5df-8e11-0558b54aadd3", " grund af en manglende systemkomponent.%0", "Microsoft.Windows.27.X19-98758_8wekyb3d8bbwe", "ActionListParser::ParseInstallPackage", "RGHTN-4RFYY-WRP4D-8RPJH-94R7G", " scanonly", "a75d44d9-2084-73b2-8f28-cdda033bc590", "7b9cb5ad-bb37-6c7c-b757-5ecf8e7fb7e0", "ndaren accepterade inte licensvillkoren innan tidsgr", "Microsoft.Windows.49.X19-98863_8wekyb3d8bbwe", "DiskSpaceInstallReq: Initializing InstallConstraint: [%d]", "<$=9=", "G0N0X1", "connection already in progress", "d20e551d-ee57-3820-b43d-b34abed98a04", "D$XSVW", "4)5\\5", "rbare filen GatherOsState har en ugyldig signatur.%0", "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE", "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c", "tXVWj", "z!qHe", "82ca92e7-90dc-0af8-c188-659be1c91754", "8f423f01-69fe-2472-99f4-410da5227bdd", "servercloudstorage", " jour.%0", "OriginalFilename", "Module version is [%s]", ".?AVCDlpActionPreFinalizeFactory@@", "default", "3%3,3P3W3g3n3", "sen. %0", "%hs: couldn't get host product name", "Microsoft.Windows.100.X18-28457_8wekyb3d8bbwe", "o - Poss", "MoSetupPlatform: SuspendAndReleasing NewSystem object...", "Kompatibilitetsproblemen l", "e0f302ae-0b6b-f727-f6a4-a48be5b0c626", "Microsoft.Windows.99.X20-29693_8wekyb3d8bbwe", "CDlpActionCompat::UpdateCompatProgress", "t)Ph@", "YNV4T-WVC3V-B36RW-2BHT3-B99DF", " une erreur non sp", "9a888fdf-6c73-1edc-20be-47316bde85aa", "=/>O>^>}>", "L'utilisateur a refus", "< <$<(<,<0<4<8<<<@Element.Allocate()", "8+8X8r8z8", "%WINDOWS_LONG%", "ba6ba0a7-4881-96fe-4c49-154e8b7765ed", "Microsoft.Windows.180.X21-83661_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-98831_8wekyb3d8bbwe", "ivatel se rozhodl proces zru", "Isolationp::Parse::CTemplatizedStringIterator::Attach", "connection_reset", "e08e09b2-470a-0d1c-be26-2816da1d854b", "PR3DM-NGHRJ-RXJQT-FFJPV-JQPH6", "DebuggerOptions", "8bffcfa8-b200-ea8c-8d1d-d5dd443e0f8a", "PFBN4-TKGGF-XDWQY-P436P-W2QXC", "GetWebSetupUserInput: No matching offer found for Edition=[%s], Architecture=[%s], Language=[%s]", "Finalize: Get the narrator autolaunch status and update setupplatform", "D$$Ph0", "Probl", "ve spu", "DUSetup: Instance created!", "ImageDeploy: Initializing SkipInstallingWinRE: [%s]", "DXG7C-N36C4-C4HTG-X4T3X-2YV77", "operation_not_supported", "27fbfcae-232b-e222-e6bb-50ccaa4757a6", " Windows.%0", "\\packages", ">0>4>L>P>h>l>", "GetFailedInstallCount", "bn-IN", "fce4d864-43cc-2b26-13b3-ec8f2dbfa1d9", "SetupDisplayedProductKey", "Q3DTQ-T6N3Y-YKRF7-8CB94-FC4CY", "CDlpActionDiskSpaceReq::GetSupportedDriveLetters", "RtlReallocateLUtf8String", "e475db17-cf4b-0ca2-64b7-e642181f5900", "Der Installationsprozess wurde beendet.%0", "Viallisen komentosarjan suorittaminen ep", "PerformSilentCleanup: TriggerStorageCleanup is done!", "o da instala", "%s: Leaving Prepare Method", "vel GatherOsState tem uma assinatura inv", "SOFTWARE", "dano ju", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "CDlpActionDiskSpaceReq::InitializeInstallReq", "prs-AF", "10770f90-8dac-e680-6e42-92625826f427", "CDlpActionDU::CFCPayloadDUCallback::OnProgressChanged", "Microsoft.Windows.48.X19-98893_8wekyb3d8bbwe", "jQhps", "Target Image: BitLocker Premium Available = [%s]", "tmj\\W", "MigChoice: Error reporting supported install choices: [0x%X]", "PackageMigration", "NJ84D-FDTW2-4GWYC-J4G2Y-VQWVT", "servermultipointpremium", "adavky pro sta", "Select", "16a09be3-d6e1-ce40-ef4c-1c83d4c85948", "1)1v1}1", "Microsoft.Windows.162.X21-43641_8wekyb3d8bbwe", "MultiByteToWideChar", "g venter stadig. Der kr", "7P7W7l7", "lisis de compatibilidad controlada para instalar la actualizaci", "UpgradeMatrix.xml", "=0>C>V>i>|>", "ae83bc0f-9f67-5424-be7c-f04853483bef", "9~0t\"", "@.rsrc", "880c277e-67fa-8657-f65f-1b41c4f2385f", "1&2q2", "N0Rdk", "<' > > >::SetParameters", "GHPJR-6NJ96-432GB-DXBC8-MTDF4", "cbf7542d-fa01-dadd-52b1-47837351d4c7", "M2N96-46V9F-8P3PP-V9MT7-2R4BC", "=8=X=x=", "CDlpActionImpl > > >::Pause", "RtlInitAnsiString", "BRGWG-M7TGB-2K34W-3HB8B-73KR4", "0x%08x", "Microsoft.Windows.50.X18-81307_8wekyb3d8bbwe", "DiskSpace: Total space on System Drive: [%llu] MB", ".CRT$XCL", "<><~<", "Microsoft.Windows.171.X21-24735_8wekyb3d8bbwe", "626084d9-046e-8b18-2805-b3fbaadab39b", "A rendszer nem felel meg az adatok telep", "ProductKeyValidate", "Finalize: Failed to set general setup telemetry. hr=0x%x", "Microsoft.Windows.122.X20-46570_8wekyb3d8bbwe", "me ne satisfait pas les exigences d'espace disque pour t", ";M > > >::SerializeRoutine", "Microsoft.Windows.49.X21-83176_8wekyb3d8bbwe", "DriverChecked", "N878H-93RJD-4T9MG-K9BFW-TQ9RB", "CXFNW-4HWPJ-B72QX-W36BK-M98WP", "DriversPath", "Microsoft.Windows.4.X21-05131_8wekyb3d8bbwe", "STATUS_RM_METADATA_CORRUPT", ";6;L;", "8)999J9Z9k9{9", "8caaef37-82b7-a7d6-13e4-87dbe26784dc", "ProductKey: Product key has an incorrect size.", "STATUS_INVALID_IMAGE_FORMAT", "CDlpActionImpl > > >::CheckUninitialized", "ndsutf", "D$DPh", "Activation: GatherOsState Process returned : [0x%X]", "STATUS_INFO_LENGTH_MISMATCH", "94a54c97-a7b7-896a-154d-5f9a6a708cb4", "NewInstance.Allocate()", "DownlevelBuildNumber", "281c8431-9023-378c-7922-722821d8cd75", "FACILITY_FIREWIRE_ERROR_CODE", "wcsnlen", "o foram resolvidas dentro do prazo necess", "CDlpActionDebuggerOptions::ExecuteRoutine", "kn-IN", "DUSetup: DoNotConnectToWindowsUpdateInternetLocations Value [%lu]", "697H7\\7", " il sistema non soddisfa i requisiti per l'opzione di migrazione desiderata.%0", "tirmeyi y", ".?AV?$CZeroInit@VCDlpResponseAutomationFactory@@$00@@", "RtlDowncaseUnicodeChar", ">&?6?=?", "CAutomationManager::CheckResponseArgs", "FQ36C-4ND2C-4B977-DVQ32-KW3FD", "LdrGetProcedureAddress", "9~(s+j", "Microsoft.Windows.101.X19-99556_8wekyb3d8bbwe", "f152312e-c8c3-38a1-7d30-bfd2cbde1a2c", "83KNH-KMG24-PBTQG-VWJVT-HFTP2", "d33dbe75-8d1c-9d83-6fea-aea14f66387a", "4412c8fd-e25c-33f1-83f3-a41a5e37d116", "4 4=4D4a4h4", "%wPtG", "XY6BR-KNDCB-DQHHC-WJQYH-X7666", ":3:\\:", "PreFinalize: Initializing Device scan results: [%s]", "CDlpActionDataMigrate::DeserializeRoutine", "UpdateMediaOptInDefault", "Root != Root.InvalidValue()", "Lettre de lecteur cible introuvable. %0", "Microsoft.Windows.122.X21-03403_8wekyb3d8bbwe", ":M;s;", "D$PPh", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIFCPayloadCallback@@@@@@", "n del programa de instalaci", "f0a7ec64-cc5b-feef-d473-6fc00a2d045d", "ndelser kan ikke rapporteres.%0", "Microsoft.Windows.21.X17-53887_8wekyb3d8bbwe", "medi ve kullan", "DiskPartition: Automation found! Checking for disk provisioning...", "7,8H8", "VS_VERSION_INFO", "CDlpActionCompat::AppendInstallChoice", "dCSDBuildNumber", "d08308a3-675e-2b32-5800-ef100142041d", "ActionListParser::ParseDownloadPackage", "ExitResult", "8JJ9W-CNMJ3-MHX9B-MKWHQ-M7WGQ", "0+0V0", "969Q9i9", "pidgenx.dll", "Microsoft.Windows.121.X20-29639_8wekyb3d8bbwe", "2f0e97f1-d893-1fe9-2035-f98618af144e", "Microsoft.Windows.98.X20-29577_8wekyb3d8bbwe", "t(h(r", "PGCJN-V6CCD-KDFPM-HGTC7-VT9Q6", "CMicrodomBuilder::StartDocument", "1Y2s2x2", "A0!q8", "DriverReflectPath", "272e2{2", "F692N-K7JD2-KTW3F-CV46P-RVQKD", "CDlpActionImpl > > >::Serialize", "uz-Cyrl-UZ", "HomeBasicN", "CDlpActionImpl > > >::ExecuteRoutine", "?A?x?", ".?AVCDlpActionActivation@@", "<6>]>z>", "RestoreEncryptedFile", "PhRSDT", "CDlpActionDiskSpaceReq::CheckDiskSpace", "WIM\\IMAGE[INDEX=%d]\\WINDOWS\\EDITIONID", "V2Y4T-NKJDQ-9FVF4-FWD2F-PPR6B", "CompatFinalizeReq: Initializing Selected Mig Choice: [0x%X]", "DataMigration: Initializing User MigXmlPath: [%s]", "t?Vh ", "2NM93-FP46J-PRBPG-XRR67-MBKR9", "'`OUL", "=\"=?=Y=y=", "1-2u2", "Microsoft.Windows.48.X19-98801_8wekyb3d8bbwe", "CDlpActionDataMigrate::MigrateBuildInformation", ".?AV?$CUnknownImpl@VIMoSetupDlpAction@@@@", "?0?]?x?", "CDlpActionImpl > > >::CheckInitialized", "D$lSP", "7 787<7@7D7X7\\7l7p7t7x7|7", "mesi i", "CreateDestinationFileEx", "Microsoft.Windows.125.X21-83232_8wekyb3d8bbwe", "9ba97e6b-a175-9213-45af-206eee5b31bc", "tV9_0t", "BQFBB-6N34Y-TJWPY-WC9RG-PDKRY", "SafeOSDU", "<1<7?[?", "ProductKey: Extracting data from EI.cfg file.", "0=0D0v0", "GetWebSetupUserInput: Execute: Download file size X64 = [%llu].", "5\"5=5c5", "MT992-NV4TV-3VPBY-T4FQJ-JFH8B", "CDlpActionFinalize::InitializeImageExit", "Enable", "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence", ": :$:(:,:0:4:H:X:\\:l:p:x:|:", "6e7o7", "PerformSilentCleanup: Failed to call TriggerStorageCleanup: [0x%X]", "74034938-1cdb-5391-cdd8-efeddd503cb4", "0e3ca0e1-251b-e37c-0a34-b5626e729763", "CDlpResponseImpl > > >::CheckInitialized", "FLT_INEXACT_RESULT", ">O>f>", "e pour poursuivre l", "758M8", "ndaren har valt att avbryta eftersom systemet inte uppfyller kraven f", "ProductKey: Host OS edition is [%s].", "3bd82cbe-a190-2833-5425-085943156976", "DiskPartition", "755a6964-972f-a5b5-a445-0c18a9aaf6a9", " opcj", "ProductKey: Key from SkuLib is invalid", "FRWCN-FV7YV-M84HG-M34Q7-BDWWP", ">T>b>", "SYSTEM", "Systemet opfylder ikke minimumskravene til download af opdateringen.%0", ".?AV?$CUnknownSingletonImpl@VCMoSetupCompat@@VIMoSetupCompat@@@@", "ProcessDirectory", "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)", "FilePath", "L'utilisateur a utilis", "u durdurmay", "42fcd868-6ab1-67ab-3fbb-d9c748c3c784", "652456fc-d8ad-2ee4-f9ef-188f47f33f96", "9):D:", "2c982167-b2b6-647b-fc17-dce546631e92", "t,h`Y", "0 0$0<0@0X0h0l0|0", "Microsoft.Windows.4.X21-05134_8wekyb3d8bbwe", "ZwDeleteBootEntry", "8B9M9d9o9", "8R8Y8n8", "[0b0y0", "Compatibility: Suspend was requested", "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)", "InitializeRoutine: MOSETUP_ACTION_BOOT_FINALIZE", "GetModuleFileNameA", "YY_[^", "hg0M0~0[0", "=X=|=", "4(4,444L4\\4`4d4h4l4p4t4x4|4", "ha-Latn", ">D>_>", "8aea09e6-b8e8-745c-3e57-654cc58732ea", "o de SO pendente encontrada.%0", "6;6n6", " > > >::GetActionId", "Het compatibiliteitsrapport kan niet worden weergegeven vanwege een ontbrekend systeemonderdeel.%0", "CDlpActionSummary::IsPowerPluggedIn: System's AC power is offline.", "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputSelectedArch: [0x%X]", "DebugBreak", "GetWebSetupUserInput: HostOs Language[%s].", "nnen nicht gemeldet werden.%0", "RtlCopyLBlob", "c'`n0", "_unlock", "GetWebSetupUserInput: Architecture=[%s]", "4ea80521-b3cd-f9d3-f981-fd8b77854da5", "a0986bd9-7770-2f17-8f77-d83eb46923ae", "teleknek megfelel", "Version", "o foi interrompido para fins de teste.%0", "Invalid pointer ppvObject", "\"%s\" \"%s\"", "Microsoft.Windows.126.X21-83682_8wekyb3d8bbwe", " operacj", "1b19d44f-921e-347a-353b-48e034c9f3ef", "e3a1bc17-b52f-478c-a156-1ed53c920055", "Microsoft.Windows.98.X20-20966_8wekyb3d8bbwe", "zh-TW", "SystemManifest", "1T1t1", ">;?\\?y?", "Het systeem voldoet niet aan de minimum vereisten voor het installeren van de update.%0", "ExecuteDownloadReq: Error reporting telemetry for bSpaceReqBlock: [0x%X]", "GetLastError", "st lehet", "Foi encontrada uma vers", "j0_f;", "5$5,545<5D5L5T5\\5d5l5x5", "PackageMigration: Initializing Target: [%c]", "62f590a3-1b6b-db2d-fc81-9e09d598acb3", "Target OS: SPVersion = [%d.%d]", "rma daha ", "IoTEnterpriseS", "D8W23-NBJX6-GD3V7-VW4YT-D3WXF", "en-us", "Current: [%llu] Total:[%llu]", "x}G;}", ";1<;<", "5c9e3007-b260-6f3d-b4aa-3b6029ca97c6", "MoSetupPlatform: Calling SetupPlatform::INewSystem::ExecuteCurrentOperations...", "Microsoft.Windows.101.X19-99541_8wekyb3d8bbwe", "7V7c7p7", "]SYSTEM\\Setup\\FailedInstallations", "Der blev fundet en ventende handling for annullering af opdatering af operativsystem.%0", "4$4,444<4D4L4T4\\4d4l4t4|4", "9;9U9Z9", "deserialize app scan result at : %s", " ukon", "Il sistema non soddisfa i requisiti di spazio su disco per il download e la decompressione del supporto per pi", "Not-null check failed: String1", "ntdll.dll", ".?AVICompatAction@@", "GetNativeSystemInfo", "78e38bf3-09fa-c671-195d-e780b5d2594d", "9 :*:U:_:", "%s:%s", "Microsoft.Windows.172.X21-24706_8wekyb3d8bbwe", "fclose", "UsbTarget", "serverstorageenterprisecore", "Recovery: Offline Architecture: [0x%X]", "e7bf3184-0bff-5008-70bc-cfff6199ea6e", "m_CurrentStreamObject != 0", "<0 >,class CDlpActionPreFinalizeFactory,class CDlpActionPreFinalize>::SetActionId", "MoSetupPlatform: Creating DATAONLY Fail Forward system...", "m krit", "es-GT", "Microsoft.Windows.27.X21-83177_8wekyb3d8bbwe", "b81232f2-ad85-0678-0644-73e50a274f5f", "jdYWPWQ", "6f645e1c-a9cf-5fae-47f0-8e6d5733c1be", "lai imparti.%0", "FJPN2-GBC2B-CKXGD-2KR6W-7FR8P", "lemedi veya bir hata d", "NtReadFile", "909W9}9", "ServerHPC", "Microsoft.Windows.99.X19-99565_8wekyb3d8bbwe", "STATUS_SXS_INVALID_ACTCTXDATA_FORMAT", "Microsoft.Windows.49.X21-03403_8wekyb3d8bbwe", "lemi ask", "Egy v", "CDlpActionImpl > > >::ExecuteRoutine", "Finalize: Successfully completed the downlevel phase", "CDriverCallback::ValidateDriverPackage: Driver Package: Classname: [%s], ClassGuid: [%s], Proposed Answer: [%d]", "DeviceScanResultPath", ";&;`;j;", "pienia jest niezgodna.%0", "NH29J-RHHRK-G4TK6-4B2CR-BY6QT", "93f77932-84b4-87a7-a6cf-243d1bea4693", "73f15e83-c74e-ddf2-135d-3eebf519b14c", "Microsoft.Windows.99.X20-29706_8wekyb3d8bbwe", "ku-Arab", " komunikatu blokady zamkni", "69267043-1b22-84a7-5456-e6a1961d9823", " anulowania dla reklam.%0", "Microsoft.Windows.49.X20-35546_8wekyb3d8bbwe", "D32CM-X4NMM-648WF-MGVDK-CDPJ7", "v maradjon.%0", "ERROR_INVALID_FLAGS", "9b200cf1-197e-c4e4-adb7-3e949be107e5", "CDlpActionActivation::InitializeRoutine", "EnterpriseAttribution", "97vhS", "ProductKey: EI.cfg file found.", "Il messaggio di risposta del server ", "?\"?H?", "7$7,747@7d7l7t7|7", "P84V3-NVW96-R27W2-CBMTR-K4R79", "Microsoft.Windows.50.X21-83767_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-99517_8wekyb3d8bbwe", "Bir hata komut dosyas", "The compatibility issues were not resolved within the required time limit.%0", "3+333X3`3", "Volume:GVLK", "Microsoft.Windows.125.X21-03402_8wekyb3d8bbwe", "CDlpActionGetWebSetupUserInput::ExecuteRoutine", "CDlpActionGetWebSetupUserInput::GetInstallChoiceFromResponse", "NtQuerySystemInformation", "XW8K7-NC8B8-FPJ26-FYKFM-6VJXY", "Activation: Skipping the Activation block since requested.", "\\$ ;E", "Erro ACCESSDENIED encontrado em fases iniciais da Configura", "WWRND-H328G-J8CC2-RTPTW-W44WT", "BHWRH-XY7GH-F2Y6C-DRXH6-T4XBY", "937abd9c-d4c9-4e30-4f13-8e7915181d37", "A Windows helyre", "Process %s is accessing file wim %s", "Der Benutzer hat den Vorgang abgebrochen, da das System die Kompatibilit", "nns i kompatibilitetsgenoms", "RtlFindAceByType", "SetupVersionMinor", "!040`0", "4)5D5P5[5x5", "061b2482-4b56-b386-a096-6045802ac4a7", "BiBuildIdentifierList failed %x", "575e3a7c-18f9-0529-5164-0cc460478f5a", "GetFullPathNameW", "37GNV-YCQVD-38XP9-T848R-FC2HD", "6PDKD-N2PRH-K72QG-PHQKR-7H7PX", "Microsoft.Windows.8.X17-66953_8wekyb3d8bbwe", "8$9.9[9e9", "4a4q4", "BNWWD-82X4R-WTMQC-72YF8-J8F9J", "H22VK-NM8QD-CG3VR-VWBW8-Q699B", "<<=?D?p?", "3db297d4-7fc6-ca73-bad0-fce698ac5ccc", "a pas ", " uruchomiony z nieznanym argumentem wiersza polecenia.%0", "No processes are using this file.", "n testiymp", "PackageMigration: Getting Removed FODs Failed Error: [0x%X]", "Microsoft.Windows.161.X21-43635_8wekyb3d8bbwe", "ckligt med ledigt diskutrymme f", "ar-BH", "AllocateAndInitializeSid", "0f9d5f44-b649-05bd-8077-b1b4a407532f", "92c988ce-94b7-d31f-4cde-666d9c5f756c", "Installationsprocessen har stoppats i testsyfte.%0", "El usuario eligi", "ProductKey: Initializing Wim Ref paths [%ld] [%s]", "Microsoft.Windows.100.X20-15869_8wekyb3d8bbwe", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionPackageMigrateFactory@@VCDlpActionPackageMigrate@@@@", " > > >::ExecuteRoutine", "Proces instalace byl ukon", "Die Meldung zum Blockieren des Herunterfahrens konnte nicht erstellt oder zerst", "L$,_^[3", "CDlpActionImpl > > >::GetProgress", ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@@@@@", "95ab9554-900c-2089-a82d-f60abdbfdec1", "7$7,747<7D7L7T7\\7d7l7t7|7", "N28W9-K6H3D-3VT87-TJVDK-GJHY4", "NFJ77-RMF62-V89VY-G4B7Y-VQYM4", " oldu", ">q>z>", "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X", "5.5M5l5", "IN_PAGE_ERROR", "0)0Q0", "69f84523-1850-2a6f-f59f-d986445f14d5", "CritDU", "Windows::StringUtil::Rtl::Impl::AppendTranscodedStringToPreallocatedBuffer", "191u1", "Activation: Error reporting telemetry for GatherOSState exit code: [0x%X]", "i nem old", "DNWTT-PXGKJ-2K96V-B789W-33WV9", "Microsoft.Windows.17.X17-36804_8wekyb3d8bbwe", "2DBW3-N2PJG-MVHW3-G7TDK-9HKR4", "43TWJ-BN9D2-7D7MW-DPBTB-39QD8", "ugiwana.%0", "sr-BA-Cyrl", "CDlpActionDataMigrate::MigrateLocaleInformation", "ges id", "DUImage: Failed to execute driver search and download [0x%x]", "n porque el sistema no tiene espacio en disco.%0", "087c9f5c-9fc3-c1c5-f1b4-23ce84cb2047", "Compatibility: Resolve returned an error [0x%x].", ":$:D:L:T:`:", "Timeout", "__COMPAT_LAYER", "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement", "rique ne dispose pas de l'espace disque requis pour l'installation.%0", "CDlpActionImpl > > >::PreInit", "5a6d265c-9675-6628-9981-54e2d23c82df", "ReadMetaDataFile", "PathToProductsXml", "7db9b258-a7bd-cdc6-721c-b0b618b38c4f", "Microsoft.Windows.101.X19-99523_8wekyb3d8bbwe", "yet st", "m_StoredTable.Find(Pair, ppusAttrListNumber)", "DUSetup: Initializing Facilitator Url: [%s]", "CAutomationManager::GetAutomationValues", "CDlpActionImpl > > >::Suspend", "CDlpActionDU::GenerateHardwareCompatFile", "31ddee98-14b2-07fc-5d9f-a0be69841902", "DataMigration: Queue private files into Target OS...", "4428afaf-6187-0528-0a37-87a843f90f4e", "::operator ()", "Nem tal", " per il download non sono stati risolti entro il limite di tempo richiesto.%0", "The installation process did not complete within the required time limit.%0", "DriversDownloadPath", "FveSetFipsAllowDisabled", "212D2", "MoSetupPlatform: NewSystem object released!", "invalid seek", "f9FHu", "RtlGUIDFromString", "8RQCG-NRXBX-PJX2K-XGTH7-QM9XV", "STATUS_CANCELLED", "STATUS_LOG_GROWTH_FAILED", "7c899I9`9", "jth`u", "061f8a0c-5839-4d9c-73e7-983ca01880f1", " >,class CDlpActionFinalizeFactory,class CDlpActionFinalize>::CreateAction", ".?AVCDlpOSInfo@@", "st.%0", ":,;E;b;", "Microsoft.Windows.98.X19-99432_8wekyb3d8bbwe", "FACILITY_GRAPHICS_KERNEL", "Ein ausstehender Rollbackvorgang f", "CDlpActionUpdateMedia::GetResultsRoutine", "383N3[3h3", "Microsoft.Windows.50.X21-83770_8wekyb3d8bbwe", "ho programu, aby bylo mo", "2PFGF-QKNVW-7C936-6PRD4-KBVY4", "6f17da6f-4d97-949e-cf2e-8574e2f4a908", "Microsoft.Windows.7.X21-83397_8wekyb3d8bbwe", "glich.%0", "Esta versi", "CAutomationManager::Initialize", "Microsoft.Windows.7.X17-53913_8wekyb3d8bbwe", "6%6O6Z6", "serverembeddedsolutioncore", "Index of element to remove exceeds number of the element.", "182?2R2a2H3_3v3Q4", ".;,=~#@^&'$%", "FDTTH-PGBYW-XW2RD-NCYMM-88F9H", "5?6M6m6", "Microsoft.Windows.48.X19-98846_8wekyb3d8bbwe", ">4>Y>k>x>", "MTP4X-N26Y3-69V49-HT8YX-4JRBQ", "Microsoft.Windows.48.X20-29666_8wekyb3d8bbwe", " dispon", "N768D-V2R7C-VRBQM-YCJQQ-MDYP4", "572ab8c6-b122-e3fc-2c16-709a59a2e57a", " a telep", " il sistema non soddisfa i requisiti minimi per l'installazione dell'aggiornamento.%0", "4a23a648-b320-5cf9-67cc-c07bfbfcf339", "CERT_E_MALFORMED", "no buffer space", "b29bd774-3fd0-7f5a-4428-ee3f376f072f", "owana.%0", "8(848@8L8X8d8p8|8", "Windows Recovery Environment can't be serviced currently.%0", "274e3597-8644-2f0b-0fe3-d8f3f6167c41", "Asennusta jatketaan k", "Y4WG2-WNJ29-GQFJV-PK3JM-MY64R", "CDlpActionActivation::SuspendRoutine", ">>>I>u>", "en objekt diagnostiky. Ud", "MVY7X-7NMFG-3BPQ3-63TVF-FC3FP", "CDlpResponseAutomation::InitializeRoutinePkey", "gW0j0D0", "f1a62ba0-7f1e-250d-9790-09fd18c23a21", "878V8", "373W3", "Microsoft.Windows.50.res-v4329_8wekyb3d8bbwe", "El id. de vuelo est", "0R0s0", "o foi conclu", "Automation", "6!6%6)6-6", "Downloads", "Der Installationsprozess wurde zu Testzwecken angehalten.%0", "CMicrodomBuilder::StartElement", "ebcad5a6-f265-722d-829b-ce736f8c7c9f", "Der blev registreret en uventet version af bin", "1j2t2", "QQSVW", ".?AVCMoSetupPlatform@@", "System32\\Config", "TNYB9-P84KB-VM2T6-YQC3Y-BBHYP", "9,9X9", "Microsoft.Windows.125.X21-83251_8wekyb3d8bbwe", "rste trinnene av installasjonen ", "nicamente, no para instalar el sistema operativo.%0", "Microsoft.Windows.121.X19-98674_8wekyb3d8bbwe", "ff-Latn", "Microsoft.Windows.145.X21-83687_8wekyb3d8bbwe", "Se ha producido un error y el valor del resultado debe consolidarse con fines de telemetr", "no_buffer_space", "Der Kompatibilit", "me ne pr", "< <1C>c>x>", "lenemiyor.%0", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponseFactory@@@@@@", "j\\Xf9DN", "Microsoft.Windows.164.X21-06162_8wekyb3d8bbwe", "The user has chosen to cancel because the system does not pass the device scan to install the update.%0", "Failed to initialize DriverKeyformProperties: {0}", "CDlpActionFinalize::SerializeExit", "ExecuteInstallReq: Drive [%c] has enough free disk space", "CDlpActionImpl > > >::GetResultsRoutine", "OYuU0", "Microsoft.Windows.145.res-v4318_8wekyb3d8bbwe", "a64c30ea-c091-3561-9850-c6b2b5be876f", "voldoet niet aan de minimum vereisten voor het downloaden van de update.%0", "9P9q9", "4e4653e1-9bbd-2594-33cf-f6f9fd5cc270", "Microsoft.Windows.121.X19-99466_8wekyb3d8bbwe", "e74d2639-11fe-11a3-e1a3-00ba19291994", "Microsoft.Windows.4.X19-98701_8wekyb3d8bbwe", "Q73N4-C93QV-YQ826-HGQ79-JXCJR", "\\Device\\Harddisk%u\\Partition%u", "Microsoft.Windows.101.X20-24576_8wekyb3d8bbwe", "t$PPQQQQ", "DownloadFileHashX86", "Created new boot entry 0x%x", "7G8b8h8", "WimRefPaths", "15d73864-d3e8-eee8-e753-08715a182028", "=%=P=[=", "CX9MK-PFNX4-4GHQR-FMGQH-RGDGQ", "Installer kjernehandlinger", "1edce1f3-7792-a6e5-8330-88607dfa1dac", "0I0W0", "WATSON_DRIVER_DOWNLOADED", "Die Flight-ID ist leer.%0", "PQQhH", "MSCFu", "SWPhP", "4a55b715-31f5-df8d-0585-96e08838017d", "4=4s4", "PrivacyConsentOption", "zHr,g", "NMRk0f", "FveCommitChanges", "b2cf312a-e02c-9d7a-4804-a36e970e156d", "Microsoft.Windows.171.X21-24727_8wekyb3d8bbwe", "t$$QV", "KN7J6-3BQFW-29TFD-2TG98-F3KQ6", "0_06RP", "622d7456-1822-68f9-c39f-5869c8cdf250", "Microsoft.Windows.49.X19-99519_8wekyb3d8bbwe", "4:4V4", "78568d00-2f73-c56b-6be7-17bdbb396b7c", "ffades under den inledande konfigurationen - nytt f", "Microsoft.Windows.122.X19-98689_8wekyb3d8bbwe", "operation not supported", "CDlpActionProductKeyValidate::ValidateProductKeyFromWim", "Microsoft.Windows.101.X20-17627_8wekyb3d8bbwe", "fe8a6ffd-5cea-3b45-c290-237b7b5d0b8d", "Uyumluluk sorunlar", "98bac3d0-5c94-3ccb-0d08-9dc9f4ebd241", " istemcisinin beklenmeyen bir s", "ExitProcess", "969m9", "d014ba89-2113-549f-e903-917899af9aab", ";' > > >::PreInit", " installere oppdateringen, og brukeren skal ikke varsles.%0", "Failed to allocate new string", "DiskSpace", "b555f3ad-0c82-7545-070d-c305cbdc2d4f", "ffa41827-6786-a83d-931e-fa36567329b9", "<6m_LayoutCache.DocumentId()", "WF32N-224KM-4CK7R-PRPCJ-82R42", "565]5", "6+7x7", "CDlpActionDataMigrate::MigrateFlightData", "ImageDeploy: Initializing Wim Ref paths [%ld] [%s]", ";!;=;\\;~;d?", "CDriverCallback::ValidateDriverPackage: GetDriverBlockType Failed. HRESULT = [0x%X]", ", lisans ko", "9H9a9", "DUImage: Initializing Wim Path: [%s]", "CoreConnected", "tott telep", "OutMut->Buffer = static_cast(this->ReserveBytes(InBlob.Length, Alignment))", "no protocol option", "5R5s5", "Falha do execut", "1)1k1v1", "%CLOUD_N%", "2O3~3", "Microsoft.Windows.164.X21-06163_8wekyb3d8bbwe", "29fd1b73-4bc9-7058-e09b-b531de590179", "DiskSpaceInstallRequirement", "CDlpActionActivation::ExecuteRoutine", "Microsoft.Windows.8.X21-83709_8wekyb3d8bbwe", "m_StoredTable.Find(Pair, ppAttDef)", "not_connected", "y uszkodzone.%0", "Nem lehet l", "Setup", "686D6d6l6", " tietov", ".?AV?$CUnknownImpl@VIDlpActionFactory@@@@", "D$4PQ", "DUImage: Initializing Image Index: [%d]", "Microsoft.Windows.101.X19-98875_8wekyb3d8bbwe", "Microsoft.Windows.21.X17-53890_8wekyb3d8bbwe", "uGj\\[", "Staged Image", "DiskSpaceDownloadReq: Initializing Storage Reserve Flag: [0x%X]", "SetLastError", "50U0}0", "%BASE_K%", "MKWHN-783W8-GCGD4-9RTGW-W4YQW", "P3NRG-H2HT7-DD6YP-KHY4P-76F8D", "0c0f0", "PGXBY-RHNHX-P2BBF-8QHKT-4M47V", "CDlpActionImpl > > >::SetParameters", "_lock", "coreconnectedcountryspecific", "%wZ~%ws~%ws~%wZ", "tre signal", "Microsoft.Windows.180.res-v4257_8wekyb3d8bbwe", "n de desinstalaci", "serversolutionspremium", "KDPBN-MKMTM-VPQK2-PHVBV-9BT7B", "SETUPCORE.DLL", "ltigen Befehlszeilenargument gestartet.%0", "M33WV-NHY3C-R7FPM-BQGPT-239PG", "RtlReallocateUnicodeString", ":::@:L:i:p:", "it-IT", "1F2M2W2^2", "r versionen av verktyget st", "CQGKN-F7X3F-CPH37-BPHY6-8T3FD", "N7KWP-RFCTM-8TM42-HVPTC-9QBQD", "%hs: Window %s does NOT exist", "592e0b62-e6f8-0c3d-a440-dcf181e9b1c9", "GetWebSetupUserInput: Execute: Download Url X86 = [%s].", "Microsoft.Windows.101.X20-39245_8wekyb3d8bbwe", "949e350a-fe20-efa6-ed84-8db5fbfe883c", "ActionListFODPaths", "multi(%d)disk(%d)rdisk(%d)partition(%d)", "JGN9H-28H2K-DX3T6-XPQ7G-KTPJF", "1Q1p1", "PackageMigration: Initializing LXP License Paths [%ld] [%s]", "D$0;D$(", "coreconnectedn", ".?AVCDlpActionCompat@@", "Target Image: Product Name = [%s]", "NYPVG-GFKXY-H6FKC-4JFGB-X4R9M", "tsprobleme wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0", "::RtlIsLUtf8StringValid(StringIn)", "NV8QP-FB7GV-PJP6F-WRCYD-7T9TP", " su cui ", "in uyumluluk taramas", ".?AVResultException@wil@@", "C9GCN-GP33R-D34V9-M79TW-DGQMX", "Proces instalace byl zastaven za ", "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize", "UltimateN", "8c9g9k9o9s9w9{9", "nda kullan", ".?AVICompatProgress@@", ": :=:Y:k:", "bc475ae6-b31b-abfa-f6d0-e11abbdcb82b", "EulaAccepted", "9/9`9", "Finalize: Error updating the setupplatform on enterprise attribution status: [0x%X]", "7(8/8|8", "Microsoft.Windows.122.X19-98684_8wekyb3d8bbwe", "nyzik egy sz", " parancsprogram v", "nytelen.%0", ":D:T:|:", "Microsoft.Windows.121.X21-03400_8wekyb3d8bbwe", "041F04B0", "DataMigration: skipping ReportId...", "Microsoft.Windows.48.X19-99646_8wekyb3d8bbwe", "CDlpActionProductKeyValidate::ValidateProductKeyFromPidGenX", "CDlpActionImpl > > >::GetError", "78NGV-VTM63-8V4QQ-PJ94G-D3W49", "=0=C=V=i=|=", "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceRegistryProperty Error: 0x%X", "tl licen", "DataMigration: Queue preservation of locale [%s] into Target OS...", "TJ4JT-NPRW3-RKQXD-MY3F4-FC2HV", "DataMigration: Queue Request for OC replicaiton", "Microsoft.Windows.168.X21-83760_8wekyb3d8bbwe", "Microsoft.Windows.50.X21-83769_8wekyb3d8bbwe", "ServerEnterprise", "5^6t6", "0)0C0e0", "122561f8-f7a7-18b6-dab7-4743210fa142", "_vsnwprintf_s", "3v4}4", "91e47d5c-3682-de02-1231-2301ff9c9787", "8]9u9", "0:0D0", "Une erreur s'est produite et la valeur r", "4150c44c-9d12-9c18-d546-0f34cc826225", "Microsoft.Windows.121.X19-99462_8wekyb3d8bbwe", "XRTMN-66H4W-GD3K8-V93BK-XKXQ2", "JV34N-8GBMD-43J9Q-262CR-KBVKB", "SetFileSize failed", "Los problemas de compatibilidad controlada no se resolvieron en el plazo requerido.%0", "Microsoft.Windows.48.X20-44906_8wekyb3d8bbwe", "NtSetInformationThread", "FYGFT-4RNJV-8TWCQ-946FX-V24C9", "t=Wj,j", "5%5R5\\5", "CreateCompatibilityController", "=(=/=", "ProductKey: SelectImageIndex: Image index not found in response. Selecting image index from SkuLib.", " le d", "0C0A04B0", "Todav", "o aprova os requisitos m", "df92aad8-083d-b6d3-9a28-58243c359ef2", "tmhXU", "777e7{7", "PPNQJ-T6RG8-9MF42-TMMGX-8QK9D", "Microsoft.Windows.48.X19-99721_8wekyb3d8bbwe", "exploitation en attente d", "QM8CX-N29PT-FFFCD-BPJYC-CKCKY", "professionaleducation", "fr-CM", "CompatInstallReq: Initializing Selected Mig Choice: [0x%X]", ":(:=:W:l:w:", "444J4n4u4", "ServerWeb", "PYDXP-3N9MD-7V6FJ-6VHDR-JHWG2", "0*151a1l1", "6NTQ8-YGP9M-B7GVF-P3G4B-F9FFK", "TlP0X", "Microsoft.Windows.182.X21-64698_8wekyb3d8bbwe", "The installation process was suspended.%0", "Der Benutzer hat die Ank", "coreconnected", "serverstorageexpress", "FACILITY_FWP_ERROR_CODE", "DebuggerOptions: Initializing Debugger Type: [Serial]", "Ncknx", "Generating object GUID.", "b1318b8c-6398-2f0b-6011-dfcedfe81dd8", "&PWSV", "Microsoft.Windows.161.res-v3915_8wekyb3d8bbwe", "ProductKey: Extracting Eula", "CDlpActionFinalize::InitializeBootFinalize", ">>>I>g>", "kl-GL", "Microsoft.Windows.49.X19-98870_8wekyb3d8bbwe", "Microsoft.Windows.27.X19-98765_8wekyb3d8bbwe", "j\\Yf9", "%hs: Window %s exists", "CNRGM-9V26B-KVV9T-2KWCH-DRVYM", "onecore\\internal\\base\\inc\\blockpool.h", "\\0k0q0", "Not-null check failed: pStream", "nyt komentorivikomennon setup.exe kanssa scanonly-vaihtoehtoa k", "NRMFG-W72MC-YF83V-4KFM3-QRR86", "O ficheiro execut", "K8TDD-MNPB4-BCFYR-MGRD7-T3B6P", "D$$Ph", "RestoreReparsePoint", "Microsoft.Windows.101.X20-29688_8wekyb3d8bbwe", "s-ellen", "ringsoperasjon.%0", "cd07df8b-5588-d16d-da9f-e00ee19db594", "8 8(848T8\\8h8", "kleme giri", "TRUST_E_PROVIDER_UNKNOWN", " em falta uma tarefa necess", "797h7", "CN38Q-DDMD9-YD84K-2TMM6-4M47F", "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de minimum vereisten voor het installeren van de update.%0", "Finalize: Requesting ASIMOV upload.", "3'3K3y3", "na odnale", "ne-NP", "El usuario ha elegido cancelar la publicidad.%0", "c639bfcd-f3b7-3969-788a-2014d1a430b4", "CDlpActionGetWebSetupUserInputFactory::CreateInstanceRoutine", "d3355629-a2a5-44dc-9a40-b5f105ced5c8", "Activation: Rescan was requested. ", "3ceea0c9-26bf-a96b-5f84-1b8a8c28bc01", "E_FAIL", ">.>?>q>", "MoSetupPlatform: Loading Setup Platform...", "=)=k=", "it ani zni", "3ac946b9-dc8a-8b18-a58e-0afdf520a14f", "Microsoft.Windows.101.X20-00912_8wekyb3d8bbwe", "Microsoft.Windows.4.X19-99698_8wekyb3d8bbwe", "Microsoft.Windows.48.res-v3623_8wekyb3d8bbwe", "mpningsskript kunde inte k", " peruutti toiminnon, koska laitteen levytila ei riitt", "Z9S4u", "5Fz<|", "QQPWQ", "A valid store must have a description key.", "=1=N=T=c=i=t={=", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionAdvertiseFactory@@VCDlpActionAdvertise@@@@", "TheElement != TheElement.InvalidValue()", ":;;[;", "26K99-N2H9H-VMBQB-6FMXX-GJHY6", "Could not parse {0}", "4 4$4(4,4044484<4@4T4X4h4l4p4", "PreFinalize", " GatherOsState ", "4`4g4n4", "0%0X0{1", "77380dff-e8d9-bb1e-3f5b-aa60fb7113ba", "ERROR_ADVANCED_INSTALLER_FAILED", "='=1=8=b=i=p=(>/>i>", "=&=@=G=a=h=", "Serversvaret har fel format.%0", " le Contrat de Licence Utilisateur Final dans le d", "PWDHN-MX39J-9HW2X-XHHFD-BHCF6", "Decoder != 0", "737>7Y7", "ImageFinalize: Initializing SQM: [%s]", "ParseChunkRegionInternal", "TGMNB-2M6M7-39WWG-MT7JH-6XYV4", "Microsoft.Windows.27.X19-98759_8wekyb3d8bbwe", "The system does not pass the compat scan to install the update.%0", "ProductName", "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)", "DUImage: Error on downloading ImageDU Payload: [0x%X]", "5>6Y6", "Diagnoseobjektet ble ikke opprettet. Hendelser kan ikke rapporteres.%0", "Failed open key %ws. Status: %x", "Microsoft.Windows.164.X21-06155_8wekyb3d8bbwe", ";-;J;Q;_;", "dbaa08ca-3313-fcec-0eeb-9dbbe96f9636", "Xf9ABt", "5)5N5", "9JFKN-MWC8F-X8PVJ-RG34X-9HD27", "QW876-NFKK2-9CHBQ-4VK88-2GYP2", ".?AV?$CZeroInit@VCDlpActionFinalize@@$00@@", "Installationsprocessen blev afbrudt i fasen til afg", "SetupCore.pdb", "?4???p?{?", "fveapi.dll", "%s\\%s", "278b2aba-ff8f-1f88-1100-521fc69224d4", "Microsoft.Windows.7.X21-83410_8wekyb3d8bbwe", "mu nen", "InstallType", "9(9@9X9p9", "ExecuteInstallReq: Getting disk space requirement using fake drive letter [%c].", "o em disco para baixar e descompactar m", "WIM\\IMAGE[*]\\WIMBOOTENTRIES", "GetWebSetupUserInput: Selected Image Name From response = [%s].", "24W89-MNYP4-9GFRG-WPQK6-CG2RM", "1c24f3fd-13fd-69f6-af7d-8c7094ae83cc", "2B3I3`3>4E4", "8c35cf71-6e90-d725-f564-cc5476f4f121", "DUImage: Searching for FOD updates...", "Microsoft.Windows.48.X20-35540_8wekyb3d8bbwe", "1Q2t2", "DUImage: Initializing DU Categories OneSettings: [0x%X]", "::RtlIsLUtf8StringValid(Source)", "2.3F3y3", "%EDU_K%", "368WN-4TYJW-BKYFP-4WY9T-YG92J", "Microsoft.Windows.48.res-v3621_8wekyb3d8bbwe", "GetAclInformation", "totta a folyamatot, mert a rendszer nem felel meg a v", "fa-IR", "jFSVh", "BcdForciblyUnloadStore: Failed to acquire BCD sync mutant. Status: %x", "CDlpActionGetWebSetupUserInput::GetTargetUsbDriveFromResponse", "Brugeren har valgt at annullere, fordi systemet ikke opfylder gated-kompatibilitetsscanningen og kan derfor ikke installere opdateringen.%0", "r att ladda ned och packa upp media med flera arkitekturer.%0", "JN63M-337XK-M337F-9JMXV-CYWV7", "RFPF3-NWRDC-83K94-HQTKQ-KKXT3", "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode", "Microsoft.Windows.48.X19-99494_8wekyb3d8bbwe", "_wtoi", "1 181H1L1d1t1x1|1", "2Y2x2", "\\Windows", "IncrementFailedInstallCount", "9:9C9P9", "Die Serverantwort ist falsch formatiert.%0", "= >d>k>l?z?", "-eQkU", "RtlSetControlSecurityDescriptor", "DiskSpace: Creating new system (without ext drive)", "CDlpActionImpl > > >::Suspend", "99931c1e-6a0c-40b8-444d-43845d46fe7e", "MigChoice: Initializing Image Index: [%ld]", "Microsoft.Windows.48.X19-99483_8wekyb3d8bbwe", "VMKVQ-3MN6B-BVM9F-YWV97-R9FCX", "c414312f-9f39-ba5f-88e0-ad2be072897a", "Compatibility: Polling scan timeout occurred. Exiting.", "RtlIsMicrodomUpdateContextValid(HostUpdate)", "?w > > >::SerializeRoutine", "m nepro", "9A0vq", "KNWBR-KQ8FV-CKBJD-MT6B3-GF4TM", "JGP36-HCNXR-RG9F9-BYHGK-TF62C", "Microsoft.Windows.101.X19-99524_8wekyb3d8bbwe", "ServerHyperCore", "Process PID %d is accessing file wim %s", "I0G1-0+", " systemet til installationen.%0", "ca613cee-63d2-d117-d2d9-749ca40d624e", "Text.Allocate()", "4(404<4\\4h4", "Sikertelen volt a GatherOsState v", "C<+C(", "<<AllocateStreamObject()", "373=3I3]3d3", "serverwinsbv", "xRES_REQUIRED_RESOURCEID_MAP", "DiskSpaceReq: skipping FOD packages...", "0N1U1c1", "49765a7c-95da-e40f-561e-7cb508bac1f1", "697o7", "NewAttlistClose = this->AllocateStreamObject()", "FACILITY_RPC_STUBS", "f@f#E", "Microsoft.Windows.101.X19-99545_8wekyb3d8bbwe", "Microsoft.Windows.122.X20-29556_8wekyb3d8bbwe", "DataMigration: Initializing ProductKey: [%s]", "?8???M?", "CDlpActionImpl > > >::Deserialize", "ActionableCompat", "GetWebSetupUserInput: Execute: Decryption key X86 = [%s].", "Microsoft.Windows.121.X19-98681_8wekyb3d8bbwe", "Windows::Rtl::IsValid(ptr)", "9r$tL;", "Systemet oppfyller ikke minimumskravene for ", "9e1dc9a5-0439-bee1-54b3-4a2308c67bb1", "Compatibility: Resolve requested. command: [%lu]", "DataMigration: Resurrect system for the installation process", "6-6J6", "SafeOSImageIndex", "GetProductInfo", "CMicrodomBuilder::ConsumeProcessingInstruction", "4?4J4", "6)6/6?6D6\\6j6", "OpenProcessToken", "RQ2HY-JWN2P-MDT3J-JHRCC-FYBPJ", "Reason", "QQQQQQQW", "me est n", "CloseHandle", "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]", "9<:V:", "^[w\"QRW", "BTP36-XN8H8-DHX8Q-M3TYJ-9TQJJ", "ProductKey: Matching upgrade edition not found in SkuLib.", "0c076999-00bb-bb14-0b79-c5e89d0954bc", "e na disku za", "7R436-NJWQX-TJRKQ-THVC6-TJHW2", "Wykonywanie skryptu zwi", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDiskSpaceReqFactory@@VCDlpActionDiskSpaceReq@@@@", ">>>q>", "757R7r7", "CDlpActionEula::DownloadEulaFromOnlineStoreUrl", "9E9", "Kompatibilitetsproblemerne i forbindelse med download blev ikke l", "Q3NGT-DKTD4-TYMGV-WH8WG-4M47H", " el objeto de diagn", "Microsoft.Windows.125.X21-03403_8wekyb3d8bbwe", "b04eead7-dad3-0961-c56d-fd7fe680f17c", "ncia.%0", "ksynyt mainosta aikarajaan menness", "ProductKey: Genuine ticket generated : [%s]", "oc-FR", ":<:G:y:", "G83W4-NH2PT-6GJR3-Y2P47-3J3XD", "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild", "333k3r3", "DataMigration: Initializing Host Settings: [%s]", "770dc8cb-e595-2700-dcfc-b5187c36c4f3", "f9a5716d-57b2-ceb3-93dc-b2edb5a0c489", "4o5y5", "HN3B3-X9PC6-GDTBF-T6M43-C37YQ", "uNj03", "tsprobleme mit dem Download wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0", "MFN9T-42MKQ-XF4VM-MC92T-C9XRX", "CompareStringW", "PackageMigration: Migrating LangPacks from [%s] into Target OS...", "1d670a88-9832-5763-9d70-cc806a1fbbd9", "ssel kapcsolatos kompatibilit", " dans un environnement de test. %0", "121=1n1y1", ">6?k?", "ProductKey: Product key edition does not match an install wim.", "9TMNP-6GTTJ-DQF6X-RR68K-GJF7J", "f0bebb66-5949-07d0-106e-e8c3b57663eb", "485v5s6", "Microsoft.Windows.101.X19-99544_8wekyb3d8bbwe", "CDlpActionImpl > > >::GetState", "processorArchitecture", "Microsoft.Windows.126.X21-83271_8wekyb3d8bbwe", "WCBQD-VN8PB-FH2RR-WPFCX-3RTKM", "nda sona erdirildi.%0", ">$>*>L>R>t>z>", "ekirdek Eylemleri", "5R6n6", "STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE", "Target OS: Language = [%s]", "Microsoft.Windows.4.X19-99695_8wekyb3d8bbwe", "ExecuteDownloadReq: Using auto selected drive letter [%c].", "Microsoft.Windows.48.X20-35538_8wekyb3d8bbwe", "UpdateMedia: Error reporting telemetry for SkipUpdateSelected: [0x%X]", "[RS4]", "Microsoft.Windows.8.X21-83715_8wekyb3d8bbwe", "ringsskript kan ikke kj", ">(>.>", "es-DO", " Microsoft Corporation. Alle Rechte vorbehalten.", "Microsoft.Windows.122.X20-29554_8wekyb3d8bbwe", "WATSON_BUGCHECK_CODE", "PYT28-42NKJ-X68MD-2RBRC-27JVW", "Failed to acquire permissions to load hive. Status: %x", "Das System hat die Kompatibilit", "e chyb", "Microsoft Time-Stamp Service", "a8dee1a7-5ec1-0340-2be8-2993596fb45b", "XQQYW-NFFMW-XJPBH-K8732-CKFFD", "Failed to open object's key. Status: %x", "Microsoft.Windows.125.X21-83239_8wekyb3d8bbwe", "strncmp", "4PN9J-CYGQ9-GG23D-YQH87-JQKRF", "Microsoft.Windows.48.X19-98895_8wekyb3d8bbwe", "Microsoft.Windows.49.X20-35463_8wekyb3d8bbwe", "HXQDV-NR47Q-98XPH-TGBKD-8K8VH", "212=2H2", "F3D28-2NW8J-KXMG3-4XK3H-G6QJC", "8H9r9", "Microsoft.Windows.27.X19-98753_8wekyb3d8bbwe", ";E;P;z;", "Microsoft.Windows.49.X20-29606_8wekyb3d8bbwe", "WIMSetFileShortName", "DiskSpaceReq: Rescan was requested", "Microsoft.Windows.161.X21-43637_8wekyb3d8bbwe", "7=8|8", "f92u9A", "VFFNY-J46DH-MDD2F-RCFMY-RC4CF", "m_pAllocator->Allocate()", "ProductKey: Product key is invalid.", "PUBLIC", ";2<{<", ".?AVCDlpActionUpdateMedia@@", "UnmapViewOfFile", "XR8RN-MGCR7-R4QXC-9HK9T-8TYMK", "55c2861e-56fb-b50f-ae9b-b28ef094ad41", "Microsoft.Windows.100.X19-99443_8wekyb3d8bbwe", "Cf9Y*", "Microsoft.Windows.50.X21-83777_8wekyb3d8bbwe", "CDlpActionImpl > > >::GetActionName", "n inesperada de binarios de la plataforma de instalaci", "HeapSize", "NTGMV-YWGFF-8R6R6-QB63X-2YV74", "a229eea4-e845-d409-60b8-70e6d6f0e851", "Microsoft.Windows.7.X21-83408_8wekyb3d8bbwe", "ltig.%0", "FFPNR-W93H9-6VMTM-KR7PR-4X8WH", "tRPWhH", "ImageDeploy: Unknown BitLockerMode: [0x%X]", "de-CH", "Local\\SM0:%d:%d:%hs", " Microsoft Corporation. V", "Microsoft.Windows.165.X21-06170_8wekyb3d8bbwe", "FN9MV-2D8M3-F742C-W9RG2-TMT6G", "sr-Latn", "sti.%0", "Microsoft.Windows.100.X19-99661_8wekyb3d8bbwe", "Egy parancsprogram t", "|$ 9t$L", "131:1F1T1p1", "PerformSilentCleanup: Error reporting telemetry for OSPARTITION_FREESPACE_BEFORE_SILENT_CLEANUP: [0x%X]", "IsDebuggerPresent", "GetWebSetupUserInput: Drive [%c] has [%llu] MB of free space.", "<4=F=l=", "FveAddAuthMethodInformation", "The user has declined the license terms.%0", "Microsoft.Windows.48.res-v3309_8wekyb3d8bbwe", "f704d9e7-09b6-0d20-ecbd-f0c297d34f64", "CDlpActionGetWebSetupUserInput::GetOfferSelectionFromResponse", "Microsoft.Windows.164.X21-06152_8wekyb3d8bbwe", " > > >::Initialize", "Microsoft.Windows.122.X20-00862_8wekyb3d8bbwe", "RNB93-FKP46-P23DM-M7CFR-R3KVB", "eny.%0", "[ybVhl", "DUImage: Initializing Mig choice: [%d]", "61c4886e-2df5-c1ea-7057-e50caa6036da", "a57991b8-7a5d-0374-d74a-549c44fb5360", "L'utente ha scelto di annullare per la pubblicit", "FF69K-FWN4P-P3HHJ-MJY6B-PR4W9", "TerminateProcess", "SetThreadToken", "8$84888<8T8X8p8", "zh-hk", "s$97t", "RestoreSecurityDescriptor failed", "c7abc2eb-16ee-c3a7-24f4-069c4f1c7db8", "6-7W7^7k7{7", "b2ddb48a-79ca-f211-b367-06ab0f603ea9", "2db43247-133a-f40d-c76f-b3e0c867b3ad", ">!>2>6><>@>R>V>\\>`>f>j>p>t>z>~>", "GetBitLockerKeyFromUI: Attempting to get a bit locker key from the user.", "2B87N-8KFHP-DKV6R-Y2C8J-PKCKT", "SVhh\"", "CDlpActionDiskSpaceReq::GetFakeDriveLetter", "acfc3d58-f71f-80e6-3f86-3fc4febb7226", "tt, hogy nem fogadja el a licencszerz", "0A0L0x0", "tn-BW", "%08lx", "vel da instala", "0'1X1_1", "no_protocol_option", ";6;A;k;v;", "2<2D2L2T2\\2h2", "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x", "CDlpActionImpl > > >::Resume", "DataMigration: Initializing bSkipOCMigration: [%s]", "RMMRN-9B43V-4DYBD-P2RFT-BP2J6", "TelemetryAssertDiagTrack", "t5QQj", "9_:l:", "DUSetup: Action List Path [%s]", "2/3B3q3x3", "CDlpActionFactoryImpl >,class CDlpActionActivationFactory,class CDlpActionActivation>::GetActionId", "4268aeb2-8195-756d-3e7a-4fffc033198a", "Die Probleme mit dem Downloadspeicherplatz wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0", "r tomt.%0", "Microsoft.Windows.7.X21-83731_8wekyb3d8bbwe", "24WMH-RNHKB-7M29G-BH8RX-9HKC2", "6.6O6_6", "_purecall", "44NYX-TKR9D-CCM2D-V6B8F-HQWWR", "CDlpActionDiskSpaceReq::PerformCleanupTask", "3K4f4", "Arresto anomalo del processo di installazione.%0", "WIMCreateFile", "CompatInstallReq: Initializing Server Image: [%s]", "n_0W0f0D0j0D0_0", "10f0a177-c463-6079-3a18-4c5011b68ddd", "WimPath", "GetVersionExA", "sw-KE", "Attempting to determine owner of file %ws.", "38bbfe2d-9efb-c214-3a60-1944bbba47f9", "2h3y3", "MicrodomImplementation::CMicrodom::IRtlMicrodom_Cast", "0L0zzg0Y0", "200304183039Z", "Exporting forcible unload to firmware", "Microsoft.Windows.184.res-v4258_8wekyb3d8bbwe", "3&3A3F3V3", "Microsoft.Windows.50.X15-55273_8wekyb3d8bbwe", "v>", "LSVW3", " inesperadamente.%0", "gn-PY", "Microsoft.Windows.4.X19-98708_8wekyb3d8bbwe", "MigChoice", "o anterior ainda est", "VK7JG-NPHTM-C97JM-9MPGT-3V66T", "SetFileStorageTierClass", ";A?>Y>", "Microsoft.Windows.136.X21-98319_8wekyb3d8bbwe", "4(4L4T4\\4d4l4t4|4", "res.%0", "o foi executado com um argumento de linha de comandos inv", "Microsoft.Windows.98.X20-39256_8wekyb3d8bbwe", "MoSetupPlatform: Creating Setup Platform object...", " Microsoft Corporation. ", "CreateSemaphoreExW", "DUImage: Loading Facilitator.dll", "El usuario decidi", "492eee7d-f896-233f-ab18-2cb6d18f586a", "ProductKey: Getting Host OS install channel for telemetry.", "Microsoft.Windows.49.X19-98897_8wekyb3d8bbwe", "RtlCompareEncodedLBlobs", "ImageDeploy: Initializing RollbackType: [%d]", "$SVWh", "SizeofResource", "VVVjd", "333T3", "m_AttdefListTable.Initialize()", "9`:|:", "WIMCopyFileEx failed", "4118aaa1-c76a-697b-6184-3632c5a29927", "vel continuar com a instala", "ImageDeploy: Initiate installation(image deploy) of the operating system", "464A4m4x4", "363I3U3h3o3t3}3", "RNWQJ-2JWM6-C7V2C-9HQWQ-RJRBR", "RestoreHardlinks", "SYSTEM\\Setup\\MoSetup", ">'>:>M>`>s>", "ndig ", "xM9sdtF", "Not extracted", "_vscwprintf", "Incorrect filesize. Could be corrupted", "c83d313f-6691-09a3-6f72-37ad3d366770", "o cumpre os requisitos de espa", "XPDNH-BD66B-HG77G-F79HF-FC4BV", "Sistema operativo Microsoft", "Une version inattendue du client Agent de mise ", "CheckHotPluggableDriveEx: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X", "NtAdjustPrivilegesToken", "f97eff2a-19bf-788f-1fa6-45cb7bd06bc3", "%c:\\Windows", "QXV7H-NV2J3-2V68C-FB2WD-Y4HKD", "07fde8dc-7c6a-1d7b-843e-c4a298e07df5", " necessario riavviare il sistema.%0", "Microsoft.Windows.121.X20-29614_8wekyb3d8bbwe", "Not-null check failed: Matches", "De installatie kan niet worden voortgezet omdat het systeem onvoldoende schijfruimte heeft.%0", "CDlpActionDU::SerializeDUImage", "535Q5h5u5{5", "Microsoft.Windows.99.X19-99655_8wekyb3d8bbwe", "r~akow", "CDlpActionImpl > > >::GetProgress", "88GNY-7733F-RM7MM-KY2XT-J2R7Y", "22d29407-aae7-2ccc-5818-7cd0b941ad8e", "Telemetry=%s", ".?AV?$CUnknownImpl@VIDiskSpaceAction@@@@", "Havaittiin p", "BUCL::Rtl::Increment(m_NextStringId)", "fc2d7bfe-07bc-4ea7-1abb-21f0b5ce4cfc", "d40739c4-a65b-6201-d504-c97739f0ff53", "not connected", ";E:S:Y:v:", "1c8d7df0-fe5a-f4e6-5f7d-70feb6b93fbc", "turulam", "N6738-PV7HR-YRW62-6QQ6P-W2RFK", "CDlpActionImpl > > >::GetResultsRoutine", "Finalize: Error reporting downlevel time(ASMV): [0x%X]", "D84KV-7NXJR-FTWTG-GYYXG-D3WXM", "System32\\hal.dll", "CallTriggerStoragePolicies: Uninstall period is inactive", "CDlpActionImpl > > >::Deserialize", "2E2P2|2", "ProductKey: Initializing Partner ID: [%s]", ";';/;<;D;Q;q;y;", "9PCFV-XNFWP-HFM8J-4DGG4-MWRT6", "n nincs el", "bban elind", "MoSetupPlatform: ReleaseSetupAutomation called with invalid suspend path: [%s] err = [0x%X]", "El ejecutable GatherOsState tiene una firma no v", "%u.%u.%u.%u", "No se puede mostrar el informe de compatibilidad debido a que falta un componente del sistema.%0", ";L;/;?Z?}?", "2CTP7-NHT64-BP62M-FV6GG-HFV28", "TV4D3-R2NC9-QQHB7-GDDY4-MWRDF", "EnumeratePathEx: Failed search path is >= MAX_PATH!", "Microsoft.Windows.49.X20-29568_8wekyb3d8bbwe", "De gebruiker is niet binnen de vereiste tijdslimiet akkoord gegaan met de gebruiksrechtovereenkomst.%0", "si folyamat tesztk", "Microsoft.Windows.146.X21-83743_8wekyb3d8bbwe", "BTQTW-N6VJB-63M8G-PHQ77-GCQGG", "0D0l0t0|0", "Brukeren har ikke godtatt annonsen innen tidsfristen.%0", "9230d783-86a3-ca6a-c43f-0b2f11aaafd3", "69790082-fefa-9083-07b7-b64bc49b3ab1", "SkipInstallingWinRE", "losti nen", "GetWebSetupUserInput: Execute: Decryption key X64 =[%s].", "V instalaci nelze pokra", "~(9~0t", "L$$RP", "Microsoft.Windows.50.X17-54017_8wekyb3d8bbwe", "velete m", "68430125-aa01-6889-4463-d37f936993e0", "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Find", "CDlpActionMediaCreationSuccess::ExecuteRoutine", "XmlParserGenerator::ParseLString", "ERROR_INVALID_DATATYPE", "349dd569-36a4-3bbf-955f-b93781abcc64", "Los archivos de carga estaban da", "jnh`u", ";';L;", "Microsoft.Windows.48.X19-98849_8wekyb3d8bbwe", "CDlpActionPackageMigrate::CancelRoutine", "V36XB-NDXCJ-PMGXD-XRYQQ-9764D", "TMYNM-76HXQ-6BJBF-78X8H-6XXQY", "e70e22bd-6461-8e74-dc56-2bb33da5d533", "0(u6b", "ProfessionalCountrySpecific", "rique pour l'installation de la mise ", "DataMigration: Migrating Reserve Manager Active Scenario Key [%d].", "ZwAllocateUuids", "3a24c78c-0ab2-b88d-d8b2-b7207b9cacad", "onecore\\base\\lstring\\lutf8_string.cpp", "CDlpActionImpl > > >::GetResults", "T9GNW-2WKYM-KC92M-DCM9T-YG9RR", "CDlpActionAdvertise::DeserializeRoutine", "526m6", "CDlpActionDU::GetResultsDUImage", "SYSTEM\\Setup\\MoSetup\\Volatile\\Telemetry", "WATSON_BUGCHECK_P4", "Microsoft.Windows.121.X21-03402_8wekyb3d8bbwe", ";$;+;7;H;\\;~;", "CDlpActionDataMigrate::ResumeRoutine", "dddb0dcc-2689-87db-8735-56d6fcb40696", "CBasicNodeType::ChangeName", "N79KC-MKD68-96QY3-CPRFC-RVV3G", "NQTH4-KK96T-T4W27-KYP3C-JB47T", "ActionListParser::ParseRemoveFeature", "c1c30bf9-e872-8af2-d965-b2da3569a7fa", "cutable d'installation n'a pas ", "=;>V>", "KNRWR-JTCF6-8636P-9YRD7-JQKTG", ".?AV?$CZeroInit@VCDlpActionRecoveryFactory@@$00@@", ">B>M>", "tta eftersom systemet inte har n", "BUCL::Rtl::Add(pCachedInfo->m_ulChildCount, pCachedInfo->m_ulAttributeCount, cNecessary)", "3f16486b-2c5a-992d-adaa-be22078fcef1", "BMRN3-KDT93-FTPHK-HY9JM-3GP22", "Diese Version des Tools wird nicht unterst", "26fe1901-4a72-733a-8c9e-b51fa7914459", "9F sN", "7dee2a4c-8763-cec6-729b-0b97405c8c55", "De installatie kan niet doorgaan omdat er een vereiste taak ontbreekt.%0", "ab2a6bb9-0cb3-6ada-906b-203f943992f3", "343u3", "P6DH4-PHNT4-V32D6-TBP2T-WXCKD", "379756f2-d69b-3534-5985-1ca572e6c0c4", "JMGNM-VTCK8-VTP9W-CYHBD-TCRBY", "CDlpActionUpdateMedia::ExecuteRoutine", "NotificationBttnClicked", "9)9a9", "es-HN", "e4f31708-93c5-4e9a-d87d-766826162afa", "ImageExit: Initializing SetupResult: [0x%x]", "Microsoft.Windows.48.X19-98813_8wekyb3d8bbwe", "The user has chosen to cancel as the device does not have enough disk space to download.%0", "CDlpActionImpl > > >::GetSerializeOnProgress", "fmalloc failed", "e syst", "The GatherOsState executable has failed to execute.%0", "da54096b-9ded-b28f-34ae-1b948d890ccf", "cutable GatherOsState.%0", "0bbfca56-176a-6e92-d966-4689118aff8f", "L$,!t$0!t$4", "tte, fordi der mangler en n", "Microsoft.Windows.122.X20-29611_8wekyb3d8bbwe", "2.3d3n3", "96178c45-7dc6-2b8c-33ea-2ec619101cc3", "3$3,343<3D3L3T3\\3d3l3x3", "DiskSpaceInstallReq: Initializing RecoveryOption: [%d]", "5 696N6m6", "4\"5[5", "DownloadSize", "0<0H0h0p0", "=1=;=", "r installationen.%0", "pToInsertInto->Element != 0", ".?AVCDlpActionCreateMediaSuccessFactory@@", ".?AV?$CZeroInit@VCSetupCore@@$00@@", "e1e897c9-4b68-101f-9172-2021a1f23455", "o em disco suficiente para a instala", "CDlpActionImpl > > >::CheckUserInterruptEx", "tRSV3", "CDlpActionImpl > > >::Pause", "4-4J4`4m4z4", "DiskPartitionAutomation", "viin telemetriatietoihin.%0", "62db884e-f008-a5ed-e498-89f646cb91c7", "Microsoft.Windows.49.X19-98825_8wekyb3d8bbwe", "#wXsA", "CDriverCallback::ValidateDriverPackage: We want to migrate this package. Returning proposed answer. {7EFC331C-A8DD-4DDA-8601-005B2520F06A}", "t beti", "DTYHP-NF3K3-FCBTF-HF4K6-CGT97", ".\\%s\\%s.mui", " supportata.%0", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteText", "IsDriveLetterSupported: Drive [%c] is supported", "9288c808-ca41-0745-1773-7825ff6be5f8", "*ppObject = State->m_pAllocator->Allocate()", "Un'operazione di pulizia di un tentativo di installazione precedente ", "FveCheckSuspendBitLockerOnUpgrade", "CDlpActionFinalize::PauseRoutine", "6fa07987-6297-adbb-4774-2a8bcc37b313", "FACILITY_ACPI_ERROR_CODE", "t;Sh<", "0S0h0L0g0M0~0[0", "DebuggerOptions: Retrieving BCD settings interface...", "DiskSpaceReq: Migrating FOD packages from [%s] into Target OS...", "271fba0f-bf4c-71a5-d49d-26382a6e9fbd", "j Yf;", "3$5U5z6", "The user has use the setup.exe command line to do scanonly, not to install the OS.%0", "9L:S:r:y:", "NTRHT-XTHTG-GBWCG-4MTMP-HH64C", "Microsoft.Windows.21.X17-53888_8wekyb3d8bbwe", "9097772d-87a2-1e80-ad0d-705e334c8cfc", "9#989B9I9s9z9", "Microsoft.Windows.8.X21-83708_8wekyb3d8bbwe", "%hs: Registry value 'CSDBuildNumber' is not the correct type (REG_SZ).", "D0K0U0", "ersiz.%0", "Microsoft.Windows.121.X20-21794_8wekyb3d8bbwe", "Target OS: Error retrieving upgrade flags! [0x%X]", "trehozni vagy megsemmis", "435>5E5v5}5", "3c538bb8-b3a9-e4f0-4cff-ec74e901da81", ".?AV?$CZeroInit@VCMoSetupPlatform@@$00@@", "PackageMigration: Initializing FullUpgrade: [%s]", "598e6490-d22d-94d1-9564-552305cbe0fc", "2NJR4-TQ688-4X24Y-KRPQ7-8HQKF", "1cdbd138-173b-e306-bb7f-783f452e16a8", "0%0-0W0r0", "(SVW3", "0-NbkW0f0", "2+3M3k3", "41045f1a-546c-1f08-d720-fa23e6472a06", "Systemet uppfyller inte diskutrymmeskraven f", "CDlpActionDataMigrate::MigratePrivacyConsentOption", "N:Nzz", "021=1i1t1", "Microsoft.Windows.8.X17-66950_8wekyb3d8bbwe", "%wLtC", "0f0O0`0U0D0", "ExecuteInstallReq: No response registered.", "1/2u2|2", "HNFWK-JGCHR-B4RWK-VVV2K-MG9RY", "msvcrt.dll", "HK38N-M79BP-C7GMX-8MDT8-PKFBQ", "The requested attribute value can not be determined at the current stage of the update.%0", "n asennuksen sijaan.%0", "CDlpActionAdvertise::ExecuteRoutine", "truire le message de blocage d'arr", "FALSE", "CDlpActionProductKeyValidate::SearchForEICfgFile", "?$?4?8? > > >::Pause", "file exists", "SYSTEM\\CurrentControlSet\\Control\\SystemInformation", "Microsoft.Windows.171.X21-24737_8wekyb3d8bbwe", "leme i", "YN79T-WVGKW-B83DY-7V74T-BP2HM", "Installationen afsluttede uventet.%0", "si probl", "CreateSetupObject", "54945600-72ed-bcbe-680f-7f6effef20a0", "tg0o0", "CDlpActionFactoryImpl >,class CDlpActionDiskSpaceReqFactory,class CDlpActionDiskSpaceReq>::SetActionId", "L'utilisateur a choisi d'annuler l'op", "e0b050c8-102d-04b7-ebd1-93f33eb61adf", "Microsoft.Windows.8.X21-83695_8wekyb3d8bbwe", "nOa-Q", "DUImage: Initializing DU Categories Cmdline: [0x%X]", "iotenterprise", "Brugeren har ikke accepteret annoncen inden for den p", "FltCommStubCreateChild", "DJTP2-NR4TF-4J2G8-9CWD8-KY9XY", "u6f9s", " jour a ", "NewElement = this->AllocateStreamObject()", "Facility=", "L$(@;E", "in gereksinimleri kar", "Microsoft.Windows.126.X20-35530_8wekyb3d8bbwe", "Microsoft.Windows.48.X20-29660_8wekyb3d8bbwe", "inden y", "CDlpActionCompat::QueryInterface", "n de Windows no se puede atender actualmente.%0", "Microsoft.Windows.162.X21-43643_8wekyb3d8bbwe", "776e3901-f67f-94a0-ea40-868122ec43c1", "FDBNB-3GM37-BXTD6-3TKP3-JTTTC", ";8 > > >::SetProgress", "GetFileSizeEx", "?(?8?m_pAllocator->Allocate()", "CDlpActionDataMigrate::MigrateRecoveryImage", "fr-MA", "Microsoft.Windows.101.X20-29686_8wekyb3d8bbwe", ":0:H:`:x:", "TVDC8-KNMC7-C3T67-B6XFQ-9D9WB", "Microsoft.Windows.122.X20-35512_8wekyb3d8bbwe", "CDlpActionDiskPartition::SearchForValidBitLockerKey", "WTHelperGetProvSignerFromChain", "Microsoft.Windows.48.X20-35602_8wekyb3d8bbwe", "or-IN", "no message available", "ytkownik nie powinien by", "NetNoDHCP", "my se spln", "k gereksinimleri kar", "Eine unerwartete Version des Update-Agent-Clients wurde erkannt.%0", ".?AV?$CZeroInit@VCMoSetupCompat@@$00@@", "??0exception@@QAE@ABQBDH@Z", "b5f617a8-0907-c367-5287-06108080b597", "Microsoft.Windows.98.X19-98665_8wekyb3d8bbwe", "serverstandardvcore", "bu prost", "CDlpActionFactoryImpl >,class CDlpActionDUFactory,class CDlpActionDU>::CreateAction", "ydy.%0", "9\\$Lt", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "pDomLayout->ulSignature == ('lDdM')", "Microsoft.Windows.4.X19-99704_8wekyb3d8bbwe", "Microsoft.Windows.49.res-v3320_8wekyb3d8bbwe", "Failed to set description key value. Store: %s StoreKey: %ws Status: %x", "GetWebSetupUserInput: HostOs Edition=[%s].", "MoSetupPlatform: GetSetupPlatform failed: [0x%X]", "j:Xf;F", ">&>.>N>S>r>~>", "2df27219-ed55-9e0b-ed96-8e25f148168b", "installation a rencontr", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\Features on Demand\\Removed FOD Markers", "9764e6ef-c702-e9f4-09f1-a30c6a6bbf09", "gatherosstate.exe", " (Microsoft Corporation). ", "Microsoft.Windows.98.X20-00908_8wekyb3d8bbwe", "RtlHashEncodedLBlob", " Update Agent.%0", "Microsoft.Windows.49.X19-98856_8wekyb3d8bbwe", "rt inden for den kr", "9%8YWDQ", "Cache", "QPSVW", "Microsoft.Windows.99.X20-29708_8wekyb3d8bbwe", "s rendszer", "9O:$;1;[;f;", "?(?G?i?", "lni kell a telemetriai elemz", "tt-RU", "STATUS_OBJECT_PATH_NOT_FOUND", "DUImage: Searching for driver updates...", "OfflineGather", "ReleaseSRWLockShared", "9fd478e8-ce29-9241-261a-55051408ed3e", "llt.%0", ";L;t;", "Microsoft.Windows.50.X21-83780_8wekyb3d8bbwe", "CDlpActionDataMigrate::MigrateData", "Microsoft.Windows.7.res-v4292_8wekyb3d8bbwe", "5@5K5y5", "4a060d57-d15d-5814-887c-2face8b11b99", "516~6", "thinpc", "DUImage: Failed to execute LangPack search and download [0x%x]", "ERROR_SXS_FILE_HASH_MISMATCH", "SetupPlatform.dll", "Microsoft.Windows.49.res-v3315_8wekyb3d8bbwe", "nsen gick ut.%0", "221c5f76-d2a2-7a29-e8b4-40dd658cd7ea", "VerifyIntegrityChunk", "DiskSpaceReq: Migrating critical update packages from [%s] into Target OS...", "ras eller returnerade ett fel.%0", "PreFinalize: Requesting Automation", "3X3o3v3", " pokra", "524ec275-8967-8ae2-18db-e297f123d786", "f89a9e9a-d944-990d-92d4-e5c464bc9d40", "70f4ccac-9a50-0c5b-9b8c-4fe0d6276cf1", "T9HYM-TFNC2-HHBP3-FB9P7-B7VY4", "8b3fdd7b-e8af-7b9b-7443-39a7c034b841", "ProductKey: Error with PidgenX config file format while validating product key.", ":<:f:z:", "serverstoragestandard", "Microsoft.Windows.162.X21-43651_8wekyb3d8bbwe", "Microsoft.Windows.122.X19-99475_8wekyb3d8bbwe", "M4FNP-HBDXD-WWP3B-DM2B3-KKYRK", "081604B0", "SkipZeroDay", "fr-FR", "FACILITY_NTSSPI", "4.6Y6t6", " fortsette installasjonen", "CDlpActionFactoryImpl >,class CDlpActionAdvertiseFactory,class CDlpActionAdvertise>::CreateAction", ".?AVCDlpActionMediaCreationSuccess@@", "ZwSetSystemEnvironmentValueEx", ">,?7?E?", ".tls$", "CDlpActionImageDeploy::PauseRoutine", "lem yeniden ba", "sa.%0", ";7Z>n>", "W374N-CR9R2-G36CB-MBY8K-QV8WG", "CDlpActionUpdateMedia::GenerateCommandLine", "Windows ", "LoadResource", "PostUpgradeDiskSpaceMAX", "NYR6B-CPMMK-RTJQQ-XH2GG-MKQH3", "te obsah bal", "rodowiska odzyskiwania systemu Windows.%0", "Ocorreu um erro, e o valor do resultado deve ser consolidado para fins de telemetria.%0", "9-9d9", "TN4KB-9GTMD-PDKHH-FDH4W-D9M7X", "gl-ES", "Microsoft.Windows.8.X21-83719_8wekyb3d8bbwe", "DiskSpaceInstallReq: Initializing Wim Ref paths [%ld] [%s]", "Compatibility: Rescan returned non-successful scan error code: [0x%X]", "SetupCore: Registered IMAGE_FINALIZE action", "L'utente non ha accettato il Contratto di licenza entro il limite di tempo richiesto.%0", "D$,8Y", "PsfHash", "CheckDiskSpace: Usage of drive [%c] is not supported", "Microsoft.Windows.49.X19-98865_8wekyb3d8bbwe", "969i9", "78CNT-C9JMM-K2WCJ-PJKXF-GX2F2", "~HQMR", "e0c8a3eb-681f-e01c-5b01-5ca84c9fde70", "Cloud", "><>C>\\>l>s>", "ncelle", "CDlpActionUpdateMedia::GenerateConfigFile", "67898332-c24e-690c-00d5-83b875e0f5ef", "e250993e-6651-b4c0-f22d-f588ffc06d42", "dfed173e-1299-e05b-f1c0-f040ed0ca145", " con un argumento de l", "Deleting element %08x", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionPreFinalizeFactory@@VCDlpActionPreFinalize@@@@", "050[0h0v0", "GDTNP-H4DWW-K8X3B-RFQQD-49CKM", "ccddecd1-a5b1-e44d-2f50-ffecb9d004a2", " stato avviato con un argomento della riga di comando non valido.%0", "D$ QP", "4>4}4", "Der Installationsvorgang wurde mit einem ung", "Microsoft.Windows.49.res-v3317_8wekyb3d8bbwe", "NWKXD-8HBCJ-TKC7X-DW3B4-R3MMP", "6X4N2-PXTF7-BWTFB-4Q9BV-46YQD", "PreFinalize: Initializing OnlineRollback Arguments User: [%s]", "6QKBJ-8N99P-BCFXF-BR9BR-K4R73", "I problemi di compatibilit", " indirmek ve paketini a", "Microsoft.Windows.125.X21-83253_8wekyb3d8bbwe", "=F>k>r>~>", "T$@Ph@", "0$1Z1{1", "7ca7ed4a-4ec0-7589-3069-d1d60741930f", "2?2J2v2", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData", "<**?1?H?N?X?_?u?", "False", "33b20972-e135-5163-b3cf-142956cfafe1", "3,323", "=3>T?", "a01692dd-7387-ddca-858a-ac43c81bf04a", "Microsoft.Windows.49.X19-99503_8wekyb3d8bbwe", "Education", "STATUS_SXS_IDENTITY_PARSE_ERROR", "CDlpActionImpl > > >::CheckUserInterruptEx", "!0'0X0g0|0", "_xe_U", "011f488f-0879-0f54-1e62-cb112b57b05c", "2e6b8e14-c206-b8b1-cd08-5d9d546b6df6", "TYXWC-VNTQ7-6YMHK-PR6XH-VT9RC", "Microsoft.Windows.4.X19-98705_8wekyb3d8bbwe", "Microsoft.Windows.49.X20-25156_8wekyb3d8bbwe", "OneSettingsToolUrl", "rfiler for installasjonsplattform ble funnet. Kontroller pakkeinnholdet.%0", " awarii.%0", "YKMY3-NTHJ6-3GVPJ-R7F93-2WF9W", " pendiente una operaci", "szlelt", "dwBytesRead == dwSizeToRead", "Microsoft.Windows.122.X19-99477_8wekyb3d8bbwe", "Microsoft.Windows.188.X21-99385_8wekyb3d8bbwe", "Pt(Qh", "27934eb0-31c1-8b9d-548b-1ffee3d12740", "y+VhQ", "3N4z4", "2b3331d2-139a-553a-5517-5cf0a53bbe28", "MoSetupPlatform: GetUserPreferenceAccentColor: No accent color found. Using default color...", "WIM\\IMAGE[*]\\HARDLINKBYTES", "Microsoft.Windows.79.X17-53880_8wekyb3d8bbwe", "2#383?3H3M3R3", "tre averti.%0", "Asennusta ei voi jatkaa, koska tarvittava teht", "veteli, hogy a felhaszn", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\WebSetup", "1abbb487-fca6-e737-88e4-dde5b8324fe2", "6c6941f7-3dab-5141-25fb-157e14edbb20", "ZwLoadKey2", "Compatibility: Notify UI that HardBlock status has been updated.", "STATUS_MEDIA_WRITE_PROTECTED", "t$j\\Q", "Microsoft.Windows.7.X21-83730_8wekyb3d8bbwe", "SetThreadpoolTimer", "Enterprise", "The installation progress server is unavailable.%0", "Microsoft.Windows.49.X19-98824_8wekyb3d8bbwe", "PackageMigration: Initializing Removed FODs", "Microsoft.Windows.146.res-v4315_8wekyb3d8bbwe", "resource unavailable try again", "1O1w1", "=9>B>q>", "Brugeren har valgt at annullere reklamer.%0", "8QNHV-HJWXP-XP79V-G8Q87-T269B", "8 8-8H8", "De compatibiliteitsproblemen zijn niet binnen de gestelde tijdslimiet opgelost.%0", "92NFX-8DJQP-P6BBQ-THF9C-7CG2H", "CDlpActionDU::GetResultsDUSetup", "9>9I9{9", "d4345f13-f740-f0d3-feda-1de7eb2f69c5", "dente tentative d'installation est toujours en attente. Un red", "; hash = ", "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)", "1$2>2C2", " systemet til at kunne downloade dataene.%0", "On allocating cbs array", "zupkfb^ZVSOLIEB@=:7520-+)&$\" ", "0(191R1Y1w1", "GKNKW-8BFVQ-7C3WD-J72T9-KQB3F", "9NKWQ-28467-CRMKC-9YB2V-PWF9Y", "DUSetup: Initializing Sqm OptIn Default: [%s]", "TriggerStoragePolicies", "fdacb3d0-6c55-6f94-af46-98d1a39ce4c5", "CDlpActionImpl > > >::Restart", "GetSystemWindowsDirectoryW", "_L0ckW0O0B0", "Microsoft.Windows.48.X20-17625_8wekyb3d8bbwe", "Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe", "GetFileInformationByHandle", "CommandLine", "CDlpActionImpl > > >::UpdateState", "utilityvm", "9M,tN", "G68RM-Q6NMD-X9JPK-7VXC9-JXFB8", "CDlpActionProductKeyValidate::SearchForKeyInPidTxt", "Bugcheck driver class", "@&0_DM", "H79JQ-87NDB-D3Y3T-GDJGV-B7VYG", "Microsoft.Windows.98.X20-00911_8wekyb3d8bbwe", "ivityksen asentamisen suojattua yhteensopivuustarkistusta, ja k", "Bugcheck param 4", "GetLocaleInfoEx", "Microsoft.Windows.49.X20-29594_8wekyb3d8bbwe", "N8HD3-9HMFQ-TVJGC-V6HBQ-4GGBQ", "530d8f12-5f3b-3cc6-ee42-8fb63f29286d", "89DNY-M3VP8-CB7JK-3QGBC-Q3WV6", "lenhetsbeteckningen. %0", "BitlockerPremiumAvailable", "PackageMigration: Initializing LangPack paths [%ld] [%s]", "6-777=7P7", "3HPMV-69NWF-3DRFG-BGBHD-RJRBG", ":8:V:p:", "De compatibiliteitsproblemen voor downloaden zijn niet opgelost binnen de vereiste tijdslimiet.%0", "assertVersion", ";M;c;", "3#3E3h3q3{3", "Microsoft.Windows.49.X20-29593_8wekyb3d8bbwe", "Microsoft.Windows.109.X20-87484_8wekyb3d8bbwe", ":7;:?_?", "Microsoft.Windows.99.X20-29703_8wekyb3d8bbwe", "e54b4853-3984-528f-c123-e05de7124af6", "GetSupportedDriveLetters: Excluding System drive: [%s]", "CDlpActionImpl > > >::DeserializeRoutine", "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\MINOR", "#0=0E0M0U0]0", ".rdata$zETW0", "CDlpActionImpl > > >::GetSerializeOnProgress", "B7T86-NDGHJ-M7J2H-767KR-W8HYQ", "is-IS", "Microsoft.Windows.98.X20-15866_8wekyb3d8bbwe", "9-:m:", "1&121>1h1", "DataMigration: Queue product key into Target OS...", "Stage", "28c8a252-76af-c895-1bfd-d291787f4bc8", " zaman a", "SetupCore: Registered DEBUGGER_OPTIONS action", "7+8w8", "b0ed9a0e-1899-78dd-0745-a2f5137daf73", "ERROR_FAIL_NOACTION_REBOOT", "\\ProgramData", "18596609-ffcf-6ab6-792a-9afabde63ed1", "K93XN-VTF4B-DJWPG-G8Y92-FX8XG", "EA^Wp", "FirmwareBootDevice", "VWj43", "CDlpActionPackageMigrate::GetFODPackagesToRemove", "9`:g:u:", "1?2g2", ";%<: >,class CDlpActionDUFactory,class CDlpActionDU>::SetActionId", "CDlpActionImpl > > >::CheckInitialized", "CDlpActionPackageMigrate::ExecuteRoutine", "L$TQj", "Microsoft.Windows.49.X20-39272_8wekyb3d8bbwe", "ndaren valde att avbryta installationen f", "f4389fdf-6585-07bb-c6bd-60b43186f76c", "5(6F6s6Z7", "dure d'installation est bloqu", "jaYjz^j:Z", "DataMigration: skipping FlightData...", "> >(>@>D>H>L>P>d>h>x>", "Problemerne med programkompatibilitet blev ikke l", "PN44P-9W8RR-T3FVH-2J6PY-43PFY", " avec la configuration minimale requise n'ont pas ", "dc15a0cb-351d-03d3-a0a6-c482c6529a57", "Microsoft.Windows.161.X21-43621_8wekyb3d8bbwe", "5-6S6h6", "5:5L5U5s5", "QRP8G-JNKV9-98H69-GWDRG-PDKRJ", "Microsoft.Windows.100.X20-39262_8wekyb3d8bbwe", "gend Speicherplatz zur Verf", "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)", "ActionListParser::ParsePlan", "63ce0644-8d6a-9bd4-703b-2defad566f8e", "o fornecidas eram inv", "b9f31d56-6f7a-3493-f6c5-d5d1b717f4dc", "hSVW3", "DUImage: Action List Path [%s]", "4C4U4\\4f4", "BDFPV-YNCQW-H9WRJ-9T7GF-QGRBQ", "CDlpActionDiskSpaceReq::ReportStorageReservesTelemetry", "mt-MT", "Target OS: Edition = [%s]", "PMWTN-WT8XM-YCYHT-2MYJR-8B6QX", ":':/:9:G:S:a:i:o:", "vetelm", "ERROR_SERVICE_DOES_NOT_EXIST", " grunn av en manglende systemkomponent.%0", "CDlpActionImpl > > >::Serialize", "5 5@5H5P5X5`5l5", "3N4[4h4", "482e3ada-05f0-d73c-4fef-cc9d8f8d989f", "TriggerStorageCleanup", "CompatInstallRequirement", ":*:1:", "6]7m7", "DiskSpaceDownloadReq: Initializing Timeout in Mins: [%ld]", "Microsoft.Windows.126.X21-83279_8wekyb3d8bbwe", "L'utilisateur a choisi d'annuler le contrat de licence.%0", "9WHvQ", "Los problemas de compatibilidad para la descarga no se resolvieron en el plazo requerido.%0", " jour de l", "GetThreadUILanguage", "4?4t4", "Microsoft.Windows.161.res-v3919_8wekyb3d8bbwe", "operation_would_block", ">!>B>X>", "9,9]9{9", "1A1U1", "Microsoft.Windows.101.X20-15865_8wekyb3d8bbwe", "CDlpActionProductKeyValidate::ExtractEula", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNode", " stato sospeso.%0", "gios iniciais da Configura", " cancelar el proceso porque el sistema no cumple los requisitos de la opci", "ProductKey: Failed to extract key from Host OS. hr=[0x%x]", "CDlpActionImpl > > >::DeserializeRoutine", "VQPWV", "7a7a8af5-2248-ea42-c9a3-edeccf6d375d", "6N3KD-DD7PR-FKKBH-JG3YX-BKMMG", "CDlpActionDU::InitializeRoutine", "DiskSpaceInstallReq: Initializing FOD paths [%ld] [%s]", "GX7WN-2W37Y-W3R6F-RJYRM-6VJVQ", "ndaren ska inte meddelas.%0", "8@8t8", "XHH47-38NK7-4G3VV-Q3YRP-76DD6", "PQQQW", "lemi bilinmeyen komut sat", "9CNGY-6GWHC-XGMT6-77GXH-VT9RD", "31e9a4d1-e7a6-759a-1aeb-332b97591ddc", "n requiere el usuario acepte el acuerdo de licencia.%0", "7E7b7", "IsServer", "SetupCompilationType", "MYJVR-HHN9Q-9BJXB-68F7Q-7T9R2", "MXR8F-33NPH-K4Q6G-K728D-GF4W4", "GetSecurityDescriptorLength", "HYNC4-8VY3W-8MTV6-DBJD3-7T9QQ", "Microsoft.Windows.48.X19-98807_8wekyb3d8bbwe", "lemi, eylem yap", "5a195ed4-4fca-fdb3-3d70-cc5c4080b674", "es-ES_tradnl", "=2>w>", "HNQFF-CPM78-BQJXP-9JRDM-7MJGQ", "bf4901c2-7cc7-910c-a487-484a623c197f", "O(u*g", "DUImage: Populating Image info set.", "='=S=^=", "Compatibility: App Uninstall Block found.", "Microsoft.Windows.145.X21-83689_8wekyb3d8bbwe", "4I5~5", "En eksekverbare GatherOsState-fil har en ugyldig signatur.%0", "o foi encerrado durante a fase de compatibilidade acion", "not a stream", "1!1N1h1{1", "Microsoft.Windows.99.X19-99563_8wekyb3d8bbwe", "8G762-CNJ38-3BWB9-8PXC4-CR64D", "F0Vh`", "7=8D8a8w8", "r installationsprogrammet", "Failed inserting element io cbs array", "2.353}3", "Installasjonen kan ikke fortsette fordi forekomst-hash ikke samsvarer.%0", "PostOobePath", "serverdatacenterevalcor", ":-;4;S;Z;r;y;", "0e9c0996-3d32-3048-df7d-73e4c77d2823", "Microsoft.Windows.49.X20-29596_8wekyb3d8bbwe", "DUImage: Failed to execute FOD search and download [0x%x]", "let-k", "dia.%0", "EnterCriticalSection", "[Blue]", "73d087c9-d25f-3a73-7631-a08c5cc1d902", "036a60cc-a532-0ca7-f912-d81bef42b822", "MoSetupPlatform: Retrieving current boot entry...", "EventUnregister", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@@@", ";%;I;W;k;y;", "1-1F1Z1j1~1", "serveressentialmanagementsvc", "X4JNT-7CWP3-PW82B-XDRVJ-F3PGF", " komentoriviargumenttia.%0", "RtlReleaseResource", " un error.%0", "6)656Z6x6", "0\"0:0?0X0_0", "jljai nem a v", "rminos de licencia. %0", "STATUS_ADVANCED_INSTALLER_FAILED", "CMicrodomBuilder::StartAttlist", "N7FD6-8GC8C-R7MG3-3Q44K-P38WF", "ntat.%0", "CDlpActionProductKeyValidate::InitializeRoutine", "BiUpdateEfiEntry failed %x", "W0j0D0_0", "9S0vmR", "Microsoft.Windows.27.X19-98766_8wekyb3d8bbwe", "Express", "me est insuffisant.%0", "VNJG3-QDK8Q-C3DPY-6HKRM-2PR8Y", "ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT", "69ea8289-c6f3-6b41-e066-c8e6a54953e0", "CDlpActionImpl > > >::GetError", "hrt werden.%0", "S*41C\\", "UpdateMedia: Block reasons = [0x%x]", "Installasjonaprosessen ble avsluttet.%0", "o e o utilizador n", "Microsoft.Windows.4.X19-99697_8wekyb3d8bbwe", "As informa", "96YNV-9X4RP-2YYKB-RMQH4-6Q72D", "PerformSilentCleanup: Failed to run SilentCleanup task: [0x%X]", "Microsoft.Windows.8.X21-83699_8wekyb3d8bbwe", "n y no se debe notificar al usuario.%0", "Microsoft.Windows.121.X20-29552_8wekyb3d8bbwe", "Integer overflow after WriteData", "Egy kor", ":&:6:_:e:|:", "a352ad34-5377-4c8e-fe00-e85e710491bf", "H9NDH-3KJ74-TVB33-R67MG-MKQD4", "stes inte inom den aktuella tidsgr", "n para continuar con la instalaci", "0G1h1o1", "Microsoft.Windows.122.X21-83178_8wekyb3d8bbwe", "3V6Q6-NQXCX-V8YXR-9QCYV-QPFCT", "Microsoft.Windows.8.res-v4306_8wekyb3d8bbwe", "['`1XJT", " des fins de t", "CDlpActionEulaFactory::CreateInstanceRoutine", "NtUpdateWnfStateData", "1!1.1", "Microsoft.Windows.122.X20-21793_8wekyb3d8bbwe", "Unable to delete install failure count REG key. GLE is [%d]", "Microsoft.Windows.100.X19-99464_8wekyb3d8bbwe", "CDlpActionDataMigrate::SerializeRoutine", "MoSetupPlatform: Getting WinREUseNewPBRImage proc address...", "rbara filen GatherOsState har en ogiltig signatur.%0", "D74T9-BHNY9-WB94V-QJKTY-K77YC", "tb9t$", "D$lj PQ", "DUImage: Initializing Facilitator Url: [%s]", "Target OS: Enabling migration of host settings.", "70f8cbed-9b4b-6e5c-cb66-a83eb054a11c", "M66NY-3BVW3-DVBPQ-CQ3C7-B7VYQ", "NMTOKENS", "7T9NV-W7MXB-WJB83-RBQCJ-BWTFK", "252?2", " instalacj", "6$626O6", "CDlpActionImpl > > >::Deserialize", "GetVolumeRootFromPath", "37f71d0b-6a69-4801-d164-3e13b8e5c29b", "586T6", "NFPXB-HRPHT-998P2-WHK3P-FX9XY", "3ee16add-b675-e087-d185-e617cc1a2ebf", "Microsoft.Windows.126.X21-83273_8wekyb3d8bbwe", "Microsoft.Windows.4.X21-05127_8wekyb3d8bbwe", "043acdb7-1984-91af-c6b1-257068578dcd", "MoSetupPlatform: Not requesting install of FOD packages from [%s].", "nimos para instalar a atualiza", ":QVEE", "9w > > >::SerializeRoutine", ".?AV?$CZeroInit@VCDlpResponseAutomation@@$00@@", "RtlCalculateUtf16StringLengthFromLUtf8String", "Microsoft.Windows.4.X19-99709_8wekyb3d8bbwe", "4f981d62-b25d-796d-3b25-23cb94c19b97", "6cd0c78b-055d-8d54-e2ba-76b5f536513a", "1f94ea59-05de-658f-293b-24c363a1e34d", "WWWWV", "CBasicNodeType::ForceValue", "t;f97t6", "r licensvillkoren.%0", " indirmek i", "DecompressChunkedFile failed", "689a423d-2210-5cc4-5cdc-6d06321664ff", "ck(WKm", "?(?h?", "CDlpActionDebuggerOptions::DeserializeRoutine", "REQUIRED", "d196793c-1767-1489-8237-f3991d829267", "8NDWP-X6X8C-GFWXX-4BM6Q-8K848", "$filehashes$.dat", "1\"1)10171u1", "n de la actualizaci", "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X", "De server voor de voortgang van de installatie is niet beschikbaar.%0", "0d2a44b4-605d-3189-959c-3bf8f02b5397", "e wznowi", "SystemTimeToTzSpecificLocalTime", "Microsoft.Windows.125.X21-83237_8wekyb3d8bbwe", "CDlpResponseAutomation::InitializeRoutineEula", "rios obrigat", "b496a9a1-fe98-7a3f-4c7c-b3e40208d89b", "a8a48c62-8886-b0a9-20e1-8c446008b70b", "ZwLoadKey", "Microsoft.Windows.8.X21-83693_8wekyb3d8bbwe", "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputSelectedLang: [0x%X]", ";(;9;I;Z;j;{;", "ExecuteDownloadReq: Trying to use proposed external drive [%c]", "gleges", "1(1,1<1@1X1`1d1h1l1p1t1x1|1", "HN49G-V24KT-T6C2T-WH62T-MKMP3", "LegalCopyright", "PsfSourcePath", ">S>j>q>", "CDlpActionImpl > > >::GetActionId", "Nebyl vytvo", "edinstala", "DYHRN-MM9MT-TMRRW-497WH-6XXTT", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "Microsoft.Windows.101.X19-99648_8wekyb3d8bbwe", " kan ikke behandles i ", "%hs(%u)\\%hs!%p: ", "Y__^[", ":*:N:Y:", "tzVW3", "404971d2-6817-a5a2-1403-a85bff039221", "Expanded", "Finalize: Failed to process persisted telemetry events. hr=0x%x", "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate", "Microsoft.Windows.98.X20-35496_8wekyb3d8bbwe", "towlower", "cb0646aa-cc2a-1355-0317-73277a19c4d8", "4#4z4", "Microsoft.Windows.48.X20-29659_8wekyb3d8bbwe", "File[*]\\Architecture", "BNMVG-QJR9K-B87YR-XYRPR-VMH3D", " konsolideres for telemetriform", "&030j0", "Microsoft.Windows.49.X19-99509_8wekyb3d8bbwe", "Microsoft.Windows.189.X22-09602_8wekyb3d8bbwe", "CompatInstallReq: Initializing FODs Removed: [%s]", "Die Mindestanforderungen zum Installieren des Updates werden vom System nicht erf", "5Qh<|", "1:2E2", "d7fc32dd-52f3-ad23-90e9-260945dc2550", "5!646?6^6", "Servicing\\Editions\\UpgradeMatrix.xml", "KJ8MH-MNJMF-XPRD4-BTT49-MG92M", "SetFileInformationByHandle", "CDlpActionDiskSpaceReq::ExecuteRoutine", "AcceptEula from Response [%s]", "ReadWriteDataInternal", "Microsoft.Windows.100.X20-15868_8wekyb3d8bbwe", "The installation image was not found.%0", "DataMigration: Failed to read WebSetup image location Hr=[0x%X].", "J0m0t0", "8o9v9}9", "qps-plocm", " stato terminato durante la fase di compatibilit", "DriverUpdate", "809:9r9", "|hK,_", "DiskSpaceDownloadReq: Initializing ProposedExtDriveLetter: [%c]", "YT83R-NYG6V-QMHXV-Q6GDY-39G99", "Microsoft.Windows.101.X19-99549_8wekyb3d8bbwe", "ci skr", "Microsoft.Windows.122.X21-03402_8wekyb3d8bbwe", "=F=a=h=n=", "3RKN7-8PWXC-VRKJW-6RRGP-DDBW2", "N7HY3-YHFHM-P6F86-M98CR-KBQHW", "W69BB-N79M9-M223P-JVQDC-JB49G", "Shellbrd", "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX", "uz-Latn", "CMicrodomBuilder::EndElement", "DisableShiftF10", "clouden", ";w(tE", "9'9X9o9v9", "CDlpActionProductKeyValidate::DeserializeRoutine", "Microsoft.Windows.101.X20-29685_8wekyb3d8bbwe", ": :;:B:c:j:", "CDlpActionCompat::GetResultsRoutine", "FLT_INVALID_OPERATION", "cdkHr,g", "E_UNEXPECTED", "A rendszer nem felel meg az t", "CDlpActionCompat::SerializeDownloadReqScan", "Microsoft.Windows.162.X21-43646_8wekyb3d8bbwe", " dans le d", "DUSetup: Initializing IsServer: [%s]", "stico. No se pueden notificar los eventos.%0", "RtlConcatenateLUtf8Strings", "d7dafb96-1180-6946-76e9-d709e770b867", ".rdata$zETW1", "t$Buffer)", "Failed to filter delete element %08x. Status: %x", "FveGetStatusBasicW", " > > >::Initialize", ":9:x:", "rdigg", "213l3", "C743N-RYHH2-YV4JV-GP4HJ-J8HYV", "8N8Y8`8", "3&4W4", "6Q3N8-3R9CG-M8V87-WRVQQ-9766P", "GetCurrentThread", "BJBKV-PQNJV-K4Y3H-4TJB7-CYVKR", "ci z powodu braku sk", "no such file or directory", "a8fb83ec-f4fa-3147-b2cc-655981741035", ".data$brc", ":3:::@:b:i:o:", "232B2s2", "CoCreateInstance", "s rendszer telep", "Microsoft.Windows.101.X19-99537_8wekyb3d8bbwe", "JN9WX-28CF8-YV7CK-WDHHM-8FJV3", "Microsoft Time-Stamp PCA 2010", "j\\Zj:", "8305992b-a37a-66ee-ef9d-d3f542c606b7", "4e6edf56-9c26-5a85-3d34-51fb0777d862", ";3;A;W;e;{;", "5 5(50585@5H5P5X5`5h5p5x5", "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Syspart", "D$(PQ", "CDlpActionFactoryImpl >,class CDlpActionCreateMediaSuccessFactory,class CDlpActionMediaCreationSuccess>::CreateAction", "Het uitvoerbare bestand GatherOsState heeft een ongeldige handtekening.%0", "sr-Cyrl", "Microsoft.Windows.4.X21-05129_8wekyb3d8bbwe", "203q3", "Legal_Policy_Statement", "FindChunkForOffset", "ExpressPackagePath", "999F9", "CDlpActionDataMigrate::MigrateReserveManagerKeys", "Finalize: Error getting narrator running status: [0x%X]", "WIM\\IMAGE[*]\\WINDOWS\\LANGUAGES\\DEFAULT", "r den Download aufweist.%0", "ActionList", "pa-IN", "Microsoft.Windows.49.X19-99506_8wekyb3d8bbwe", "8HFNR-6MYQ7-8B2DM-MB4M8-XW3GP", "lebilir dosyas", " gerekli zaman s", "MH37W-N47XK-V7XM9-C7227-GCQG9", "78bcb07f-e1ff-ea66-9d0f-484d19ebd426", "0475ed62-f64a-f0b5-95cc-0cbedb856c27", "CDlpActionCompat::InitializeRoutine", "PCPB6-8N2D2-YCKBQ-RBHTV-VT9Q6", "DNBM8-2JPG2-MHCJK-4FXTY-G3B7V", "cessaire. %0", "sr-latn-rs", " sistemde disk alan", "c7fcb013-68f2-5a24-db20-68c70b4c92cc", "~h_^]", "1!252;2_2e2", ">&>K>q>", "Microsoft.Windows.189.X22-09604_8wekyb3d8bbwe", "Microsoft.Windows.171.X21-24733_8wekyb3d8bbwe", "ExecutableName: ", "DiskSpaceInstallReq: Initializing LXP License Count [%ld]", "DiskSpaceInstallReq: Initializing UseExtDrive: [%s]", "More payload found than expected", "9t$@t", "686`6", ":(:4:@:L:X:d:p:|:", " pouvant donner lieu ", "Sistem, g", "f6fa7417-496c-dfbe-5979-0b7f0d33945b", "wcscat_s", "Installasjonsprosessen ble startet med et ukjent kommandolinjeargument.%0", "GD7KH-DV2JH-NX4JF-42MTJ-9TP8T", "0O0o0", "WriteData failed during NULL block copy", "81579925-db7e-1da6-db6e-a0be8c2d6907", "t$ > > >::Cancel", "1+121S1Z1_1e1t1{1", "Microsoft.Windows.145.X21-83695_8wekyb3d8bbwe", "PQ6NX-BHK88-86J9G-7FWM9-6CJYT", "advapi32.dll", "Specifying Compat MigXml file: [%s]", " form", "onecore\\base\\xml\\udom_microdom.cpp", "8:8Y8v8", "Microsoft.Windows.50.X21-83776_8wekyb3d8bbwe", "FACILITY_FILTER_MANAGER", "BGQ3W-4N7FY-VDT2P-J43GQ-FM49G", "Das System hat die Ger", "=,>9>@>", "2@2d2", "908da6f0-5510-92f9-bc23-555a9ddbb455", "~49~8t", "65952d75-2e77-a8d9-94f4-b10ecc2d3151", "6 60646D6H6X6\\6l6p6", "530f41fb-17ef-84f0-c7ef-a88e015d4dc9", "Microsoft.Windows.125.X20-35518_8wekyb3d8bbwe", "Gerekli bir g", "f56cc560-fd36-1d29-727d-dc1a7cb05817", "tot.%0", "Microsoft.Windows.101.X20-39247_8wekyb3d8bbwe", "PerformSilentCleanup: Calling TriggerStoragePolicies.", "72c095ba-cfc8-5c45-f7a1-d272ee042deb", "XVNRV-9HTX4-TH2JD-HVJQD-QRQWG", "maya y", "RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )", "JF4ND-8K7CW-96P84-DT2RX-9HFFK", "RtlInitLUnicodeStringFromUnicodeString", "8b0b5353-7e24-2d16-2e06-0db548937938", "1b7b551a-f4d4-8604-c60d-f6b2ee9328d8", "DUWorkingPath", "Server.OS", "=,=8=X=`=l=", "DiskSpaceDownloadReq: Initializing Required Free Space: [%ld]", "\\$4Sj", "2#232:2I2P2`2g2", " gestita per l'installazione dell'aggiornamento e l'utente non deve essere notificato.%0", "Windows::WCP::Implementation::Rtl::ParseDottedVersion", "6VVFQ-NHJC6-K7D39-83VG8-JFG44", "ERROR_BAD_ENVIRONMENT", "NGH86-TGPJY-J836V-RXQ8R-JHQJ8", ";=<_<", "DiskSpaceInstallReq: Initializing AllowUninstall: [%s]", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem", "N2KJX-J94YW-TQVFB-DG9YT-724CC", "Global\\WdsSetupLogInit", "c1c2d1da-5747-c668-a25e-4cde5c0e1d39", "CDlpActionFactoryImpl >,class CDlpActionEulaFactory,class CDlpActionEula>::CreateAction", "ckgegeben.%0", "CompatInstallReq: Initializing SKU Key No License: [%s]", "1a4738f6-9034-09d0-5fb7-64b93b780673", "CXmlCursor::CompareStrings", "SYSTEM\\Setup", "CDlpActionImpl > > >::PreInit", "FLT_OVERFLOW", "DUSetup: DUOptin from Response [%ld]", "ltige Signatur auf.%0", "PXYNJ-FYCDY-P3KKV-V6B9T-8TY6Q", "Microsoft.Windows.100.X20-29709_8wekyb3d8bbwe", "Binding EFI namespace objects", "NFF4H-MMXBC-P46DX-4GYT4-3DDFW", "71437f58-9fa6-c10a-c65e-31ac0430d49d", "Microsoft.Windows.27.X21-03402_8wekyb3d8bbwe", "Found %d processes using this file.", "D$hPW", "CDlpActionDiskSpaceReq::GetResultsDownloadReq", "MediaType", "7(7,7D7T7d7h7x7|7", "o atende aos requisitos m", "5:5s5", "1+1N1o1", "trehozva. Nem siker", "PRO_N", ">3>^>", "6m6{6", "58b4dfc5-0018-202e-f99e-24dfb7c55c21", "110cbaf0-acb2-3c6b-90fc-868cf23e338d", "=,=8=X=`=h=p=x=", " continuare perch", " stata trovata alcuna offerta che corrisponde ai criteri richiesti.%0", "berschritten.%0", "Microsoft.Windows.126.X21-83176_8wekyb3d8bbwe", "4J87H-N2833-6PCWF-7HWFF-2KCKR", "CDriverCallback::ValidateDriverPackage: Override answer - DO NOT migrate this package", "O(ug0M0~0[0", "6abbe9f9-4919-88b6-b60a-1cc394a4d4ad", "?!?+?2?9?@?G?", ":#:D:O:l:q:", "f1741714-d6c8-326f-c8c9-4c64c5064529", "HM3NG-HXCBR-B3BCG-X9MVG-GMWVQ", "Microsoft.Windows.98.X20-00899_8wekyb3d8bbwe", "onecore\\internal\\base\\inc\\rtl_object_library.h", "_u&A;", "hrt werden oder hat einen Fehler zur", "Microsoft.Windows.101.X20-29629_8wekyb3d8bbwe", "STATUS_NOINTERFACE", "wcsrchr", "7J8p8", "SLC.DLL", "Der Benutzer hat den Vorgang abgebrochen, da das System die Ger", "GDRCount", "Konfigurasjonsfilen for installasjonen er tom.%0", ".?AVCDlpActionSummaryFactory@@", ".text", "!>'>", "Microsoft.Windows.101.X20-00901_8wekyb3d8bbwe", "es de compatibilidade n", "Finalize: Error setting environment variable SP_UPLOAD_ASIMOV. GLE = [%d]", "Microsoft.Windows.4.X21-03403_8wekyb3d8bbwe", "55a63838-7b8a-b658-6dd5-adc84a088a46", "e0df8301-f297-e6fe-b881-0b6442005946", "ProductKey: Using existing image selection response (product key deferred).", "r mehrere Architekturen werden vom System nicht erf", "mi podm", "PreFinalize: Initializing PostOobe Registration Path: [%s]", "PerformSilentCleanup: Error reporting telemetry for OSPARTITION_SPACE_FREED_UP_STORAGE_CLEANUP: [0x%X]", "Software\\Microsoft\\Windows\\CurrentVersion\\ReserveManager", "Microsoft.Windows.4.X20-00860_8wekyb3d8bbwe", "098c46c3-2bad-7c87-09de-34d7a5383606", "nda ge", "trie. %0", "d608699e-bc5f-7b7a-0150-63e40240b3c9", "N+@:81J", "0PQQj", "DUSetup: Opted-out of DU and telemetry due to DoNotConnectToWindowsUpdateInternetLocations policy regkey", "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild", "Es wurde kein Ziellaufwerkbuchstabe gefunden. %0", "Kurulum Platformu belirtilmeyen bir hatayla kar", "=(=y=", "9':B:Z:", "|$HSQ", "ersiz bir komut sat", "Not-null check failed: pOutputStream", "10.0.19041.572", "NF3C7-QJCH4-XMB9G-HT9HK-HCFJX", "e6f7833e-9de3-1f80-7aae-3429a4ea396d", "jet underst", "2\"2(2W2b2}2", "Trimming remove action for package: {0}, because there is a related add package: {1}", "2.3o3", "IsWow64Process", "MigChoice: Initializing Wim Ref paths: [%ld] [%s]", "SetErrorMode", "L$$_^[3", "Microsoft.Windows.48.X20-39271_8wekyb3d8bbwe", "ration Windows (WinRE) ne peut pas ", "8;8P8_8j8r8{8", "Microsoft.Windows.122.X19-98696_8wekyb3d8bbwe", "4be79be7-7373-edc2-f333-d00557434d0f", "46J3N-RY6B3-BJFDY-VBFT9-V22HG", "PackageMigration: Initializing FOD paths [%ld] [%s]", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS", "ded3b75a-e0c9-a3b8-b853-2a5351b79ad6", "b6f9e826-ff41-69d7-0394-938a6de64a00", "8d784be4-a24a-771d-c20f-7777e4cd2200", "Microsoft.Windows.146.X21-83742_8wekyb3d8bbwe", "b7ceaa0e-5652-00a9-90c8-c592212c0857", " przerwa", "Microsoft.Windows.8.X18-81311_8wekyb3d8bbwe", " avbryte fordi systemet ikke best", "Microsoft.Windows.121.X20-46572_8wekyb3d8bbwe", "MoSetupPlatform: Setup Platform object created!", "? ?$?", "installation ne peut pas continuer, car le code de hachage de l", "TGWNR-T88HF-DKKP7-Y8Y88-GVJVW", "3)3/3L3R3l3x3", "D$(SVW3", "SetFileAttributesW", "co-FR", "f2f3425d-452a-ccbe-ac80-aa86fb98ff27", "5$5,545@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "CompatFinalizeReq: Initializing Build [%d]", "3DB6N-YXFXK-PFHGQ-C8QB2-TMWXD", " zawarto", "vel GatherOsState.%0", "6b8028f4-0edc-3ecc-8e7d-592d697bab36", "si folyamatot megszak", "CDlpActionDiskSpaceReq::CalculateRequiredDiskSpaceInstallReq", "VJ9TN-XPWV7-HPC8T-92YQ4-F6YMG", "File[*]\\Key", "%016I64x", "jQh(U", "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0", "0%0Q0\\0", "ServerHyper", "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)", "ProductKey: Product key has a block.", "?-?A?S?Y?b?m?t?y?", "Y24GV-NQ97Y-VP3KD-7CMYT-D3WVD", "5c7j7}718", "Microsoft.Windows.48.res-v3556_8wekyb3d8bbwe", "BXX9H-RKNX6-DQFRR-3737W-9TRB6", "<5=x=", "Microsoft.Windows.101.res-v3261_8wekyb3d8bbwe", " di destinazione. %0", ";)4H4]4d4l4", "CDlpActionDataMigrate::MigratePrivates", "sms-FI", "DCC6N-X83T4-DTH4H-4KH4W-TQ78X", "Der er ikke diskplads nok p", "TFKN7-3BRDR-9H7CY-XXQQ4-YTDX2", "CDlpActionFactoryImpl >,class CDlpActionGetWebSetupUserInputFactory,class CDlpActionGetWebSetupUserInput>::CreateAction", "a11549d4-7247-fc23-085c-cfe6aa738bf4", "ImageDeploy: Initializing CompactOS: [%s]", "?>?I?u?", "WIM\\IMAGE[*]\\DIRCOUNT", "ddc422e2-1615-e74d-228f-268b3376a5b5", "3X99J-PND6M-WWTJQ-TQGXY-HVCHV", "CDlpActionDU::DeserializeDUImage", "CDlpActionMediaCreationSuccess::DeserializeRoutine", "9b21e00a-9feb-ad05-df0f-e9154c11edcf", "Brugeren har valgt at annullere, fordi systemet ikke opfylder minimumskravene til installation af opdateringen.%0", "Microsoft.Windows.48.X20-17628_8wekyb3d8bbwe", "Microsoft.Windows.164.X21-06159_8wekyb3d8bbwe", "Microsoft.Windows.99.X20-15873_8wekyb3d8bbwe", "Restart", "eab3cef4-6771-c2f3-5211-f878a38592f4", "NtOpenProcessTokenEx", "SyspartIsSpace failed for %s", "n deseada.%0", "C,!s4", "nimos para la descarga de la actualizaci", "kkelig diskplads til installationen.%0", "TH4GN-T267P-HW64M-R934Y-7MHX6", "nky. %0", "si folyamat fel van f", "\\Program Files\\WindowsApps\\", "in kurulumun daha g", "FLT_STACK_CHECK", "> ?A?H?R?e?", "_vsnprintf_s", "0\"000", "Microsoft.Windows.101.res-v3572_8wekyb3d8bbwe", "739dcd23-97df-af63-1af6-f94bd133e199", "243:3G3S3]3", "D$|PQ", "Microsoft.Windows.98.X19-99591_8wekyb3d8bbwe", "Warning,", "9#:A:_:", "ErrorState", "561b9f00-654a-9cef-9575-35dac181caf3", "C9G9V-2NPKQ-TC2FF-KKPVC-P92JW", "393b1e43-e854-9ccc-ac7d-9b0d820f2628", "7TVXR-N8YTY-WWY2G-CX96R-9W4FJ", "Microsoft.Windows.48.X19-98803_8wekyb3d8bbwe", "8ae1a1e3-1e69-7ba1-3f1e-3073415cdcf2", "VN9WJ-3VGYC-PPFYD-82RBB-BBJGP", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "6888e63b-32a6-266a-995b-e4f33cb6537e", "GetLengthSid", ">[_^]", "BN6W9-JDGFQ-FW483-V4MB7-MBJGP", "onecore\\base\\xml\\parsergenerator\\lib\\xpgutil.cpp", "*** Assertion failed: %s", "Microsoft.Windows.4.X21-05136_8wekyb3d8bbwe", "= >A>P>]>x>", "9d297f82-7f98-a676-4bfc-f2da1ebc0229", "Il sistema non soddisfa i requisiti minimi per l'installazione dell'aggiornamento.%0", "5K5U5", "%I64d", "9O9~9", "Microsoft.Windows.48.X20-32155_8wekyb3d8bbwe", "Microsoft.Windows.4.X19-99702_8wekyb3d8bbwe", "2>7E7$9%<", "CDlpActionImpl > > >::UpdateState", "address_family_not_supported", ";0;;;", "ExternalDriveUsed", "DiskSpace: Post upgrade free space percentage: [%llu] MB", "ERROR", "6fd0fba3-ac21-cd9b-95d3-7dd1d236f4d6", "GetSecurityDescriptorOwner", "DebuggerOptions: Initializing Debug Bus Params: [%s]", "918299db-faa5-825f-ee07-9a4468e8352c", "Microsoft.Windows.101.res-v3570_8wekyb3d8bbwe", "6S6v6", "GetTimeZoneInformation", "Microsoft.Windows.4.X19-99682_8wekyb3d8bbwe", "4U4d4t4", "64af8ca5-a5a0-690d-d0af-57c03f6cb89b", "Microsoft.Windows.4.X19-99677_8wekyb3d8bbwe", "n finaliz", "4F6M6b6r6", "Microsoft.Windows.98.res-v3270_8wekyb3d8bbwe", "6TP4R-GNPTD-KYYHQ-7B7DP-J447Y", "K3QRN-RMXRR-DDY22-PDB6G-683XF", "6HCN4-DHPFG-XMVQJ-KJ3FW-78Q93", "b19456d1-f62c-30d0-06e5-92a7f6d344ff", "WDBN4-M33XM-48H6F-Y74TB-X4TP2", "9*:f:", "Microsoft.Windows.188.X21-99383_8wekyb3d8bbwe", "ar-YE", "936477ce-9401-be8c-ed58-b386fd57a4a4", "A preinstall script failed to execute or returned an error.%0", "DiskSpace: Required disk space from SP: [%llu] MB", "Microsoft.Windows.27.X19-98749_8wekyb3d8bbwe", ".?AVlogic_error@std@@", "2\"2-2;2E2\\2b2l2", "4DJYP-2NVY6-R2GJ9-PBMDV-DRR73", "T3NJV-7X6JX-V7HRD-7TMKD-YBH23", "2%222b2", "fAlreadyExisted", "TJ6TN-FHXJG-YGKX9-3TQ7D-G83D6", "=^=v=", "bee47dbf-17fc-f0eb-679f-677d127ffd3b", "CheckDiskSpace: Error reporting telemetry for EXT_DRIVE_FREESPACE: [0x%X]", "CDlpActionFinalize::DeserializeBootFinalize", "L'eseguibile di installazione non ", "Microsoft.Windows.22.X18-81295_8wekyb3d8bbwe", "PVVVVh", "07627a21-3c49-b6ae-3dd0-7ba104418691", "Automation: Registered MIGCHOICE Response", "CDlpActionFactoryImpl >,class CDlpActionDebuggerOptionsFactory,class CDlpActionDebuggerOptions>::CreateAction", "0F1Q1_1", "A rendszer nem felel meg az adathordoz", "Microsoft.Windows.99.X19-99656_8wekyb3d8bbwe", "system", "0U0~0", "ImageFinalize: Initializing Extended: [0x%x]", "0c599bd9-67dd-f575-eade-643711673982", "NT4CF-K26Y7-BBKBT-7CMJ3-M7VY6", "Der blev ikke fundet et destinationsdrevbogstav. %0", "o pode continuar porque uma opera", "c1b5512e-912c-d7d1-4991-7c7ef5583f9a", "892a8101-0d5b-d0de-9bc2-db4118ed5f21", "1(1/1@1Q1", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "RtlXmlDestroyNextLogicalThing(this)", "T > > >::Pause", "The installation executable was not found.%0", "84d03470-29bc-75b1-add9-0cae3bc17ba6", "NHr,g", "BootFinalize: Initializing SQM: [%s]", "@_^[]", "Finalize: Finalizing the deployment of the new OS", "1i152l2", "8 8$8(8,8084888<8@8D8H8L8T8l8|8", "fbf5ca2d-b8b7-cae4-5660-043932da6310", "m limitu reklamu.%0", "y/VhHQ", "7%8Q8}8", "CompressFileBackedByWim", "CDlpActionImpl > > >::CheckUserInterruptEx", "34WMX-7NV29-GCXJX-TPHXB-VQWVT", "041204B0", "466c5e18-450d-99e3-9d2a-d72cec734277", "Microsoft.Windows.125.X21-83230_8wekyb3d8bbwe", "Microsoft.Windows.125.res-v4248_8wekyb3d8bbwe", "7HBDQ-QNKVG-K4RBF-HMBY6-YG9R6", "<'=A=", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatAction@@@@@@", "7I7Q7Z7b7r7", "Microsoft.Windows.50.X21-83774_8wekyb3d8bbwe", "ffades.%0", "NHJ23-Q3MBT-9TW8K-R39KV-94T4D", "R7NF4-FB42P-TMDF8-TKYHG-KTPJK", "Microsoft.Windows.8.X18-78293_8wekyb3d8bbwe", "ce14a187-835c-7270-6fcb-602268e16063", "|$ +D$4;D$L", "Saved device scan result at : %s", "4(4U4", "25ea8193-f7f3-e032-fe1f-753719340d8d", "GetFileContents", "PNJTQ-7MFX9-CVF69-2BJCP-KW4FT", "DeferEula from Response [%s]", ">#><>C>[>", "aa7f433b-3137-5f8e-bb36-a8d576843324", "%s: Entering Execute Method", "Microsoft.Windows.48.X19-98799_8wekyb3d8bbwe", "bbeb2b03-f9d6-cb96-9d24-37a880f01aa0", "GetModuleFileNameW", "92b74606-d291-8d47-ab15-15bd95d081c7", "CDlpActionDiskSpaceReq::SerializeDownloadReq", "NQ2H6-X7Y93-H6RWK-PCTQC-3YJWD", "Een success-script kan niet worden uitgevoerd of heeft een fout geretourneerd.%0", "Target Image: Architecture = [%d]", "De compatibiliteitsproblemen voor minimumvereisten zijn niet opgelost binnen de vereiste tijdslimiet.%0", "8.8K8r8", "lle ei tule antaa ilmoitusta.%0", "Compatibility: Starting Wait", "t a nainstalovat image pro tento syst", "CDlpActionFactoryImpl >,class CDlpActionUpdateMediaFactory,class CDlpActionUpdateMedia>::CreateAction", "me. %0", "dd3e4a20-2e8e-2200-1d80-7a9f51df37a4", "6V268-4N9HR-2YD74-XTGTT-H8T73", "0&0L0W0w0", "Not-null check failed: DataBlock", "GetFileSize", "Microsoft.Windows.98.X19-99587_8wekyb3d8bbwe", "FWW6F-BMN4Y-VJ2C2-D3XKH-VT9RG", "bdb94eca-2cfc-0c73-ed76-7c79ca34d429", "n binaaritiedostoista. Tarkista paketin sis", "L'utilisateur n'a pas accept", "6(737X7c7", "2!2.2H2", "homebasicn", "CDlpActionFinalize::DeserializeImageFinalize", "Microsoft.Windows.8.X18-81283_8wekyb3d8bbwe", "Microsoft.Windows.98.X19-98882_8wekyb3d8bbwe", "Proces instalacji jest u", "SetupCore: Registered DATA_MIGRATE action", "lemi i", "image d", "professional", "DUSetup: Unpacking DUSetup updates to %s ", "CDlpActionImpl > > >::GetResults", "3320b35f-7ff0-becf-6aa1-0175877f6f70", "4D4O4{4", "6YDB8-N9JVF-PWCX4-G9RQY-8FHY3", "Integer overflow after ReadData", "Microsoft.Windows.126.X20-00860_8wekyb3d8bbwe", "CMicrodomBuilder::ConsumeComment", "m prost", ">:?}?", "MigChoice: Location where selected install choice found: [%ld]", "9^(teh", "UpdateMedia: Initializing UpdateMediaOptInDefault: [%s]", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName", "zh-Hant", "ad13527a-3945-c9a6-f889-2564adff724a", "242\\2", "RtlIsMicrodomUpdateContextValid(TheContext)", "4$4^4", "CDlpActionImageDeploy::ReportImageInfo", "RtlGetCharacterSetDecoder", "PhMSDM", "CDlpActionImpl > > >::SetParameters", "Microsoft.Windows.100.X20-29652_8wekyb3d8bbwe", "2711a61e-4fdb-c5c7-6d0a-a23a5078af86", "STATUS_OBJECT_NAME_NOT_FOUND", "1o1u1{1", "Flight-id'et er tomt.%0", "FinalizeExit", "De gebruiker is niet binnen de vereiste tijdslimiet akkoord gegaan met de aankondiging.%0", "O arquivo de configura", "No se encontr", "Microsoft.Windows.49.X19-98864_8wekyb3d8bbwe", "ijal v po", " stato eseguito o ha restituito un errore.%0", "Microsoft.Windows.125.X21-83261_8wekyb3d8bbwe", ":::U:}:", "gd-GB", "x*h@D", ".?AVCDlpActionAdvertiseFactory@@", "741a45a5-a7d2-c55d-2897-50a9633615ad", "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)", "3cd9f349-08ec-7091-b735-90078bb772bc", "265b78c7-3bda-8847-5514-6c5b14afca60", "not a socket", ".?AV?$CZeroInit@VCDlpActionGetWebSetupUserInput@@$00@@", "FACILTIY_MUI_ERROR_CODE", ".?AVexception@@", "misvaihtoehdon vaatimuksia.%0", "ak. Ellen", "e979be29-9c63-a516-83fb-40747e27afc4", "CDlpActionPackageMigrate::SerializeRoutine", ".data", "3N3Y3", "nea de comandos no v", "d093d17b-dd5a-f540-defc-74cbe63ba66d", "6PDNC-RCFJJ-H6K7C-MWRWY-FF8JX", "CDlpActionFactoryImpl >,class CDlpActionFinalizeFactory,class CDlpActionFinalize>::SetActionId", " bozuktu.%0", "Microsoft.Windows.101.X19-98869_8wekyb3d8bbwe", "021E1", "CDlpActionProductKeyValidate::SearchForKeyInSkuLib", "Microsoft.Windows.42.X14-19709_8wekyb3d8bbwe", " ett ospecificerat fel.%0", "Eula: Eula File Path: [%s]", "o pode continuar porque est", "alable n", "Microsoft.Windows.100.X20-29716_8wekyb3d8bbwe", " Eula", "7903d126-2405-8df0-586e-6d8877d86549", "MigChoice: Selected install choice: [%ld]", "ExecuteInstallReq: Error reporting telemetry for bSpaceReqBlock: [0x%X]", "CDlpActionImageDeployFactory::CreateInstanceRoutine", "Microsoft.Windows.17.X17-66963_8wekyb3d8bbwe", " instalacji z powodu braku wymaganego zadania.%0", "8ed16054-b812-aa7d-85ad-24f4e0f29b08", "yla birle", "rio usou a linha de comando setup.exe para fazer somente verifica", "81b602a0-509e-816d-37a8-05c0c03acd17", ",f~|z[WP", "9C0t ", "XGVPP-NMH47-7TTHJ-W3FW7-8HV2C", "nama ortam", "NBTQ7-XRQ9R-GXK6H-Y62RX-QV7PK", "exploitation Microsoft", "Microsoft.Windows.100.X19-99457_8wekyb3d8bbwe", "8N3M3-KQXF4-HHQ4Y-WRGXH-463GV", "1R1]1d1", "La proc", "4-4n4", "Nn0OUL", "Not-null check failed: ComparisonResult", "CDlpActionFinalize::UploadAdditionalSqmToSetupPlatform", "RGN8P-66G78-QBGVD-VY73P-FX8V6", "F8NYP-GYGDR-8C6BC-9FHMJ-K2FBX", "Microsoft.Windows.100.X19-99434_8wekyb3d8bbwe", ";I;h;", "Microsoft.Windows.48.X19-98814_8wekyb3d8bbwe", "MoSetupPlatform: Setting Watson bucketing parameter -> [%d]=[%s]", "CDlpActionImageDeploy::CancelRoutine", "ZwDeviceIoControlFile", "4.43494M4R4^4o4w4", "InstallationType", "C92DR-NKFCM-QQV84-P9HBG-RRJYR", "RN7HF-W962Q-329TQ-GH4B3-Y4G6Q", "N4XM6-FYMQM-8K2CG-D6DDH-RGF9C", "ponse du serveur est incorrecte.%0", "y/VhV", "CDlpActionFactoryImpl >,class CDlpActionCompatFactory,class CDlpActionCompat>::GetActionId", "Microsoft.Windows.4.X21-83177_8wekyb3d8bbwe", "VBJPB-NVV3Y-3XGWX-79GDQ-MDWVG", "4,434e4", "Microsoft.Windows.172.X21-24709_8wekyb3d8bbwe", "hu-HU", "Microsoft.Windows.101.X19-99542_8wekyb3d8bbwe", "beb015c9-08a9-2940-41af-4fcbb24710b5", "27738001-6dbe-7009-bb4b-21b600ce7141", "*ppObject = State->m_pAllocator->Allocate()", " une action.%0", "MVTXD-8N8H9-X2RY8-C28V8-W4633", "G43BN-4MD4H-MDCFH-PCCGY-92FVW", "Could not query file size for {0}", "=4=8=P=T=X=\\=`=d=h=l=p=t=", "App block found: [%s]", "BcdGetElementDataWithFlags: Failed to open key.Object: %ws Type: %ws Status: %x", "XFRQW-P8NBD-VFRFX-V2GDD-B98XJ", "ERROR_SHARING_VIOLATION", "Microsoft.Windows.188.X21-99370_8wekyb3d8bbwe", "re vonatkoz", "3!3A3[3", "haw-US", "A setup.exe parancssori futtat", "az-Cyrl", "DownlevelProductName", "header type/size mismatch", "9bc9e33d-de99-85e3-5fc1-36f8a150b5d9", "El sistema no cumple los requisitos m", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "CDlpActionImpl > > >::PreInit", "MWYTD-X8Q89-HTPBF-V3GYX-4V6XW", "?(?4?T?\\?d?p?", "N9VXB-H6WXT-HBMGX-K3WKJ-MTBP2", "sa csak ellen", "CDlpActionImpl > > >::GetActionName", "o foi encontrado.%0", ":,;3;<;I;", "DUSetup: Unpacked DUSetup Updates. Setup will be restarted.", "285c6b05-d723-801e-63e8-ecf28715fb12", "tjuk a telep", "1)1f1", ";7;<;H;`;", "SearchLocation", "68211120-e96f-cc7d-f73c-902f42a2ea5d", "1e258837-a89c-5d3d-74a1-f783947ac97b", "TheEndElement = this->AllocateStreamObject()", "7A7O7@8", "Keyform", "ProductKey: EI.cfg file did not contain an install channel.", "a5dacf6a-c950-dc54-1c2d-94ce092bbb09", "Microsoft.Windows.48.X20-29653_8wekyb3d8bbwe", "CreateFileMappingW", "O execut", " operacji finalizacji.%0", "Microsoft.Windows.100.X20-29713_8wekyb3d8bbwe", "880b245d-9556-9beb-eabc-f1aae20ea9fa", "CloseEncryptedFileRaw", "XDWQ9-DDNCH-CY4WT-KXWBG-2373P", "3HT3D-MN7HX-8K27D-QMM37-JQKQ6", "Microsoft.Windows.99.res-v3423_8wekyb3d8bbwe", "2e25a585-4505-bb00-6373-caafe0d0bc83", "SLGetSLIDList", "Finalize: Converting [%d] downlevel ticks to seconds...", "L'utente non ha accettato l'annuncio entro il limite di tempo richiesto.%0", "ImageExit: Initializing Target: [%c]", " des fins de test.%0", "Systemet oppfyller ikke kravene for det valgte overf", "CDlpActionPreFinalize::InitializeDriverMigration", "Die Installation kann nicht fortgesetzt werden, da beim Finalisieren das zuvor gestartete Update nicht fortgesetzt werden kann.%0", "KNVVP-6PX6M-W9FDR-TQ496-9KYRP", "=;>D>I>`>", "sr-Cyrl-CS", "Windows::Rtl::CRtlObjectTypeDescription::CreateTearoff", "GetCurrentProcessId", "b2130469-0378-d87b-2a1c-e9f9c2b8e4da", "ProfessionalWorkstation", "Microsoft.Windows.125.X21-03400_8wekyb3d8bbwe", "CWHNV-R8QM6-8JQM8-4874Q-GF4TP", "Microsoft.Windows.126.X21-83282_8wekyb3d8bbwe", "Microsoft.Windows.4.X19-98699_8wekyb3d8bbwe", "ResNodesLoad", "KN6V4-GPDQY-HYMV2-M38RK-T83D8", "Los problemas de espacio en el disco de instalaci", "Identyfikator pakietu testowego jest pusty.%0", "Microsoft.Windows.99.X20-29700_8wekyb3d8bbwe", "ProductKey: Error reporting telemetry for m_shEditionId: [0x%X]", "BCryptGetProperty", "Impossibile visualizzare il report di compatibilit", "Microsoft.Windows.50.X21-83766_8wekyb3d8bbwe", "405M5d5", "4a12d14e-b753-e6ec-7063-3affc3de6814", "u#j~hP", "W0~0[0", "ks-Arab", "<#=/=g=q=", "INVALID_HANDLE", "Microsoft.Windows.98.X20-35498_8wekyb3d8bbwe", "ImageFinalize: Initializing Enterprise Attribution: [%s]", "ca39f679-5717-4c8f-c82e-9a5d352ecb9f", "Microsoft.Windows.4.X19-98710_8wekyb3d8bbwe", "Target OS: Disabling migration of host settings.", "CDlpActionFinalize::SerializeImageFinalize", "Nem a v", "El archivo de configuraci", " || LogMessage: ", "*ppObject = State->m_pAllocator->Allocate()", "T2B3W-RJN32-32HFV-82TKM-K7Y9G", "Microsoft.Windows.165.res-v3794_8wekyb3d8bbwe", "o inesperada de bin", ".idata$4", "e055fe7a-6220-2293-1814-0d8e8088255b", "3V5M6m6t6+7", "Microsoft.Windows.146.X21-83745_8wekyb3d8bbwe", "J7728-RHNBP-X8XYD-H9P7R-VMKRV", "serverazurenano", "TargetName", "NVRRD-FG4TH-V8V63-CHDB4-R3KR2", "ImageDeploy: Initialized the NewSystem object", "CDlpResponseImpl > > >::DeserializeRoutine", "3)3?3s3", "en-GB", "324v4", "~(u7b", "Recovery: Examining Offline OS: [%s]...", ".?AVCMoOnlineStore@@", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "CompatMigrationChoice", "4c747df9-ab56-cd62-ba2e-cf41957fecd2", "DiskSpaceInstallReq: Initializing LangPack Count [%ld]", "8 8?8a8q8", ";0;:;D;N;X;b;", "o corresponde.%0", "5[6.7", "c6d71333-0efa-4192-1388-07b002457eb6", "6N6o6", "<)<2m_pAllocator->Allocate()", "el-GR", "in ge", "8db8c511-02ff-d1bb-4179-41c1ec35d3b6", "VSh0%", "Microsoft.Windows.145.X21-83688_8wekyb3d8bbwe", "CDlpActionGetWebSetupUserInput::GetResultsRoutine", " stato avviato con un argomento della riga di comando sconosciuto.%0", "1'2O2", "9:9^9h9", ";-;8;d;o;", "Microsoft.Windows.8.res-v4305_8wekyb3d8bbwe", "MigrateDriversDefault", "PackageMigration: skipping critical update packages...", "CDlpActionProductKeyValidate::FindMatchingImages", "8-8n8", "Compatibility: Creating RegKey for Driver Reflect", "15cced35-e3d9-187a-581d-2661ca5db923", "MVRWT-69NTQ-GVC6B-H6Q23-JT2M8", "ImageDeploy: Created Setup Platform", "CompatIssuesFound", "sr-BA-Latn", "%BASE_N%", "ko-KR", ".?AV?$CZeroInit@VCDlpActionUpdateMedia@@$00@@", "PackageMigration: Initializing LangPacks Path: [%s]", "BNYY9-422WC-Y3K9J-B6DB4-R3KQQ", "jra kell ind", "58625109-8bde-ecbc-0198-92d05a7a233e", "InitLZMSDecompression", "Zu,A;", "DUSetup: Invoking download on Payload SetupDU", "8ce91d7f-531b-98b7-c922-32c54bc5eea7", "CDlpActionEula::InitializeRoutine", "GetCurrentDirectoryW", "LXPLicensePaths", "97:>:", "CNH8T-Q7JMM-4M8BY-3FVDX-2YT63", "Microsoft.Windows.101.X20-44908_8wekyb3d8bbwe", "WINDP", "?what@exception@@UBEPBDXZ", "de-AT", ";$;7;>;o;", ".?AV?$CZeroInit@VCFCPayloadDUCallback@CDlpActionDU@@$00@@", "es-PE", "7f09bbc0-3bf5-ea0c-1f31-13deab161c06", "VW3XX-NY4T6-Q79C2-GC6M2-3YJWC", "FACILITY_TRANSACTION", "CDlpActionDiskSpaceReq::SerializeInstallReq", "CreatePath: Unable to create [%s]; GLE = 0x%x", "G4N9R-HX2VG-633R6-6P84P-PGY6Q", "Microsoft.Windows.48.X20-29559_8wekyb3d8bbwe", "ytkownik wybra", "La respuesta del servidor tiene un formato incorrecto.%0", "&0F0v0", "869|9", ":U;\\;", "YC7N8-G7WR6-9WR4H-6Y2W4-KBT6X", " Microsoft Corporation. Kaikki oikeudet pid", "DUImage: OsBranch: [%s]", "7f7q7", "lise do dispositivo para instalar a atualiza", "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control", "DXH3Y-8N27T-MJVDQ-WP3J6-683XY", "Microsoft.Windows.121.X19-98675_8wekyb3d8bbwe", "%s | %s", "si folyamat ismeretlen parancssori argumentummal indult el.%0", "=/=9=", "UpdateMedia", "OnlineRollbackArgsUser", "pToInsert != 0", "ZwWaitForSingleObject", ">3?b?u?", "D$TPQQ", "5298a995-209f-7023-95f5-99695691f69b", "installation ne peut pas continuer, car la finalisation ne peut pas reprendre la mise ", ". Olaylar raporlanam", "59b92eff-6bda-d70f-762e-bec940eda9f3", "STATUS_UNSUCCESSFUL", "JN9HR-MH7K4-DBPDD-TFTXF-Q9MMF", "Client", "r die gew", "6>7j7q7", "Os arquivos de conte", "El usuario ha elegido cancelar de contrato de licencia.%0", "Installasjonsprosessen ble uventet avsluttet.%0", "SYSTEM\\Setup\\MoSetup\\NotificationSQM", "The installation process requires that the user accept the license agreement.%0", ".w.t,", "MoSetupPlatform: Using action error code: [0x%X]", "DUImage: Instance created!", "3dabea62-0ebe-b7b6-f5da-31fe4510ce91", "tta eftersom en n", "2R2n2", "Um script pr", "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert", "smj-SE", "97e3e06d-b3a4-2f58-d350-12798e96d213", "H0O0m0", "MoSetupPlatform: Creating CLEANINSTALL Fail Forward system...", "Microsoft.Windows.122.X20-35510_8wekyb3d8bbwe", "m nespl", "PreFinalize: Initializing Migrate drivers: [%d]", "CDlpActionFactoryImpl >,class CDlpActionAdvertiseFactory,class CDlpActionAdvertise>::SetActionId", "_CxxThrowException", "0ce774e8-d71f-d5fb-9540-597ddab0cb5d", "Microsoft.Windows.72.X19-98718_8wekyb3d8bbwe", "8NT82-JYHPQ-9TDH4-V3C4M-6VMRF", "GX7VW-JRNT2-7MXMP-DMTHP-V8RJW", "RKW9C-8NW8G-R4K3M-R664B-F9D8M", "CDlpActionCompat::InitializeInstallReqScan", "jHhHr,g", "43c11182-1dfa-8d0b-907f-461f1fb1ff4e", "1#2M2c2", "5>5I5s5~5", "DUImage: DCAT offer not found", "STATUS_OBJECT_PATH_SYNTAX_BAD", "ar-LB", "DiskSpace: Required disk space is only [%ld] MB, raising it to 200 MB", "En opprydding fra et tidligere installasjonsfors", "read only file system", "ur-IN", "T49Q4-NV8XR-WRXD9-4Y78C-D7CJ4", "cd080564-f99d-f780-3688-0e05829ba48e", "102a2", ":V:]:r:", "__rv.NewCursorValue != 0", "1#1P1Z1", "S,_^[", "%CLIENT%", "CJT62-7TNTH-6JCHF-CHM2V-PWF7M", "Microsoft.Windows.27.res-v3300_8wekyb3d8bbwe", "enterpriseg", "istiedostoa.%0", "5646aab3-53d6-37f1-41d4-bc75eda9f052", "69730167-1b91-c662-365d-df42ff362327", "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d", "Microsoft.Windows.100.X20-29646_8wekyb3d8bbwe", "9bc8403e-5462-4701-4ce3-0ff3f931f3c7", "si-LK", "PPPhLE", "Esta vers", "U0S0Q", "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent", "WATSON_BUGCHECK_P2", " verificato un errore e il valore risultante deve essere consolidato a fini di telemetria.%0", "4b1fc7cb-08a1-6382-537e-6d13fd9e2e9f", "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x", "ndirilecek paket yok.%0", "4/5@5", "m proveden", "RemoveFeature", "FveAddTrustedWimData", "Microsoft.Windows.49.X19-98828_8wekyb3d8bbwe", ">(>5>U>a>h>", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@@@", "Latauksen yhteensopivuusongelmia ei ratkaistu aikarajaan menness", "serverdatacentercor", "HVYNB-XGJ47-FJYM2-7XM7H-7QYRK", "YWRXB-FNXQ6-TH9QB-6PKW6-683GG", "SVhh#", "Microsoft.Windows.98.X20-29636_8wekyb3d8bbwe", "The install cannot continue because the instance hash does not match.%0", "yEVjp", "RtlDosPathNameToNtPathName_U_WithStatus", "fr-ML", "ImageDeploy: Initializing Disable Shift F10: [%s]", "Microsoft.Windows.165.X21-06165_8wekyb3d8bbwe", "N63P7-TWY9H-PM7RK-3TPMC-CKCJK", "6\"7/7", "Microsoft.Windows.99.X20-23532_8wekyb3d8bbwe", "BREAKPOINT", "9$9+9^9e9", "9T$(r\"", "Microsoft.Windows.48.X20-29655_8wekyb3d8bbwe", "PreFinalize: Finalizing the deployment of the new OS", "Microsoft.Windows.100.X19-99445_8wekyb3d8bbwe", "6YBN7-DRWHP-9DGM8-9QGYX-JXCHH", "tt be a sz", "u 9C<", "InitializeAcl", "it, proto", "0482159b-1c73-e7a0-616b-b1889c7ab005", "bd9d8629-5126-20e9-4053-b7d30ca60d22", "5o6v6", "NKDHV-XJXBT-GMPRK-CC7BV-B7WY2", "81dd2f1c-4e27-8251-71ab-4b250de2b3cc", ".?AV?$CMoSetupUnknownImpl@VCSetupCore@@@@", "PVN2P-FR3KC-9FYPM-BXKDC-PG2JD", ">@.6Y", "r systemet.%0", "Thales TSS ESN:0842-4BE6-C29A1%0#", "8/8P8", " se aktu", "L$ Qht", "r att ladda ned uppdateringen.%0", "SLGetWindowsInformationDWORD", "Plik wykonywalny GatherOsState ma nieprawid", "MoSetupPlatform: The recovery image is not available.", "HRESULT_FROM_NT(", "N8FHW-G2P4G-DYVDY-BYHVQ-XHKXT", ";);J;k;", "MCWRC-6QNM6-GJYWP-JMR8V-HXMMG", "353k3", "CDlpActionPackageMigrate::RemovePackages", "CRtlGrowingList::Initialize", "me d'exploitation.%0", "47e5a8af-a234-a300-36f3-dc48e11cfdb8", "zanego z niepowodzeniem nie powiod", "Y8XFV-4YNCP-F4KQQ-YHH9T-8TYPT", "cbeef714-6746-66f1-d953-ae0adf977d91", "Microsoft.Windows.48.X19-99717_8wekyb3d8bbwe", "CDlpActionFactoryImpl >,class CDlpActionGetWebSetupUserInputFactory,class CDlpActionGetWebSetupUserInput>::GetActionId", "Microsoft.Windows.122.X20-29616_8wekyb3d8bbwe", "e777c773-b97e-bd46-f198-773da304a3ce", "Not-null check failed: pfn2", "?1?@?g?", "ARRAY_BOUNDS_EXCEEDED", "Not-null check failed: String2", "TmiMatrix", "182b2j2z2", "kleme beti", "BRANDING_OPTIONAL_RESOURCEID_MAP", ">;?]?", "4\"4=4G425", "7836984b-2301-56bf-6f7a-8113975e37cd", "RtlAppendUnicodeToString", "Bl(u7b", "Microsoft.Windows.121.X21-83177_8wekyb3d8bbwe", "ba0fee7d-77f8-202f-27e1-72e35791088a", ".?AV?$CZeroInit@VCMoOnlineStore@@$00@@", "6d6x6", "ACCESS_VIOLATION", "CDlpActionFinalize::ExecuteSetupPlatformFinalize", "::RtlIsLUtf8StringValid(Destination)", "42HRM-9NF7J-8QV86-KR3XH-B7XPG", "r%s__Count", "MoSetupPlatform: Requesting install of FOD packages from [%s]...", "DataMigration: Searching for private files...", "R2TJ7-9DNRJ-JY6XW-PXVKH-KHJXQ", "stroje nen", "8QC6Y-6NQ7G-R24PQ-WJYW3-DV8V9", "W0f0D0", "CDlpActionGetWebSetupUserInput::GetHostOsInfo", "K8XQY-KN4WM-KDT29-VXVJW-J8F78", "2Y3c3w3~3", "511f5299-b4a2-ade0-c018-73d11882d153", "ObjectLength", "Microsoft.Windows.100.X20-35499_8wekyb3d8bbwe", "279aa730-0ee8-3f90-6ca6-b8235308c63d", "281a62aa-60ef-a491-aa39-44df62171ced", "RtlIsLUtf8StringValid(LocalName)", "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)", "Microsoft.Windows.4.X19-98719_8wekyb3d8bbwe", ";4;8;<;@;T;X;\\;t;x;", "DataMigration: Copying ActionList.xml to working directory", "NG8GB-PRKDX-K6FMJ-4PT47-HXMM3", "cia systemu.%0", "r pakkens indhold.%0", "Microsoft.Windows.48.res-v3308_8wekyb3d8bbwe", "67d8123c-fecb-f631-f652-2a5c5ae96520", "argument list too long", "773b7db7-46ef-8650-86d3-d84b5c74276a", "20eddc5e-b78c-6ee7-d3c0-7e9a7da92cf5", "WindowsLockdownTrialMode", "WWNBF-8QPVM-WGWV2-939VV-JQKRY", "LeaveCriticalSection", "en-ZA", "Microsoft.Windows.101.X20-00914_8wekyb3d8bbwe", "979>9D9", "848970dd-94aa-653a-678c-d1fa6fb2f5f8", "Microsoft.Windows.7.X21-83748_8wekyb3d8bbwe", "3WFXN-BKYG9-WGVPV-66V4F-WFG4J", "XGNJ6-WRVRD-M4R3Q-8BTC4-6Q73B", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementById", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateAttributeNs", "adavky pro instalaci aktualizace.%0", "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE", "ImageName", "Microsoft.Windows.122.X19-98894_8wekyb3d8bbwe", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute", ")`yJb", "8bce8ef0-abe4-0e56-62ad-d1ac5881a394", "3MHNP-33X7K-Q9MYM-9QP7H-DRTTW", ".rdata$T$brc", "CDlpActionDU::InitializeDUSetup", "De installatie kan niet worden voortgezet omdat de exemplaar-hash niet overeenkomt.%0", "808=8S8]8u8", "a97cdb8f-b1d6-29c4-15d1-aeb99755e9ef", "Microsoft.Windows.98.X20-29581_8wekyb3d8bbwe", "Canonical", "teG;}", "6%6]6d6y6", "DataMigration: Initializing FailFwd Flags: [0x%X]", "8t8{8", "504b26ab-1d30-c937-3850-3e123cb0e3ca", "Het installatieproces is gestopt voor testdoeleinden.%0", ".?AV?$CZeroInit@VCDlpActionDiskSpaceReqFactory@@$00@@", "Failure from: %hs, line: %d, you can set break point on 'DebugOnError' function", "valuation est vide.%0", "WinSatIsScoreValid", "STATUS_INSUFFICIENT_RESOURCES", "NewProcessingInstruction = this->AllocateStreamObject()", "Microsoft.Windows.50.X21-83787_8wekyb3d8bbwe", "CDlpActionGetWebSetupUserInput::IsOfferLanguageMatch", "WinSatCpuScore", ".?AVCDlpActionPackageMigrateFactory@@", "RequestDriveFromAutomation", "e12553c6-fcd2-841a-c3a4-b1fa488a7570", "CDlpActionCompat::DeserializeDownloadReqScan", "ProductKey: Offer RegValue = [%s].", "l1XJT", "75c02135-2102-93b8-6fd4-11f0d11291de", "90d44f43-4581-295d-87d4-9b7d1d1f2fb0", "63be66eb-301a-b651-a0b2-8f453e71b14e", "STATUS_INVALID_PARAMETER", "Microsoft.Windows.99.X20-15871_8wekyb3d8bbwe", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "nMoSetupPlatform: Platform and Setup binaries match!", "38NQ9-CYXDQ-24VFP-DR7G8-JFG3R", "(FixedSizeBuffer != 0) || (DynamicBuffer != 0)", "3#41484Q4", "M6Y8X-H8N8Y-PKKFJ-39FWV-R9CJP", "FBVNY-B4B3R-WG8YB-RHV8Y-PR4DG", "fd7b7f16-b90b-428e-957a-1c0d6ba0cb38", "Microsoft.Windows.7.X21-83743_8wekyb3d8bbwe", ">,>4><>D>L>T>\\>d>l>t>|>", "209a0f53-a608-3dc8-a81e-69b545064fa2", "HeapDestroy", "ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY", "RtlNsInitialize(this, Comparison, pvCompareContext, Alloc)", "Wykonywanie skryptu przed zatwierdzeniem nie powiod", "PackageMigration: skipping FOD packages...", "0C0d0", "080404B0", "db1ad587-2c56-f36a-f684-52df42a2b75f", "D$,Pm", "dvendig opgave.%0", "c9c54775-1002-dbee-8d2f-360cd6482404", "VWhlC", ".?AVCDlpActionDebuggerOptions@@", "SKUName", "ms-BN", "040E04B0", "FACILITY_COMMONLOG", "ar-IQ", "VBNFV-K94KJ-WQX6X-2WMH7-QPFTR", "CDlpActionImpl > > >::CheckInitialized", "e6877017-2616-f5e3-1036-edafdef7aee8", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes", "OutputDebugStringW", "DeleteFileEx: Unable to open [%s]; GLE = 0x%x", ";CC>", "QPC3X-T9NPC-RW8BB-RRGQP-8XCKQ", "4%505a5l5", "K9MR3-WN7R2-866WW-8MDJ4-BY6PY", "7XXPF-NF6M3-VYGHV-F337T-239V3", "Ambiente ripristino Windows non pu", "SystemStartOptions", "=)=<=O=", "teleket a hat", " stata rilevata una versione imprevista del client dell'agente di aggiornamento.%0", "CDlpResponseAutomation::InitializeRoutineDuOptin", "VERSION.dll", "identifier removed", "Partition", "Microsoft.Windows.122.X20-00860_8wekyb3d8bbwe", "3<3]3l3y3", "A rendszer nem felelt meg a friss", "Target OS: DomainJoin not available. Removing install choices...", "Failed to open key for object's elements. Status: %x", ".rdata$r$brc", "MM286-PNW8H-36MC4-CVC4D-T6PHF", "PNV78-286W9-RQDD9-HTC7K-HCFJW", "xsG;}", "Microsoft.Windows.48.X20-35542_8wekyb3d8bbwe", "Der Benutzer hat sich entschieden, Setup abzubrechen, damit die Deinstallationsoption aktiv bleibt.%0", "J6QRN-JRMRY-398JP-R393D-GFXWC", ":+;5;_;i;", "Microsoft.Windows.4.X19-99693_8wekyb3d8bbwe", "O utilizador recorreu a uma linha de comandos setup.exe apenas para realizar apenas uma an", "MoSetupPlatform: Package [%s] -> install size [%I64u]", "ConX::Setup::Common::COSInfoHelper::GetTargetOSVersion", "9;9W9{9", "BiCreateBootEntry: Could not retrieve BCD Object application path. Status: %x", "<% > > >::Execute", "VP8TQ-B4NC6-D2D27-VV9TF-844BR", "6bb92e50-4c42-f6e9-282f-169cf6146a80", "@9F$u", "> ?L?", "041304B0", "HomeBasic", "Microsoft.Windows.100.X19-99439_8wekyb3d8bbwe", "?P?i?", "9ae8a256-5851-8f85-11dd-f599b3bd06e5", "NH6RH-D3DK6-KXRCV-GH8YV-9BWWV", "berpr", "4NKF9-DKB62-C37M6-RH4XT-YG9TQ", "NVXKD-FXT9G-7VB23-BG97Q-7T9TQ", " Microsoft", "HNGCC-Y38KG-QVK8D-WMWRK-X86VK", "GetProductKeyFromResponse: Automation response not found.", "c2ea678c-f40c-4d67-ba6c-012c6c004a07", "c938005a-7f79-1022-52e1-74e8bcab0cda", "6w6~6", "hubos", "ExecuteInstallReq: DiskSpace issuses resolved. DiskSpaceReq polling ends", "F2YM7-NC42F-GF8H3-3GYK7-7QYMX", "no such device or address", "Not-null check failed: Result", "RPRRj", "base\\ntsetup\\diagnostics\\lib\\diagutil\\src\\setupfailurecount.cpp", "a58e9c1e-4547-6a3e-a885-895ce76b561e", "Microsoft.Windows.98.X19-99602_8wekyb3d8bbwe", "ultimate", "ulLocation < m_PositionList.Length", "6%6b6", "RestoreDirMetadata", "Microsoft.Windows.122.X19-98695_8wekyb3d8bbwe", "0&1B1", "CDlpActionCompat::GetResultsFinalizeReq", "so-SO", "hem f", "mn-Mong", "Microsoft.Windows.188.X21-99379_8wekyb3d8bbwe", "XV48N-GJ8VM-3QFDV-Q6WDQ-RJRBG", "jaYjz_j:Z", "141c6349-4f91-7fc2-7d69-5dfd298af7ba", "GetProductKeyFromResponse: Product key is valid!", "trPWQ", "9&:M:l:", "MoSetupPlatform: NewSystem object created!", "CheckHotPluggableDriveEx: Drive %c Unable to query device number for %s Error: 0x%X", "c70a7575-282b-f1a0-00ff-feb3f285d602", "2863Y-N3JTD-R2644-R44YP-27JVF", "Microsoft.Windows.8.X21-83714_8wekyb3d8bbwe", "@u)j@j", "0!0'0,0A0Q0a0", "ImageIndex", " || SourceFunction: ", "N8DVK-WHQR7-WFRBG-82XQ8-K2FBG", "STATUS_FILE_IS_A_DIRECTORY", "H6NQT-9MFM7-9XH8W-W69CD-MDYRF", "4193bb42-f87a-8117-0b2e-34debe8569dc", "343Z3", "9(979}9", "M2P7N-69983-C3RCQ-Y9FC4-9W3PJ", "ProductKey: Digital Marker contained an empty value.", "97fb5da4-354e-5841-2921-9db7fad18d37", "DEBUG", "homepremiumn", "%s__%ld", "M6GNG-6RRJD-M4VDQ-8K8VW-CPQFQ", "_vsnprintf", "Valid flags check failed: Flags", "PackageMigration: Entered because SafeOS is present..", "0/0O0X0e0l0", "Microsoft.Windows.17.X17-36805_8wekyb3d8bbwe", "0!181c1i1", "Microsoft.Windows.48.X20-29671_8wekyb3d8bbwe", "5F6\\6", ">D>t>", "6V43W-6N6XV-HT892-Y6GF7-3J3G3", "RtlDuplicateLUtf8StringToLUnicodeString", "u+SSS", ".?AUIOperationsProgress@SetupPlatform@@", "kleme devam edemiyor ", "LangPacksPath", "hSVWjD_3", "FullUpgrade", "(Value != 0) || RtlIsLUtf8StringValid(Value)", "Target Image: BitLocker Device Encryption Available = [%s]", "!t$$Pj", "nse. %0", "5C6^6o6v6}6", "ntad version av installationsplattformens bin", "vMR!q", "NtSetSecurityObject", "ProductKey: Saving information from SKULIB key.", "Bugcheck code", "6L6_6", "6 6(60686@6H6P6X6`6h6p6x6", " > > >::SetProgress", "Failed to query boot entry order. Status: %x", "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputMediaType: [0x%X]", "W3RKC-NC38G-WWMTD-PW6FB-YWTFT", "GatherOsState ", "DataMigration: Initializing Migration Choice: [0x%X]", "BN3CX-XK2J6-F6MW7-7JHXB-VQXFY", "o de limpeza de uma tentativa de instala", "o passou os requisitos para a op", "5L5S5h5", "ges felt", "ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE", "GetLongPathNameW", "c architektur. %0", "3WN48-GVPXF-VHWK4-29Y8D-KKTD2", "GuidCache", ";#AllocateStreamObject()", "7l8v8", "Microsoft.Windows.125.X21-83249_8wekyb3d8bbwe", "TX3M3-HN6CW-2D8RM-QKCVK-WT3F3", "2I3o3{3", "1C2Y2", "CDlpActionImpl > > >::Prepare", "Setup360MappedResult", "?/?J?Q?]?", "nou aktualizaci.%0", "PerformSilentCleanup: Error reporting telemetry for STORAGE_CLEANUP_TIME: [0x%X]", "017a0d88-3d90-48a1-7a08-dafb6c6c7e0e", "YYVX9-NTFWV-6MDM3-9PT4T-4M68B", "041004B0", "professionalworkstation", "Microsoft.Windows.99.X20-23533_8wekyb3d8bbwe", "da-DK", "DBXXP-6YNM8-MCTYH-WXVDG-FVWWB", "?3?X?v?|?", "erinin telemetri amac", "6[7f7t7", "2566c30a-5a06-c01d-8a73-1f00e5e1ea61", "serveressentialadditionalsvc", "798977d6-4d0b-0570-5a98-b9333ea4a40c", "0c02444f-30f6-46a9-a0a4-ec405e362a97", "Process Name [%d]: %ws", "Microsoft.Windows.27.X19-98764_8wekyb3d8bbwe", "ebaa90b7-cd60-05c1-2f4a-e86e88a430d4", "c7156f3c-7c61-9242-5946-8d37662429dc", "5b744439-886b-3ff3-a517-106dc57fdf10", "StarterN", "DataMigration: Initializing bMigrateReservesActiveScenario: [%s]", "j.Xf;", "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\SPLEVEL", ".?AV?$CZeroInit@VCDlpActionPackageMigrateFactory@@$00@@", "m k instalaci nebyly v po", "STATUS_INVALID_DEVICE_REQUEST", "Microsoft.Windows.122.X19-99472_8wekyb3d8bbwe", "WJCTN-YMDWK-BDVBM-G8T77-YY47J", ":&:C:J:Y:`:i:p:", "NBD82-BBRYC-P7XDD-G6844-37CF6", "Fehler beim Ausf", "CDATA", "(u7b*g(W@b", "b28507e6-35d6-4132-3496-2603960839e9", "CDlpActionImpl > > >::Deserialize", "HN338-K69PP-P3JWH-PPCG2-D7BM3", "Microsoft.Windows.101.X20-29681_8wekyb3d8bbwe", "ges lemezter", "5dacd79b-a8fe-c0c0-e6c5-b1f06ba5f7f2", " el.%0", "QSVVV", "en-TT", "Panther", "2Q9YQ-N4XJJ-6PH9T-2KJHG-GMT6R", "Microsoft.Windows.100.X20-30045_8wekyb3d8bbwe", "YJNWD-DQKWB-HBPMK-B6RDY-FF83J", "9 9'9R9e9m9", "7\"707^7", "TJJTV-HNW4M-4KY28-BRQD2-6JGF8", "Microsoft.Windows.184.X21-83658_8wekyb3d8bbwe", "Microsoft.Windows.188.X21-99375_8wekyb3d8bbwe", "X9NV3-MCH4F-M3G24-2PKR2-BTDT3", "onecore\\base\\servicing\\actionlist\\lib\\actionlist\\objfre\\i386\\actionlistparser.cpp", "4fcd7083-c14e-cc20-89de-cf6655e146f8", "s adathordoz", "DiskPartition: Automation not found.", "=(=/=5=@=G=z=", "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de gated compatibiliteitsscan voor het installeren van de update.%0", "Microsoft.Windows.27.X19-98746_8wekyb3d8bbwe", "Microsoft.Windows.49.res-v3316_8wekyb3d8bbwe", "dfc22b9d-b1dc-0ead-7a04-a090cdde087a", "0#1x1", "99;><", "]_^[]", "DuHwCompat.TXT", "Microsoft.Windows.99.X20-37357_8wekyb3d8bbwe", "o do SO pendente.%0", "\\Windows\\Setup\\LatentAcquisition\\ActionList.xml", "ultimaten", "m_ulSize == 0", "t[Vh ", "bc0045e0-d78a-2d7f-3c28-c6622fb0654e", "9 9$9(9,9094989<9@9D9H9L9P9T9X9`9l9x9", "re eller returnerte en feil.%0", "7c2f5ca6-e604-50ae-bdf5-d7bfb961495c", " nem fogadta el a licencfelt", "Compatibility: Resolve requested. String: [%s]", "kr-Latn-NG", "pHeader->ulSignature == ('dHdM')", "N4PR4-9WYHD-J3GJ2-28RYQ-JTT8D", "DiskSpaceInstallReq: Initializing Download Drive Letter: [%s]", "The installation process was launched with an invalid command line argument.%0", "me manquant.%0", "6&7-7S7", " Windows Recovery Environment.%0", "SINGLE_STEP", "8'808", "GDRPath", "WimImageSetInformationFile", "CDlpActionFactoryImpl >,class CDlpActionSummaryFactory,class CDlpActionSummary>::GetActionId", "g%s (Error = %d)", "RDN98-QF2FV-VBFXF-QWJGP-DDB6M", "Microsoft.Windows.145.X21-83691_8wekyb3d8bbwe", "CDlpActionProductKeyValidate::GetProductKeyFromResponse", "CreateDirectory failed", "D$ j8", "ImageLocation", "7eccbf80-e904-e6f7-5a5a-606a8f501d10", "NTBVJ-QQ2TW-MHD26-2M77M-JMBJ2", "O usu", "848^8", "1 1&1-1", "m.Reserved < m_NamedNodeMaps.Size()", "DisableThreadLibraryCalls", "GetWebSetupUserInput: Selected Architecture From Resposne = [%s].", "CDlpActionDiskSpaceReq::CancelRoutine", "operation in progress", "PhXSDT", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDUFactory@@VCDlpActionDU@@@@", "failed", "3c5ded6b-6fd0-5e2c-a8b1-5633e56d5f73", "CMicrodomUpdateContext::Construct", "GDRChecked", "N37VK-3DQBV-KGKPC-WYDHP-GQ9PF", "CDlpActionGetWebSetupUserInput::IsOfferEditionMatch", "Microsoft.Windows.121.X19-98678_8wekyb3d8bbwe", "8N8c8", "Diagnosticeringsobjektet blev ikke oprettet. H", "Asennusta k", "DataMigration: Initializing InstallType: [0x%X]", "474B4o4y4", "CMicrodomUpdateContext::CreateVirtualTextual", "KN773-HKQCT-MVBPM-JRFMG-237YT", "L$4_^[3", ")Microsoft Root Certificate Authority 20100", "Microsoft.Windows.98.X20-24579_8wekyb3d8bbwe", "ProfessionalStudent", "onnistui, tai viallinen komentosarja palautti virheen.%0", "Microsoft.Windows.48.X20-00859_8wekyb3d8bbwe", "Microsoft.Windows.7.X21-83734_8wekyb3d8bbwe", "_T{b_", "Os ficheiros de payload estavam danificados.%0", "en-IE", "CDlpActionImpl > > >::GetActionName", "sq-AL", "til chybu.%0", "100701213655Z", "Microsoft.Windows.7.X21-83739_8wekyb3d8bbwe", "CDlpActionDU::ExecuteFacilitatorLatentAcquisition", "d5b2660a-95d0-2843-fb1c-4bc7408d8b24", "Automation: Registered SUMMARY Response", " tietojen lataamisen levytilavaatimuksia.%0", "1E2]3", "Failed to query process information for size. Status: %x", "dc9f71e3-aeac-c7e8-4a0f-d36f83ca146e", "SelectedDriveLetter", "Microsoft.Windows.188.X21-99382_8wekyb3d8bbwe", "en virheellist", "8]9x9", "The requested attribute value is the wrong type. Either int was requested instead of string or vice versa.%0", "Failed to increment failed install count. GLE is [%d]", "HKLM\\%s", "Microsoft.Windows.122.X19-98686_8wekyb3d8bbwe", "o em disco suficiente para download.%0", "F3NGF-8BK3B-CRXW9-CWDG6-P7MJ4", ":,;3;s;", "in uyumluluk sorunlar", "Microsoft.Windows.101.X19-99535_8wekyb3d8bbwe", "Microsoft.Windows.49.X20-29595_8wekyb3d8bbwe", "Y9YDN-7XCQV-WQVR6-FBHX7-3J4FW", "Object GUID: %s", "Microsoft.Windows.7.X21-83732_8wekyb3d8bbwe", "kernelbase.dll", "Der blev ikke fundet en installationsafbildning til dette system.%0", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@", "OutputDebugStringA", "2 20242L2\\2`2x2", "DiskSpaceInstallReq: Initializing LXP License Path [%ld] [%s]", "Microsoft.Windows.121.X21-83176_8wekyb3d8bbwe", "Finner ingen installasjonsavbildning for dette systemet.%0", "Failed to get saved failed install count. GLE is [%d]", "WNXY8-KV4JY-6QYBW-TMWCD-63DCC", "Unable to create or destroy the shutdown block message.%0", "CDlpActionAdvertise::SerializeRoutine", "Microsoft.Windows.48.X19-98798_8wekyb3d8bbwe", "MALLOC failed", "Microsoft.Windows.184.X21-83667_8wekyb3d8bbwe", "SetEnvironmentVariableW", "tta eftersom instans-hash inte ", "o passou os requisitos m", "NF6HC-QH89W-F8WYV-WWXV4-WFG6P", "L$8PW", "::RtlIsLUnicodeStringValid(Source)", "9$9D9X9x9", "HC9QN-HRPCH-JPHFW-B86FF-CR397", "NJ6Y6-HQ4JJ-GXJY6-JCPM6-BP2KR", "NP93H-BJDMF-PQRVW-D7G8J-XWW3J", "79a766c6-b883-53b2-12cf-4e77ef782667", "N76RK-Y8DB4-TCGMV-TB6JB-RC4BP", "xito n", "1I1T1~1", "ra just nu.%0", "cec0ae21-d0bc-0105-c9ee-0cf08c10e0e5", "CDlpActionDiskSpaceReq::GetSystemDriveRequirements", "fo-FO", "kleme i", ";D$ t\"Q", "9;:B:X:p:", "ce34f504-46e0-6e37-b23b-eb54d8bbd6c3", "=A=f=", "3df795cc-d20f-203f-155d-b9d6cfb377ef", "Systemet videresender ikke kravene til diskpladsen for at downloade og udpakke medier.%0", "5f301dd5-019c-f58a-e7ec-b0ab326cda46", ".?AVCDlpActionCompatFactory@@", "89211cad-5aea-44da-f694-23eb7ebf4090", "0*0c0", "TNK62-RXVTB-4P47B-2D623-4GF74", "Package", "ERROR_INVALID_DATA", "Microsoft.Windows.162.res-v3799_8wekyb3d8bbwe", "minSPVersion", "api-ms-win-eventing-provider-l1-1-0.dll", ".?AVCDlpActionDebuggerOptionsFactory@@", "6D8CG-BNHCR-2QKC6-GTKW8-9TPHF", "A script exceeded the timeout limit.%0", "?(?7?>?L?S?_?n?{?", "STATUS_ILLEGAL_CHARACTER", "090`0", "Proces instalace vy", "est pas prise en charge.%0", ";;;J;W;z;", "Automation: Registered EULA Response", "SetupCore: Registered IMAGE_DEPLOY action", "vede tidsgr", "indigd.%0", "ZwEnumerateKey", "8543aaa2-de1b-8b1a-f37d-251aae310b6e", "WimApplyPrivileges", "7)7/787B7I7O7U7]7w7", "cych miejsca na dysku potrzebnego na zainstalowanie ", ".idata", "GetFileAttributesW", "6 6$6(6,60686P6`6d6|6", "PackageMigration: Nothing to do.", "d0ca42ec-cccd-8670-1fa1-b973474e9516", "Microsoft.Windows.27.X19-98747_8wekyb3d8bbwe", "37a65355-2eaf-f4ef-98f3-b3dd63f92cf2", "M2382-NCG6C-PGBJV-2D6VV-T3BMQ", "MoSetupPlatform: Not persisting telemetry data", "Microsoft.Windows.164.X21-06167_8wekyb3d8bbwe", "5d0a4a09-5ef5-108c-32d8-0347639c00bb", "onecore\\private\\base\\inc\\LogAdapter.h", "network_reset", "Server pr", "BinaryPartition", "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)", "PerformSilentCleanup: Error reporting telemetry for SILENT_CLEANUP_TASK_TIME: [0x%X]", "XM9N2-JYHQP-MTP8H-X89BH-BDWV3", "2aa03c0a-d0f2-74c2-a020-d6a2edf8c3cd", "Installationsbilledet blev ikke fundet.%0", "Y9D2N-8G4P4-7BCRG-MK77Q-M7VYB", "ActivationIssuesSkipped", "CDlpActionSummary::InitializeRoutine", "87f7769c-2d98-be15-45ba-9fc61a26a93a", "ba9c128f-e99c-e193-3298-02947849d507", "6#7N7u788c8", "Et forh", "> >8>P>h>", "CDlpActionProductKeyValidate::SerializeRoutine", "WTMK2-FNFHY-78XKW-GVYBG-233H8", "SourceName", "7ca454a9-6572-7b5b-81da-e2684d034ee9", "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom", "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize", "2G2Q2", "Not-null check failed: Params->Source.pBlob", "PPIPro", "ACCESSDENIED-Fehler in Anfangsphasen des Setups gefunden ", "De installatie kan niet worden voortgezet omdat de eerder gestarte update niet kan worden hervat.%0", " system nie spe", "5&6S6", "o pode ser executado ou devolveu um erro.%0", "rder f", "es-NI", "4f214c2c-3e60-5366-f3ef-b279cbd6a209", "D$8t3", "97867e01-314b-d486-5380-298c339eaad6", "Microsoft.Windows.8.X18-81302_8wekyb3d8bbwe", "L'utente ha usato la riga di comando setup.exe solo per una scansione e non per installare il sistema operativo.%0", "ILLEGAL_INSTRUCTION", "F93BG-2NQGW-3FKT3-7P8MK-3RVY4", "Microsoft.Windows.99.X20-29704_8wekyb3d8bbwe", "ivityksen asentamisen yhteensopivuustarkistusta.%0", "onecore\\base\\lstring\\ucsdecoders.cpp", "ReadFile", "a7128ada-b478-99f1-2ba3-675b88eac1f7", "FODDownloadPath", "Y%m-\"", "L'ID versione di anteprima ", "f0104cb7-3db3-974a-9d88-0205adf5d225", "Microsoft.Windows.7.X21-83741_8wekyb3d8bbwe", "Sistem, medyay", "CDlpActionCompat::InitializeDownloadReqScan", "Microsoft.Windows.126.X20-00862_8wekyb3d8bbwe", "Asennusta ei suoritettu vaaditussa ajassa.%0", "Deze versie van het hulpprogramma wordt niet ondersteund.%0", "broken pipe", "W86ND-FTRMC-7F9HM-486GP-7CFBT", "2VN9R-T2TFP-2HPVG-D43WQ-C36BT", "Microsoft.Windows.101.X20-35482_8wekyb3d8bbwe", "PVMJN-6DFY6-9CCP6-7BKTT-D3WVR", "WimFindClose", "llt die Anforderungen f", ">6>j>", "0^1j1", "lisis de compatibilidad para instalar la actualizaci", "KCNPH-BQTCW-CG2QQ-9FHM9-KQDD4", ";&;>;X;", "oeY<9", "3,303@3D3H3`3d3l3p3t3x3", "r die Einrichtung der Plattform wurde erkannt. ", "23MXW-YN2QD-FB2M6-4KP6C-2DKTG", "RJD2N-BHQBB-4MTQK-788W2-V8T4T", "ar-AE", "NF3W7-8C4B7-BFRT9-VKR44-8B6R2", "value too large", "Microsoft.Windows.188.X21-99373_8wekyb3d8bbwe", "10b252bb-1b24-d4e1-c7a6-7e774e7355a8", "Nie znaleziono ofert spe", "DataMigration: Migrating file: [%s] -> [%s]", ":,:3:O:U;[;", "B38N7-QYJB6-HQRBK-KTVKH-VT4WX", "Compatibility: Device Block found.", "HB2G7-NJB3W-C3CT2-HVQXH-B7V3B", "Microsoft.Windows.50.X21-83773_8wekyb3d8bbwe", "212<2h2s2", "Microsoft.Windows.48.X19-99645_8wekyb3d8bbwe", "tej aktualizacji.%0", "Microsoft.Windows.100.X20-29650_8wekyb3d8bbwe", "GetWebSetupUserInput: Execute: Action[%u] InstallNow=[%s].", "6 6Q6\\6", "696E6S6", "u anda Windows Kurtarma Ortam", "rbara installationsfilen.%0", "Fant ikke installasjonsbildet.%0", "6NYJH-YBYFY-96TVD-B9FHM-TXX9F", "-confirma", "404656af-d8b7-1db5-afc7-c4852fd64e07", "tti kompatibilit", "Microsoft.Windows.164.X21-06158_8wekyb3d8bbwe", "19c65668-f2b5-2a0b-e5fa-ab83b302652b", "cd24d0d1-5499-6933-b55f-da416ea68eb1", "G,PSWh", "nschte Migrationsoption nicht erf", "Automation: Registered DUOPTIN Response", "gu-IN", "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\BUILD", "n virheen.%0", " usean arkkitehtuurin tietov", "=K>p>", "[RS3]", "4 5?5", "7c136ced-57a1-2dca-efd4-f72cc5000d6d", "pContext != 0", "PPPPP", "STATUS_RESOURCE_DATA_NOT_FOUND", "27596e46-fce0-a0e7-f3eb-bbc8b65a8d84", "Microsoft.Windows.48.X19-98844_8wekyb3d8bbwe", "Microsoft.Windows.121.X19-98887_8wekyb3d8bbwe", "CopyFileW", "Microsoft.Windows.122.X20-00859_8wekyb3d8bbwe", "13cffd52-8d0f-b739-1804-c555192abc1f", "Microsoft.Windows.8.X17-36777_8wekyb3d8bbwe", "WimLazyInitialize", "Microsoft.Windows.4.X19-98713_8wekyb3d8bbwe", "8PXG6-NT6GR-VTFFC-GQG42-J44TQ", "2,2L2r2", "CDlpActionFactoryImpl >,class CDlpActionGetWebSetupUserInputFactory,class CDlpActionGetWebSetupUserInput>::SetActionId", " n'ont pas ", "7g9J:Q:m:", "<(<@6L6r6", "3L3f3", ";#<` > > >::Pause", "marrage du syst", "8\"8`8", "o est", "o de migra", "tti parancsprogram v", "Microsoft.Windows.126.X20-35529_8wekyb3d8bbwe", "in disk alan", "94ee330d-32ea-0031-aabe-af8e9e48575e", "3!373E3[3i3", "VDPNF-J4X9B-FJC2P-7JQFD-JTYQD", "kleme y", "<->X>", "9$939", "PG7H6-7RNT3-R4MGR-HMJK2-J462D", "2H6HF-GNKW2-JB93P-BK6XC-W2R42", "Microsoft.Windows.123.X20-57725_8wekyb3d8bbwe", "ReadData reparse tag from filestream failed", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect", "Microsoft.Windows.48.X20-39265_8wekyb3d8bbwe", "Microsoft.Windows.98.X20-36697_8wekyb3d8bbwe", ">'>T>_>", "SymbolicLink", "ProductKey: Initializing Digital Key: [%s]", "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE", "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x", "#text", "GetSystemFirmwareTable", "RtlAdjustPrivilege", "=4=8=@=X=\\=d=h=l=p=t=|=", "G7FJC-PN8KK-Y8DRB-YR28B-K766T", "061o1", "nimos para la recuperaci", ".?AVIDlpObject@@", "DiskPartition: Selected Drive letter from automation [%c]", "fil-PH", "84NJF-R7748-RB4W8-WB72F-FC26Q", "CDlpActionProductKeyValidate::GenerateGenuineTicket", "Microsoft.Windows.122.X21-03401_8wekyb3d8bbwe", " operace nem", "rt werden.%0", "e21bad02-cca4-7606-41ad-e9693f099b26", "onecore\\base\\xml\\udom_xmlcursor.cpp", "07901ac7-e54e-63c7-469c-d07a08922e02", "Microsoft.Windows.4.res-v3291_8wekyb3d8bbwe", "lacakt", "no stream resources", "RpcStringFreeW", "B6GMV-NJ4P4-PXJ9C-3JQ86-MKMMW", "Microsoft.Windows.22.X17-53882_8wekyb3d8bbwe", "CDlpActionProductKeyValidate::ExecuteRoutinePkeyGetEdition", "Den kj", "791ee811-71b2-247e-8946-c32795dfa494", "Microsoft.Windows.48.res-v3312_8wekyb3d8bbwe", "Microsoft.Windows.49.X19-98896_8wekyb3d8bbwe", "RNR8D-B4QK8-BDP4D-GTPCR-BY49W", "invalid_argument", "PVNPJ-T4WWX-6WK66-DKP3R-369Q6", "DUImage: Hardware compatibility file [%s] generated with [%d] entries.", "7c396c9f-59ea-0d3e-dd8f-0aceae7c765a", "4WQN9-2BWFT-PHQVP-YPT2Q-TCQW7", "Problemet ned installasjonsplass p", "AcquireSRWLockShared", "No se puede crear ni destruir el mensaje de bloqueo de apagado.%0", "GetWebSetupUserInput: Execute: PreSelected Language is = [%s].", ";+ > > >::SetParameters", "6%666G6v6", "wsc:setup:Setup_DismissAllDismissibleBlock", "647ce6ad-4629-ce52-0f70-02c8d823d50c", "2e33ca33-6cbb-89c5-d996-390db4b118be", "7D7N7", "Installasjonsprosessen ble ikke fullf", "o foi encontrada.%0", "01e9c00e-44fb-23a1-b539-6583ac61fa5c", "95affec8-a2df-63e9-5089-5bd34051e038", "84NGF-MHBT6-FXBX8-QWJK7-DRR8H", "maxVersion", "Il processo di installazione richiede che l'utente accetti il Contratto di Licenza.%0", "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART", "Too many delimiters in string id.", " laste ned nyttelasten.%0", "M6N3G-M747G-GHV4F-XTKFB-VQXRM", "SourceMicrodom != 0", "PerformSilentCleanup: Error reporting telemetry for OSPARTITION_SPACE_FREED_UP_CLEANUP_TASK: [0x%X]", "serverstandardnano", "Microsoft.Windows.49.X19-99521_8wekyb3d8bbwe", "9W9m9", "ProductKey: Not calling GatherOSState", "RPCRT4.dll", "(null)", ".?AVCDlpActionActivationFactory@@", ":?:v:", "Microsoft.Windows.101.X20-29676_8wekyb3d8bbwe", "NJBCW-WXK3P-BH2HC-HV2DQ-2WBRC", "CDlpActionImpl > > >::Resume", "5$5(5,5D5T5X5h5x5|5", "10181D1d1p1", "W\\\\.\\%c:", "Microsoft.Windows.48.X20-23601_8wekyb3d8bbwe", "T$4Qj", "274d7952-e8f8-077a-bb77-60b3f23de33d", "Microsoft.Windows.172.X21-24715_8wekyb3d8bbwe", "8NVGM-CKCPY-VFHVY-KTMH2-HH668", "Un script super", "CompatFinalizeReq: Initializing Telemetry OptIn: [%s]", "network_unreachable", "GetCurrentProcess", "Microsoft.Windows.161.X20-00862_8wekyb3d8bbwe", "PPPPSW", "k mulig.%0", "8/9=9n9{9", "VCTJH-KNG8D-3Y36V-W9Y48-J8F9M", "The system does not pass the diskspace requirements to install the payload.%0", "This version of the tool is not supported.%0", "NPTDJ-TDWGG-QQK2H-X83P9-FRCPX", "Brugeren har ikke accepteret slutbrugerlicensaftalen inden for den p", ".?AVCDlpResponseAutomationFactory@@", "GetWebSetupUserInput: Execute: Download file hash X86 = [%s].", "Microsoft.Windows.99.X20-23529_8wekyb3d8bbwe", "Et skript har overskredet grensen for tidsavbrudd.%0", ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionEulaFactory@@VCDlpActionEula@@@@", "NewAttdef = this->AllocateStreamObject()", "Activation: Starting Wait", "BGHKJ-QC9GW-QBDX9-CVT3C-QX33Q", "Microsoft.Windows.121.res-v3282_8wekyb3d8bbwe", "Microsoft.Windows.126.X20-00861_8wekyb3d8bbwe", "Microsoft Windows0", "lettel kapcsolatos k", "V293R-HN3JK-D69PJ-4D2J7-8HW4F", "4309cd6d-2166-9415-cf27-09cc8bca0f6b", ">%>+>1>7>=>J>`>f>", "UploadTelemetryFreeSpaceOnSystemDrive: Error reporting telemetry for Free Space On OS Partition for %s: [0x%X]", "ImageDeploy: Initializing AllowPartitionChanges: [%s]", "Configuration", "NJ23M-WDVR7-72XT7-T8FCG-9KRWG", "FindFirstFileNameW", "tvVW3", "%h.vvZu", "PerformSilentCleanup: TriggerStoragePolicies is done!", "ProductKey: Signing issue with GatherOsState. This is a non-critical error. Assuming machine is not active.", "WJF7T-NW437-T74PD-FR6JJ-33YMV", "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))", "TlsFree", "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext", "CompatInstallReq: Initializing Wim Ref paths: [%ld] [%s]", "Installationsprocessen startades med ett ogiltigt kommandoradsargument.%0", "HNB99-KKKXK-Y69TM-8782Q-3PFBG", "MGY4W-DXN7K-838GJ-44M6D-7T9Q2", "KGBJC-N8DR2-4TW94-R3QWC-76DXD", " Operating System", "Activation: Activation issuses resolved. Activation polling ends", "cych do wymaganych kryteri", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "S _^[", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment", "1d1k1r1", "qps-ploca", "BiExportEfiBootManager failed: %x", "ba6a2fe2-0daf-592d-1bcd-88e38a2d0ae1", "3GR3N-MTFRB-9GJ7M-MJ2BV-9BV79", "%CLOUD%", "CDlpActionActivation::GetResultsRoutine", "Impossible de poursuivre l", "che requise est manquante.%0", " foi solicitada uma opera", "tHjahx", "\\FVEAPI.DLL", "WKYKR-2NHJK-496TK-BMCKJ-DGPJM", "891c5371-5513-50ee-5edb-98ee36622b0b", "Microsoft.Windows.7.X18-81317_8wekyb3d8bbwe", "X[_^]", "Activation: Initializing Timeout in Mins: [%ld]", "<0 > > >::Suspend", "WNT9D-KBW3Q-7RVW8-3FVB9-Y7XV3", "Recovery: Offline Edition ID: [%s]", ">l>s>", "CallContext:[%hs] ", "rer Windows.%0", "4NF4Y-PY6TP-8GC66-66Q6H-FJT2P", "in iptal etmeyi se", "Microsoft.Windows.101.X19-99550_8wekyb3d8bbwe", "J6NW8-62PJK-7QR4Y-DJC74-6Q8KG", "Microsoft.Windows.48.X20-23600_8wekyb3d8bbwe", "77def6ea-5521-8d80-3376-21482f4b1503", "G4NCM-F9JB6-2MRX7-WP9FQ-9D72F", " a rozbalen", "57fd01ec-b41b-2441-6ecd-957eaa7ed5fc", "Installasjonen kan ikke fortsette fordi det allerede er bedt om en fullf", "s lehet", "rev eksik oldu", "Paketteja ei ole ladattavana.%0", "z.9Wv", "ProductKey: Checking SKULIB location failed. [0x%X]", "STATUS_TM_INITIALIZATION_FAILED", "NDCD9-K4JJB-VKCT2-Q9BJC-XTP23", "ProfessionalStudentN", "495e4f48-43b3-c29e-daeb-ced65db1e511", "fung f", "Not-null check failed: UpdateContext", "tJj > > >::Prepare", ".?AV?$CZeroInit@VCDlpActionDiskPartitionFactory@@$00@@", " ou a renvoy", "Bu sistem i", "bbarchitekt", "?3?[?", "CDlpActionDataMigrate::CancelRoutine", "2NKDB-KJM3F-Y6KYT-CRC9F-WFH4P", "CreateFile failed", "Microsoft.Windows.48.X20-29667_8wekyb3d8bbwe", "Payload files were corrupt.%0", "Properties.Length == Results.Length", "SourceDom != 0", "ProductKey: Validating EI.cfg file.", "25b28367-0114-11e7-5564-94406e299908", "9VGNT-HMQQT-3PTB9-VDGRK-BKPRM", "Microsoft.Windows.48.X19-99492_8wekyb3d8bbwe", "ci dotycz", "63fdad36-1fac-b16c-55ed-d93192f0262d", "4:4^4v4", "DiskSpaceInstallReq: Initializing Skip OC Migration: [%s]", "serverstandard", "Failed to allocate memory for space for process name.", "Microsoft.Windows.125.X21-83257_8wekyb3d8bbwe", "4U4e4q4", "8$8,848<8H8h8p8|8", "3P3W3r3", "GetSupportedDriveLetters: Unsupported drive type found. Drive: [%s], Type: [%d]", "Kompatibilitetsproblemene for nedlasting ble ikke l", "ugiwa", "Microsoft.Windows.48.X20-35534_8wekyb3d8bbwe", "cf5b5e68-55a6-56d4-80b9-f0451334fd9b", "VPiw&", "d9284b17-177f-0f65-2704-3416c5014a8a", " program a zachovat mo", "j-Yf;", " necessaria.%0", "90097968-5897-0f68-1190-882befeb2a9e", "Hbg&~", "CDlpActionImpl > > >::CheckUninitialized", "Microsoft.Windows.188.X21-99386_8wekyb3d8bbwe", ";D$ u", "02cf2873-ec88-6ef3-5c0e-4e08d17cc159", "4099d089-176b-ddfa-aadd-2e23cab98561", "industryhandheld", "AcceptEulaDefault", "9NBF6-WDTP2-7HH99-R9X3M-3GH7H", "2D3QM-TND8P-FCF2F-9239W-JFHY4", "V2MF4-NG9CF-7GMQX-TB433-XHKDW", "77effb74-e3b8-464d-8fba-71edbeffe57b", "CDlpActionFactoryImpl >,class CDlpActionSummaryFactory,class CDlpActionSummary>::SetActionId", "CP9C > > >::CheckInitialized", "Not-null check failed: StringIn", "0~0W0_0", "vi-VN", ".?AV?$CZeroInit@VCDlpActionPreFinalize@@$00@@", "f1468af8-cffc-8f9d-6faf-49f73988d9b0", "no child process", " >,class CDlpActionDiskSpaceReqFactory,class CDlpActionDiskSpaceReq>::CreateAction", "Microsoft.Windows.48.res-v3506_8wekyb3d8bbwe", "Microsoft.Windows.101.X20-30041_8wekyb3d8bbwe", ":!;5;I;`;w;", "d4e1f142-7484-d75c-f966-79d6be0d26e2", "CDlpActionImpl > > >::CheckUninitialized", "NFBM4-MHXHX-BQDR4-H7QP8-W44CF", "Microsoft.Windows.49.X20-29608_8wekyb3d8bbwe", "En nyere version af installationsprogrammet startes for at forts", "CXmlCursor::DecodeExtent", "Bugcheck param 1", "7/7E7", "Installasjonsprosessen ble avsluttet under kompatibilitetfasen.%0", ".rdata$sxdata", "<8=>=q=", "Microsoft.Windows.162.X21-43653_8wekyb3d8bbwe", "4&5A5\\5w5", "47222f8c-02c6-c54a-7d3a-32b87b0ca2d9", "this->ChildList[u]->Text != 0", "DesktopServicing", "jl al", "CDlpActionSummary::IsPowerPluggedIn: System is running on backup AC power.", "Microsoft.Windows.49.X19-98829_8wekyb3d8bbwe", "serverhpc", "?!?6?K?Z?b?k?q?", "CDlpActionEula::GetResultsRoutine", "ndigung nicht innerhalb des erforderlichen Zeitlimits akzeptiert.%0", "B\\;A\\", "es de automatiza", "bfbce14d-5527-d647-239e-42fbfec99798", "Microsoft.Windows.99.X20-29696_8wekyb3d8bbwe", "STATUS_NOT_IMPLEMENTED", "GetTickCount", "InstalledSize", "r das Betriebssystem wurde gefunden.%0", "Microsoft.Windows.162.X21-03400_8wekyb3d8bbwe", " postanowienia licencyjne.%0", "mn-Cyrl", "Microsoft.Windows.161.res-v3916_8wekyb3d8bbwe", "Microsoft.Windows.189.X22-09606_8wekyb3d8bbwe", "-FVE-FS-", ";0;M;t;", " weist eine ung", "7-888d8n8", " !\"\"\"#$ &&&%%%%%%%", "STATUS_NOT_CAPABLE", "GQBV4-JYN8F-TR99K-V9JPG-Y98WD", "Microsoft.Windows.49.X20-29604_8wekyb3d8bbwe", "HNRBK-QTGCQ-TXR6R-7R9YJ-2G2M8", "CDlpActionUpdateMedia::GenerateClientId", "Microsoft.Windows.50.X21-83775_8wekyb3d8bbwe", "NX79V-FMVY4-RR4YR-9GCPB-R6Y6R", "The system does not pass the disk space requirements to download and unpack media.%0", "283?3F3M3T3[3o3", "totta a folyamatot, mert rendszer nem felelt meg a friss", "LocalFree", "45c0f7ca-41d6-bce7-b03c-416422c29f34", "230c238c-963e-1677-8ac5-04e31687a401", "3$373", "Die Installation kann nicht fortgesetzt werden, weil auf Ihrem System nicht gen", "Un script de pr", "PackageMigration: Migrating FOD packages from [%s] into Target OS...", "I problemi di spazio su disco per il download non sono stati risolti entro il limite di tempo richiesto.%0", ".?AV?$CZeroInit@VCDlpActionDUFactory@@$00@@", "ytkownik nie zaakceptowa", "DiskSpaceInstallReq: Initializing ExtDrive space req: [%ld]", ";B;K;", "Microsoft.Windows.4.X21-03402_8wekyb3d8bbwe", "Installationsplattformen har st", "be084ded-98b3-9d72-32d4-cb50c81bc5a9", "9NRVV-F7GMC-DPR6X-GRDBH-BDXC4", "VRBNY-WGYMJ-V32HB-96J7W-GVJVV", "<`2[2b2", "NtDeviceIoControlFile", "THN6R-6GYFG-J2MWM-6R2CG-Y99FK", "<5S?", "Asennusn", "yla durduruldu.%0", ">>>Y>j>x>", ",01070y0", "As quest", "Region", "CDlpActionDiskSpaceReq::UploadTelemetryFreeSpaceOnSystemDrive", "PackageMigration: Initializing SSU paths [%ld] [%s]", "203N3n3", "Microsoft.Windows.4.X19-99703_8wekyb3d8bbwe", "Der Benutzer hat den Vorgang abgebrochen, da das System die Mindestanforderungen f", "93cb2d0f-6ba5-bae5-445e-43e2e501fadc", ";l >,class CDlpActionActivationFactory,class CDlpActionActivation>::CreateAction", "tPSVP", "MNM8Y-C332H-8QKD7-HCQXF-K4R7P", "MicrodomImplementation::CMicrodom::GetDocumentNodeSet", "Systemet klarar inte kompatibilitetskontrollen f", "SetupCore: Registered COMPAT_MIGCHOICE action", "Microsoft.Windows.161.res-v3798_8wekyb3d8bbwe", "PreFinalize: Migrating Correlation Vector [%s] into Target OS...", "CDlpActionImpl > > >::Initialize", "25b1a4d0-b537-7537-05c4-594ea75fd438", " soubor GatherOsState m", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "1M3`3v3", "RNQRB-3BXF7-X782H-4H4HM-JMBJP", "Podane informacje o automatyzacji s", ": :$:(:<:@:D:H:L:P:X:p:t:", "1$1R1", "zvizsg", "onecore\\base\\xml\\udom_builder.cpp", "Not-null check failed: Destination", "313X3", "DiskSpaceReq: Something went wrong during Polling.", "Failed to export alterations to firmware. Status: %x", "TriggerStorageCleanup is not supported", "enterprise", " hylk", "not a directory", "+>h>", "TargetISO", "rio optou por anular a Instala", ":*:=:", "<#=h>", "XXRW6-8QNPQ-M8MKC-DFBXG-XQCM4", "W7JC8-G7N7P-C2WTV-44W6Q-YBH3D", "22324-FN7V3-8V6VT-XF87K-RM47T", "Problemerne med diskplads i forbindelse med installationen blev ikke l", "(New == 0) || RtlIsLUtf8StringValid(New)", "5b12d121-2337-1875-1f04-2166e4ab5c2d", "lstasjonsbokstav. %0", "o consegue retomar a atualiza", "FACILITY_NTWIN32,Code=", "5608c207-e8fd-c9d6-e2bd-bcbea630df0b", "Microsoft.Windows.100.res-v3424_8wekyb3d8bbwe", "Microsoft.Windows.98.X20-29635_8wekyb3d8bbwe", "47fb20a3-b025-7acc-5149-767c31ece4fe", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributeNs", "0021b46d-8398-0673-90f6-6f100d8b5dee", "ServerRdsh", "nns inte i enhetsgenoms", "Se interrumpi", "NH7W7-BMC3R-4W9XT-94B6D-TCQG3", "kk-KZ", "=8=P=", "b35aee31-e9c1-c22d-4ec4-86959f145e07", "f2ada5f6-c0c2-19ad-64cf-6e777fba230e", "n. Se puede reintentar.%0", "DiskSpaceInstallReq: Initializing Drivers Path: [%s]", "GetPrivateProfileSectionW", "ProductKey: Failed to Validate Default product key.", "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x", "DiskSpaceInstallReq: Initializing CompactOS: [%s]", "rio optou por cancelar o an", "RHr,g", "fad76bee-c952-d956-3a36-3f8c3f4e8d91", "70d26009-9672-cef2-d382-4f942f7fc73b", "3ef3c5a0-3c55-7606-2218-d4fc8c9ec8fc", "70L0j0", "Not-null check failed: fHasAttribute", "Microsoft.Windows.125.X20-35522_8wekyb3d8bbwe", "lemi, kullan", "1g1t1", "1[1`1w1", "EtwEventUnregister", "6419b893-60c7-3988-c248-5b2968f134b9", "^j?[;", "Server", "FellBackToCanonical", "SetupCore: Registered COMPAT_FINALIZEREQ action", "c15412ec-0fa1-cea3-df38-77c9f734c51d", "3B2KJ-Q6NFR-H8PHY-PCYFM-K766T", "8C3ND-JRGWR-3RF9P-92KD8-K2FCT", "dia pro v", "ImageDeploy: Initializing AllowUninstall: [%s]", ">#>C>_>", "D$ SV3", "l>f:y|Q", "5-595P5z5", "QPWSRh", "CDlpResponseImpl > > >::ExecuteRoutine", "CDlpActionActivation::CheckActivationBlock", "CreateMutexExW", "057e1749-68ef-56ec-fe9a-6bff4c4d46a5", "b8aa0744-3e40-ab7f-fcf3-70ce3156e64c", "FNTQK-DP7FM-GPQB2-M9BKR-DJ3HB", "1\"1:1", "538f5699-0a8e-3d66-24e2-363bd89d3dbd", "3834ce33-a5f5-db7f-f91d-b902fec9dc36", "CDlpActionCompat::ExecuteSysReqScan: Enter", " avbryte fordi enheten ikke har nok diskplass for nedlasting.%0", "Brugeren har afvist licensvilk", "ZwClose", "a5ff19ba-b00f-86dc-bebb-472c8a8e07fe", "421f35b8-7a38-2e6a-14b6-7c44b7b2b62a", "5\"5Q5}5", "ste konsolideras i telemetrisyfte.%0", "ZwAddBootEntry", "e9x0v[", "CDlpActionFactoryImpl >,class CDlpActionCompatFactory,class CDlpActionCompat>::CreateAction", "SetupCore: Registered COMPAT_RECOVERYREQ action", "ResExtract", "OpenThreadToken", "Microsoft.Windows.125.res-v4247_8wekyb3d8bbwe", "preoobescript.cmd", "8A;H;X;_;n;u;", "Microsoft.Windows.121.X19-98888_8wekyb3d8bbwe", "C4NTJ-CX6Q2-VXDMR-XVKGM-F9DJC", "Payload-bestanden waren beschadigd.%0", "enterpriseeval", "Microsoft.Windows.146.X21-83737_8wekyb3d8bbwe", "2ba6701a-4632-f994-3b3c-6ac4db3f16f8", "as-IN", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", "ActionListCriticalPaths", "CDlpActionFactoryImpl >,class CDlpActionEulaFactory,class CDlpActionEula>::SetActionId", "729b7416-38a0-ce81-2303-0438cddd1f3b", "b6747fa0-b8aa-7512-18bf-f27026b4202c", "PerformSilentCleanup: SilentCleanup task is done!", "installation n", "J0V;A", "CDlpActionImpl > > >::GetResults", "c6f8cd32-23f0-ca24-c34a-d01d7065cf89", ">6>=>Y>", "69915946-b8e4-58b1-81dd-7c3a346de02b", "Na wst", "7169fce6-6d49-ed73-1715-55a916fc71e1", "Microsoft.Windows.98.X19-99437_8wekyb3d8bbwe", "6c9Q;", "Asennusymp", "? ?$?(?,?0?4?8?::CreateInstance", "ERROR_SXS_ASSEMBLY_NOT_FOUND", "?/?6?M?T?i?", "d3c3c081-c1e4-d21c-3c9c-f7cd394d0144", "Microsoft.Windows.122.X21-83176_8wekyb3d8bbwe", "c120c01f-63a5-f497-ff8c-760ee295a143", "startern", "ch soubor", "7f160fbc-cb61-7965-d748-d1222c816624", "2Y2f2", "Zu-A;", "8$8,848<8D8P8p8x8", "ATTLIST", "Recovery: Initializing Install Choice: [0x%X]", "Microsoft.Windows.7.res-v4293_8wekyb3d8bbwe", ":8;I;~;", ".rdata$zzzdbg", "PackageMigration: Initializing GDR Path: [%s]", ">5><>[?b?", "CDlpResponseAutomation::GetResultsRoutineEula", "S\\Omi", "ca2cffd3-6cca-b4a5-1165-4dc235a7b611", "Windows Recovery Environment kan ikke vedlikeholdes for ", "Microsoft.Windows.98.X19-99585_8wekyb3d8bbwe", "tO|Fonecore\\internal\\base\\inc\\rtlstringutil.h", "b4bcefe9-9d6e-67d7-611a-a1f1ad06c984", "Microsoft.Windows.165.X21-06166_8wekyb3d8bbwe", "8CW4N-MCWMY-FGXK7-M34XJ-W44C6", "t0jLSV", "ImageDeploy: Creating NewSystem object...", "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon", "Microsoft.Windows.8.X21-83686_8wekyb3d8bbwe", "50@0P0", "MoSetupPlatform: Cancel already requested.", "CreateThread", "yor.%0" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "3ed873893232f4172c55860d3aa8a7c9285514213907e000e3c9b68425dc830f", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/3ed873893232f4172c55860d3aa8a7c9285514213907e000e3c9b68425dc830f", "guest_paths": [ "overlay" ], "size": 8504, "crc32": "B3C8E964", "md5": "2ed5b018b374f2a2b84a4b295572a10c", "sha1": "33bdb5a5b03f81aa4959db3bceb5f1006a8ec8f6", "sha256": "3ed873893232f4172c55860d3aa8a7c9285514213907e000e3c9b68425dc830f", "sha512": "e3facb7f03d82df3128c492fd961786cce80c634a51fbeabaae5c5a74a9819e8dfbb639faf83b10be9bf9c38196678dbfee3dfaadb5a9f058144fa1be6b2b393", "rh_hash": null, "ssdeep": "96:fOJMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGuGDXtxmhdKDm46DfK:WBr8VHwDDBQABJ60vMNIXqnajgKoHX", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1C00219D28B686443DB63BC406358E5877C3D93CB0824946B649EF6A92CD73C9FF0496E", "sha3_384": "5554eef2eebf826534a409ab69130e3aaadbacf2487563438447cde4e9819774eee272e1e46de4e15c6131463f3c0434", "data": null } ], "extracted_files_time": 0.0005414670013124123, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "DU.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/4912abc0a250dfaf63a48e4165e94ab701505f14bcc7a1464d5588fa2d434564", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\DU.dll" ], "size": 123712, "crc32": "B8854089", "md5": "7727a405c9878c2fe052922c1f965384", "sha1": "12ef6479a97c7a6574ca8dd7be6b64f47b79f710", "sha256": "4912abc0a250dfaf63a48e4165e94ab701505f14bcc7a1464d5588fa2d434564", "sha512": "55c1a07bc932c619b585e3b883eaf581f5a0c5c8ed0ab1d1d0386dd344501746420d2541f0cd3caff984472ab65b8a7d49f5fd8821f45e5c4fa7194ddb89e09e", "rh_hash": null, "ssdeep": "3072:7UTZhzH2+F3yOme7PNWCsWlMzeNDz7biF4jL4hgXE:GbF13PACNlDzS4Cn", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T19FC31BB2719C45B2D3EB127DB25D53B25B2BA860C7D192DF313C804919949E6AF3A333", "sha3_384": "4cd252dd2ad2c04a023c8d5e62c88f99e0b5e6511107519b216d6ea6da3a0d9db66719f803739ba685c346707374d8e1", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x00016af0", "ep_bytes": "8bff558bec837d0c017505e845060000", "peid_signatures": null, "reported_checksum": "0x00023bed", "actual_checksum": "0x00023bed", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "du.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x1001b160", "name": "wcschr" }, { "address": "0x1001b164", "name": "_wcsicmp" }, { "address": "0x1001b168", "name": "__CxxFrameHandler3" }, { "address": "0x1001b16c", "name": "_errno" }, { "address": "0x1001b170", "name": "realloc" }, { "address": "0x1001b174", "name": "_except_handler4_common" }, { "address": "0x1001b178", "name": "_unlock" }, { "address": "0x1001b17c", "name": "__dllonexit" }, { "address": "0x1001b180", "name": "_onexit" }, { "address": "0x1001b184", "name": "?terminate@@YAXXZ" }, { "address": "0x1001b188", "name": "_initterm" }, { "address": "0x1001b18c", "name": "_amsg_exit" }, { "address": "0x1001b190", "name": "_XcptFilter" }, { "address": "0x1001b194", "name": "_CxxThrowException" }, { "address": "0x1001b198", "name": "_callnewh" }, { "address": "0x1001b19c", "name": "wcsstr" }, { "address": "0x1001b1a0", "name": "iswspace" }, { "address": "0x1001b1a4", "name": "_purecall" }, { "address": "0x1001b1a8", "name": "memcpy_s" }, { "address": "0x1001b1ac", "name": "_vsnwprintf" }, { "address": "0x1001b1b0", "name": "towupper" }, { "address": "0x1001b1b4", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0x1001b1b8", "name": "??1exception@@UAE@XZ" }, { "address": "0x1001b1bc", "name": "_lock" }, { "address": "0x1001b1c0", "name": "??1type_info@@UAE@XZ" }, { "address": "0x1001b1c4", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0x1001b1c8", "name": "??0exception@@QAE@XZ" }, { "address": "0x1001b1cc", "name": "malloc" }, { "address": "0x1001b1d0", "name": "memmove_s" }, { "address": "0x1001b1d4", "name": "free" }, { "address": "0x1001b1d8", "name": "__RTDynamicCast" }, { "address": "0x1001b1dc", "name": "memset" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x1001b028", "name": "EnterCriticalSection" }, { "address": "0x1001b02c", "name": "LeaveCriticalSection" }, { "address": "0x1001b030", "name": "InitializeCriticalSection" }, { "address": "0x1001b034", "name": "GetCurrentThreadId" }, { "address": "0x1001b038", "name": "GetLastError" }, { "address": "0x1001b03c", "name": "RaiseException" }, { "address": "0x1001b040", "name": "DeleteCriticalSection" }, { "address": "0x1001b044", "name": "Sleep" }, { "address": "0x1001b048", "name": "QueryPerformanceCounter" }, { "address": "0x1001b04c", "name": "GetCurrentProcessId" }, { "address": "0x1001b050", "name": "GetSystemTimeAsFileTime" }, { "address": "0x1001b054", "name": "GetTickCount" }, { "address": "0x1001b058", "name": "UnhandledExceptionFilter" }, { "address": "0x1001b05c", "name": "SetUnhandledExceptionFilter" }, { "address": "0x1001b060", "name": "GetCurrentProcess" }, { "address": "0x1001b064", "name": "TerminateProcess" }, { "address": "0x1001b068", "name": "OutputDebugStringA" }, { "address": "0x1001b06c", "name": "DelayLoadFailureHook" }, { "address": "0x1001b070", "name": "LoadLibraryExA" }, { "address": "0x1001b074", "name": "IsDebuggerPresent" }, { "address": "0x1001b078", "name": "DebugBreak" }, { "address": "0x1001b07c", "name": "SetThreadErrorMode" }, { "address": "0x1001b080", "name": "CreateMutexExW" }, { "address": "0x1001b084", "name": "OpenSemaphoreW" }, { "address": "0x1001b088", "name": "WaitForSingleObjectEx" }, { "address": "0x1001b08c", "name": "OutputDebugStringW" }, { "address": "0x1001b090", "name": "ResolveLocaleName" }, { "address": "0x1001b094", "name": "ReleaseMutex" }, { "address": "0x1001b098", "name": "GetModuleHandleExW" }, { "address": "0x1001b09c", "name": "ReleaseSemaphore" }, { "address": "0x1001b0a0", "name": "CreateSemaphoreExW" }, { "address": "0x1001b0a4", "name": "GetModuleFileNameA" }, { "address": "0x1001b0a8", "name": "LoadLibraryExW" }, { "address": "0x1001b0ac", "name": "FreeLibrary" }, { "address": "0x1001b0b0", "name": "HeapFree" }, { "address": "0x1001b0b4", "name": "GetProcessHeap" }, { "address": "0x1001b0b8", "name": "CloseHandle" }, { "address": "0x1001b0bc", "name": "CreateEventW" }, { "address": "0x1001b0c0", "name": "CompareStringW" }, { "address": "0x1001b0c4", "name": "HeapAlloc" }, { "address": "0x1001b0c8", "name": "SetEvent" }, { "address": "0x1001b0cc", "name": "MultiByteToWideChar" }, { "address": "0x1001b0d0", "name": "WaitForMultipleObjects" }, { "address": "0x1001b0d4", "name": "CreateDirectoryW" }, { "address": "0x1001b0d8", "name": "GetVolumeNameForVolumeMountPointW" }, { "address": "0x1001b0dc", "name": "HeapSize" }, { "address": "0x1001b0e0", "name": "HeapReAlloc" }, { "address": "0x1001b0e4", "name": "HeapDestroy" }, { "address": "0x1001b0e8", "name": "FormatMessageW" }, { "address": "0x1001b0ec", "name": "LocalFree" }, { "address": "0x1001b0f0", "name": "WaitForSingleObject" }, { "address": "0x1001b0f4", "name": "SetLastError" }, { "address": "0x1001b0f8", "name": "GetModuleHandleW" }, { "address": "0x1001b0fc", "name": "GetProcAddress" } ] }, "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x1001b1f0", "name": "CLSIDFromString" }, { "address": "0x1001b1f4", "name": "CoCreateInstance" }, { "address": "0x1001b1f8", "name": "CoInitializeEx" }, { "address": "0x1001b1fc", "name": "CoUninitialize" }, { "address": "0x1001b200", "name": "CoTaskMemFree" }, { "address": "0x1001b204", "name": "StringFromCLSID" } ] }, "WDSCORE": { "dll": "WDSCORE.dll", "imports": [ { "address": "0x1001b150", "name": "WdsSetupLogMessageW" }, { "address": "0x1001b154", "name": "ConstructPartialMsgVW" }, { "address": "0x1001b158", "name": "CurrentIP" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x1001b148", "name": "CharLowerW" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x1001b104", "name": "VariantClear" }, { "address": "0x1001b108", "name": "SysFreeString" }, { "address": "0x1001b10c", "name": "SysStringLen" }, { "address": "0x1001b110", "name": "SysAllocStringLen" }, { "address": "0x1001b114", "name": "SysAllocStringByteLen" }, { "address": "0x1001b118", "name": "SysStringByteLen" }, { "address": "0x1001b11c", "name": "VarBstrCat" }, { "address": "0x1001b120", "name": "VariantInit" }, { "address": "0x1001b124", "name": "SysAllocString" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x1001b000", "name": "RegSetValueExW" }, { "address": "0x1001b004", "name": "RegOpenKeyExW" }, { "address": "0x1001b008", "name": "RegEnumKeyExW" }, { "address": "0x1001b00c", "name": "RegDeleteKeyExW" }, { "address": "0x1001b010", "name": "RegCreateKeyExW" }, { "address": "0x1001b014", "name": "RegCloseKey" }, { "address": "0x1001b018", "name": "RegDeleteTreeW" }, { "address": "0x1001b01c", "name": "ConvertStringSidToSidW" }, { "address": "0x1001b020", "name": "RegQueryInfoKeyW" } ] }, "SETUPAPI": { "dll": "SETUPAPI.dll", "imports": [ { "address": "0x1001b134", "name": "SetupDiGetClassDevsW" }, { "address": "0x1001b138", "name": "SetupDiEnumDeviceInfo" }, { "address": "0x1001b13c", "name": "SetupDiDestroyDeviceInfoList" }, { "address": "0x1001b140", "name": "SetupDiGetDeviceRegistryPropertyW" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x1001b1e4", "name": "RtlFreeHeap" }, { "address": "0x1001b1e8", "name": "RtlAllocateHeap" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x1001b12c", "name": "UuidFromStringW" } ] } }, "exported_dll_name": "du.dll", "exports": [ { "address": "0x100091f0", "name": "??4ClientApplicationInfo@DU@@QAEAAU01@$$QAU01@@Z", "ordinal": 1 }, { "address": "0x100091d0", "name": "??4ClientApplicationInfo@DU@@QAEAAU01@ABU01@@Z", "ordinal": 2 }, { "address": "0x10009150", "name": "??4DownloadOptions@DU@@QAEAAU01@$$QAU01@@Z", "ordinal": 3 }, { "address": "0x10009150", "name": "??4DownloadOptions@DU@@QAEAAU01@ABU01@@Z", "ordinal": 4 }, { "address": "0x10009190", "name": "??4ImageInfo@DU@@QAEAAU01@$$QAU01@@Z", "ordinal": 5 }, { "address": "0x10009170", "name": "??4ImageInfo@DU@@QAEAAU01@ABU01@@Z", "ordinal": 6 }, { "address": "0x10009140", "name": "??4SearchOptions@DU@@QAEAAU01@$$QAU01@@Z", "ordinal": 7 }, { "address": "0x10009140", "name": "??4SearchOptions@DU@@QAEAAU01@ABU01@@Z", "ordinal": 8 }, { "address": "0x10009190", "name": "??4Version@DU@@QAEAAU01@$$QAU01@@Z", "ordinal": 9 }, { "address": "0x10009170", "name": "??4Version@DU@@QAEAAU01@ABU01@@Z", "ordinal": 10 }, { "address": "0x100094c0", "name": "DUCancel", "ordinal": 11 }, { "address": "0x10009410", "name": "DUDownload", "ordinal": 12 }, { "address": "0x10009320", "name": "DUSearch", "ordinal": 13 }, { "address": "0x10009780", "name": "DUShutdown", "ordinal": 14 }, { "address": "0x10009540", "name": "DUStartup", "ordinal": 15 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00018c20", "size": "0x00000287" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0001b210", "size": "0x000000dc" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0001d000", "size": "0x000003e0" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0001c200", "size": "0x00002140" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x0001e000", "size": "0x00001d04" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00008830", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x000011d0", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x0001b000", "size": "0x0000020c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00018b88", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00017ea7", "size_of_data": "0x00018000", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.24" }, { "name": ".data", "raw_address": "0x00018400", "virtual_address": "0x00019000", "virtual_size": "0x000010c4", "size_of_data": "0x00000c00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "4.04" }, { "name": ".idata", "raw_address": "0x00019000", "virtual_address": "0x0001b000", "virtual_size": "0x00000d7a", "size_of_data": "0x00000e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.43" }, { "name": ".didat", "raw_address": "0x00019e00", "virtual_address": "0x0001c000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.15" }, { "name": ".rsrc", "raw_address": "0x0001a000", "virtual_address": "0x0001d000", "virtual_size": "0x000003e0", "size_of_data": "0x00000400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.26" }, { "name": ".reloc", "raw_address": "0x0001a400", "virtual_address": "0x0001e000", "virtual_size": "0x00001d04", "size_of_data": "0x00001e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.71" } ], "overlay": { "offset": "0x0001c200", "size": "0x00002140" }, "resources": [ { "name": "RT_VERSION", "offset": "0x0001d060", "size": "0x0000037c", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.47" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Dynamic Update" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "DU.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "DU.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "96048393aa446d6a9ea450137c963885", "timestamp": "2074-09-11 13:02:40", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 10 }, "data": null, "strings": [ "VPh(>", "%s: Failed to get the IUpdateSearcherInternal object for getting driver sets. hr = 0x%x", "Microsoft", "VShXm", "%s: Failed to set the value for the Version Info SP build number. hr = 0x%x", "%s: Failed to initialize the CDUUpdateCollection. hr = 0x%x", "%s: Failed to create destination directory %s for update number %d from the bundled updates collection. hr = 0x%x", "FailFast", "GUID_DEVCLASS_SMARTCARDREADER", "%s: Failed to set the value for the Image Info language. hr = 0x%x", "%s: Failed to create a new IUpdateDownloader. hr = 0x%x", "GUID_DEVCLASS_EXTENSION", "?.?8?l?s?y?", "?9?K?R?Y?e?q?", "91989>9D9P9\\9u9", "UnhandledExceptionFilter", ".text$yd", "__dllonexit", "%s: Failed to create the root Image Info registry key. hr = 0x%x", "%s: WU_UpgradeI::CreateInternalUpgradeSession failed. hr = 0x%x", "%s: Failed to make a writable shallow copy of the IUpdateCollection. hr = 0x%x", "PQSVW", "959N9]9n9u9{9", "QQSVWhT", "Microsoft Time-Stamp Service", "VPhh;", "%hs: ProcessDeviceClass() failed for NULL device class; hr = 0x%X", ".CRT$XIAA", "%s: Failed to copy update from the WU cache. hr = 0x%x", "<[;J;\\;", ".didat$2", ".rsrc", "%s: Failed to set the value for the Version Info major version. hr = 0x%x", "?$?*?5?A?t?", "7#757Q7g7", ".giats", ".didat$6", "base\\ntsetup\\cdp\\du\\dll\\du.cpp", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ImageInfo", "9~(s,j", "%s: Failed to create the Type registry key for device IDs. hr = 0x%x", "GUID_DEVCLASS_FDC", "ReleaseSemaphore", "%s: No valid driver update type; invalid update", "VWhHv", "Network cost manager is not available; will proceed with download", ">*>1>7>=>H>U>s>", "=2>9>E>P>b>w>}>", "xDU::CDUSession::Search::CServerSelectionReset::DoReset", "[%hs]", "|qbd}pc", "9sd~}j", "4_4l4G5", "%s: Failed to set WU driver applicability property to ignore installed drivers. hr = 0x%x", "?terminate@@YAXXZ", ".?AVCDUSearchCompletedCallback@DU@@", "??0exception@@QAE@ABV0@@Z", "RegCloseKey", "xDU::CDUSession::Download", "xDU::CRegistryManager::CreateImageInfoKeys", "DU::CDUSession::CreateUpdateSession", "RegCreateKeyExW", "4%4,42484C4O4c4y4", "%s: Invalid update removed successfuly", "8$8+81868A8L8R8f8", ".?AUIDUUpdate@DU@@", "8$8B8H8P8j8r8", "%s: Failed to get update number %d from the IUpdateCollection. hr = 0x%x", "=0=\\=c=j=v=", " Microsoft Operations Puerto Rico1&0$", "ComponentUpdate:", "HeapSize", "3&424D4", "GetProcessHeap", "3$303<3P3z3", "2+2v2", "<%<,<2<8Q>[>q>", "base\\ntsetup\\cdp\\du\\lib\\src\\duupdatecollection.cpp", "%s: Failed to get the IUpdateSearcherIgnoreInstalledDrivers object for using WU driver applicability. hr = 0x%x", "xDU::CDUSession::GetOnlineServiceId", "5,5<5L5\\5l5|5", "DU::CDUUpdateCollection::GetItem", "%s: Failed to create the Type registry key for input language features on demand. hr = 0x%x", "100701213655Z", "%s: Failed to create the Update Types registry keys. hr = 0x%x", "%s: Failed to create the Type registry key for Setup updates. hr = 0x%x", "WShXJ", "?%?,?2?8?C?O?c?{?", "SVh@U", "%s: Failed to set the value for the device ID %s. hr = 0x%x", "=%=9=P=W=]=c=q=}=", "%s: Failed to restore server selection %d for IUpdateSearcher. hr = 0x%x", "_errno", "InitializeCriticalSection", "WaitForSingleObject", "<(<4\">/>>>r>", "wcsstr", "%s: Failed to get update type property; hr = 0x%x", "4!4,4@4l4s4z4", "GUID_DEVCLASS_61883", "%s: Failed to set the volume %s for download (to achieve WU cache redirection). hr = 0x%x", "VPh87", "DU::CDeviceIDIterator::ProcessDeviceClass", "%s: WU internal upgrade API mismatch; expected [%s], actual [%s]", "5 5$5(5,5@5H5`5|5", "Microsoft Corporation1&0$", "<%;M;T;[;f;r;", "%s: Failed to set the value for the Client Application Info architecture. hr = 0x%x", "DU::CDUSession::Initialize", "??1exception@@UAE@XZ", "WSh H", "R!s4Z", "1#2>2r2", "7$7*7j7y7", "%s: Invalid search flag 0x%x passed with update types 0x%x. hr = 0x%x", ":::s:", "GUID_DEVCLASS_MEDIA", "%s: Unexpected flight ID property type %d. hr = 0x%x", ":E:Y:s:", "'XD}*", "%s: Failed to get the IDownloadProgress property from the IDownloadProgressChangedCallbackArgs. hr = 0x%x", "_purecall", ">+?k?", "2 2&2,272C2W2", "%s: Failed to create the root Client Application Info registry key. hr = 0x%x", "%s: Failed to clear registry state before starting DU search. hr = 0x%x", "040904B0", "%s: Failed to build the search criteria. hr = 0x%x", "Microsoft Time-Stamp Service0", "GUID_DEVCLASS_DISPLAY", "DU::CDUSession::CancelOperation", "%s: Failed to get network cost from network cost manager. hr = 0x%x", "WShPM", "HeapFree", "%s: Failed to restore service ID %s for IUpdateSearcher. hr = 0x%x", "VPh`8", "9*:A:[:n:s:y:", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "%s: Failed to get IUpdateService2 interface from IUpdateService index %d. hr = 0x%x", "Got IUpdateSearcher properties: server selection = %d, service ID = %s; will restore later", "%s: Failed when iterating over the set of device IDs. hr = 0x%x", "_wcsicmp", "SetupPlatformUpdate:", ".?AVexception@@", "api-ms-win-core-delayload-l1-1-1.dll", "\"Microsoft Window", "191219011500Z", ".idata", "%s: Failed to get generate well-formed GUID string from service ID string %s. hr = 0x%x", ".data$r$brc", "CoTaskMemFree", "%s: Failed to get update ID for update number %d from the bundled updates collection. hr = 0x%x", ".data", ".?AUIDUUpdateCollection@DU@@", "1$2:2O2j2z2", "[%hs(%hs)]", "RegEnumKeyExW", "%s: Failed to get the IUpdateCollection object wrapped up by the CDUUpdateCollection. hr = 0x%x", "696K6W6q6w6", "Redmond1", "bcp47langs.dll", "10.0.19041.572 (WinBuild.160101.0800)", "%s: Failed to clean up the download operation. hr = 0x%x", "%s: Could not get volume path for [%s]. hr = 0x%x", ">-?:?", ">*>7>", "xDU::CRegistryManager::CreateDeviceIdKeys", "%s: Failed to dynamic cast IDUUpdateCollection* to CDUUpdateCollection*", "3%3,383D3X3b3h3", "Msg:[%ws] ", "ole32.dll", "VWPh :", "8+82888>8I8U8i8", "%s: Failed to set WU internal configuration property for targeted scans. hr = 0x%x", "9(9.939F9Z9", " Windows", "j\\Yf;", "1%242I2~2", ";%<>/>;>I>W>c>j>p>v>", "ADVAPI32.dll", "DU::CDUSession::Search::CIncludeDriverSetsReset::DoReset", "404D4X4l4", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\SetupUpdate", ".?AVCTargetedScanReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@", "5\"565M5]5m5", "CategoryIDs contains '", "%s: Failed to restore WU driver applicability property to ignore installed drivers. hr = 0x%x", "USER32.dll", "GUID_DEVCLASS_PROCESSOR", "%s: Failed to append version override criterion value: %s. hr = 0x%x", "EnterCriticalSection", "3S3Z3", "%hs!%p: ", "InstallationType", "SWhHz", "CLSIDFromString", "%s: Failed to allocate the flight ID string", "%s: Failed to append OR string. hr = 0x%x", "GUID_DEVCLASS_INFRARED", "qvd}pRichwd}p", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "VPh`]", "3PhhZ", "%s: Failed to set the values for the Image Info Version. hr = 0x%x", ":):W:n:", "WdsSetupLogMessageW", "CreateSemaphoreExW", "%s: Failed to set the value for the Image Info GDR DU Revision level. hr = 0x%x", "pvd}pc", "%s: Failed to get the update result for update %d. hr = 0x%x", "DU::CDUSearchCompletedCallback::Invoke", "=,=>=Z=", "3 3*3:3J3P3[3a3m3}3", "GUID_DEVCLASS_IMAGE", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ComponentUpdate", "CurrentIP", "<%<7<", "WPh(}", "GUID_DEVCLASS_PRINTERUPGRADE", "%s: Failed to get the hardware id from the update description. hr = 0x%x", ".xdata$x", "GUID_DEVCLASS_PORTS", "VPh8=", "020S0Z0`0f0r0", "?#?7?@?Y?p?z?", "2 2,2;2O2h2v2}2", "4$4*434H4T4[4b4h4", ".didat$3", "DU::CDUUpdateCollection::Invalidate", "5,535?5F5h5", "=%=1===Q=b=", "Microsoft Corporation1", "VPh`<", "RtlAllocateHeap", ".?AVCRegistryManager@DU@@", "GUID_DEVCLASS_PCMCIA", "?\"?.?B?L?S?Y?_?j?x?", "SetThreadErrorMode", "4!4X4u4", ".?AVCDUInterface@DU@@", "<\"=g=s=", "%s: Failed to append category ID contains clause. hr = 0x%x", "towupper", ":$:>:E:o:v:|:", "m;h;", "<);>j>", "%s: Not a component update; request to not extract cab file is invalid. hr = 0x%x", "111019184142Z", "CreateDirectoryW", "umVVW", "%s: CoCreateInstance on IUpdateServiceManager failed. hr = 0x%x", "%hs(%u)\\%hs!%p: ", "?what@exception@@UBEPBDXZ", "Y__^[", "%s: Failed to set the value for the Client Application Info id. hr = 0x%x", "%s: Failed to get the Operation HRESULT of the partially successful download. hr = 0x%x", ".idata$3", "0 0&0,070C0Q0]0d0j0p0{0", "GUID_DEVCLASS_USB", "WSh`N", "1'1.141:1F1R1l1|1", "RtlDisownModuleHeapAllocation", ".rdata", ";*;>;e;p;", "%s: Failed to append closing single quote. hr = 0x%x", "%s: Operation result code (%d) after download indicates failure.", "RPCRT4.dll", "VPhX3", "0\"0+00090>0G0L0U0Z0r0w0}0", "$`2X`F", ": ;@;t;", "3Ph`[", "0$0,040<0D0L0T0\\0d0l0t0|0", "M0K0I", "%s: Failed to allocate the hardware ID string", ".text$di", "WWWWWWP", "du.pdb", "VarFileInfo", "GetCurrentProcess", ":);G;S;u;", "5$585=5R5d5", "%s: Failed to set the value for the Version Info minor version. hr = 0x%x", "??1type_info@@UAE@XZ", "%s: Failed to set WU internal searcher property to include driver sets. hr = 0x%x", "Client", "WDSCORE.dll", "%s: Failed to initialize the device iterator for class %s. hr = 0x%x", "SetupDiEnumDeviceInfo", "|hK,_", "VPh`|", "%s: Upgrade internal session is not available; invalid request. hr = 0x%x", "%s: Failed to get service ID property from IUpdateService2 index %d. hr = 0x%x", "WShXA", "DU::CDUSession::GetNetworkCost", "%s: Failed to append version override's closing single quote. hr = 0x%x", "tNf9E", "DeleteCriticalSection", "%s: Failed to create a new IUpdateSession. hr = 0x%x", "%s: Failed to move update from the WU cache using IUpdate9. hr = 0x%x", "OriginalFilename", ".?AVCAtlException@ATL@@", "%s: Unknown DUSessionStatus: %d", "8)858I8X8r8y8", "_CxxThrowException", "DU::CDUUpdate::GetFlightID", "WSh8B", "Microsoft Windows0", "%s: CoCreateInstance failed. hr = 0x%x", "%s: Failed to set the value for the Image Info edition id. hr = 0x%x", "SetupDiDestroyDeviceInfoList", "7,7<7C7I7O7Z7f7z7", "Major", "%s: Failed to get the collection of updates that was found in the search. hr = 0x%x", "gDU::CDUUpdate::GetHardwareID", "<2http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "GUID_DEVCLASS_MEDIUM_CHANGER", "%s: Failed to set the collection of updates to download. hr = 0x%x", "%s: Failed to get the count of updates in IUpdateCollection object. hr = 0x%x", "SVWj@", "RtlFreeHeap", "8$8,848<8D8L8X8`8x8", "HeapReAlloc", "j[Sh8 ", "%s: Failed to create a new ISearchCompletedCallback. hr = 0x%x", "U0S0Q", "GUID_DEVCLASS_DOT4", "RegOpenKeyExW", "Microsoft Corporation1)0'", "2%292N2y2", "GUID_DEVCLASS_WPD", "LoadLibraryExA", "3#3)3/3:3F3Z3c3o3z3", "WVPh8E", "8 888<8T8d8t8", "SetUpdateDownloadVolume", "8I8x8", "SetLastError", "%s: Failed to copy client application info version's branch value %s. hr = 0x%x", ">*>c>", "%s: Failed to set the value for the Version Info SP level. hr = 0x%x", ".00cfg", "_callnewh", "RegDeleteKeyExW", "9#9*90969B9N9b9w9", "9(949J9Q9W9b9m9y9", "oK0D$\"<", "_lock", "Unreleased DUUpdateCollection interface during DUSession release", "768V8", "%s: Failed to get the number of updates in the collection. hr = 0x%x", "%s: Failed to get update service collection. hr = 0x%x", "%s: Failed to get update identity interface from update. hr = 0x%x", "VWh y", ".rdata$brc", "DU::CDUSession::~CDUSession", "%s: Failed to get current service ID for IUpdateSearcher. hr = 0x%x", "%s: Failed to build OS version information structure. hr = 0x%x", "%s: Invalid update. Removing update from the collection...", ".?AUIRegistryManager@DU@@", "CallContext:[%hs] ", "%s: Failed to append category ID. hr = 0x%x", "%s: Failed to get current WU internal searcher property to include driver sets. hr = 0x%x", "GUID_DEVCLASS_PNPPRINTERS", "%s: Failed to get online service ID. hr = 0x%x", "msvcrt.dll", "%s: Failed to get count from update service collection. hr = 0x%x", "$>0>T>\\>d>l>t>|>", "3$3<3@3X3\\3t3x3", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "z.9Wv", "GUID_DEVCLASS_EHSTORAGESILO", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\SetupPlatformUpdate", "GetCurrentThreadId", "GetUserLanguagesForUser", "%s: Failed to set the Aborted event. GLE = 0x%x", ".data$brc", "SWhp^", "CoCreateInstance", "9)9=9G9", "7(787H7L7\\7`7p7t7x7|7", "VWh d", "%s: Failed to abort the search operation. hr = 0x%x", "6)646H6v6", "7#7Q7_7", "Microsoft Time-Stamp PCA 2010", "%s: Waiting for WU update event neither timed out nor failed; wait status = 0x%x", "4N4a4y4", "Failed to get device compatible IDs; hr = 0x%8X", "iswspace", "3,3@3T3h3|3", "7 7&7,787G7[7x7", "MultiByteToWideChar", "%s: Incompatible search flags 0x%x passed. hr = 0x%x", "memmove_s", "FreeLibrary", "Branch", "`.data", "%s: Failed to create the Type registry key for Driver updates. hr = 0x%x", ".?AVCPropertyReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@", "WPhXR", "%s: Failed to abort the download operation. hr = 0x%x", "ReturnHr", "%s: Failed to get update identity for update number %d from the bundled updates collection. hr = 0x%x", "??4SearchOptions@DU@@QAEAAU01@$$QAU01@@Z", "000E0Z0l0", "Legal_Policy_Statement", "GUID_DEVCLASS_KEYBOARD", "Microsoft Time-Stamp PCA 20100", "4C4J4P4V4a4n4}4", "%s: Caller profile search criterion is not supported. hr = 0x%x", ".?AVCIgnoreInstalledDriversReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ClientApplicationInfo", "__CxxFrameHandler3", "1$181L1`1t1", "VPhL{", "xDU::CRegistryManager::CreateFeaturesOnDemandKeys", "333a3s3z3", "GUID_DEVCLASS_LEGACYDRIVER", "5 5@5H5P5X5d5", "DU::CDUSession::Search::CIgnoreInstalledDriversReset::DoReset", "GUID_DEVCLASS_NETCLIENT", "5G6N6]6i6x6", "%s: Failed to get IUPDATE_INTERNALUPDATEPROPERTY_FLIGHTID from IUpdateInternalProperty. hr = 0x%x", "1<;'>3>E>", "<&<,<2<=(>P>x>", ".CRT$XCL", "UuidFromStringW", "GUID_DEVCLASS_WCEUSBS", "%s: Failed to create the Type registry key for Setup Platform updates. hr = 0x%x", "%s: CoCreateInstance failed for network cost manager. hr = 0x%x", "%s: Failed to create the Client Application Info registry keys. hr = 0x%x", "Wp/wM", "GUID_DEVCLASS_SBP2", ".CRT$XCA", "6Sh(C", "PQQSVW", "3;3E3K3T3g3m3|3", "0?0F0L0R0]0i0", "%s: Tried to get the hardware ID of a non driver update", "5a6u6", "EditionID", "VPhH4", "WSh|B", "SetUnhandledExceptionFilter", "%s: Failed to check whether caller profile search criterion is supported. hr = 0x%x", "?&?P?", "2$2,242<2D2L2T2\\2d2l2t2|2", "Dynamic Update", "VWhPc", "GUID_DEVCLASS_ENUM1394", "141L1S1Y1_1j1v1", "LeaveCriticalSection", "GUID_DEVCLASS_SOUND", "TlP0X", "%s: Failed to create a new IUpdateSearcher. hr = 0x%x", "<,=0=<=\\=h=", "%s: Failed to move/copy bundled update number %d from the WU cache. hr = 0x%x", "%s: Failed to start the asynchronus download. hr = 0x%x", "WilError_03", "SETUPAPI.dll", "0K0d0", "%s: Failed to start the asynchronus search. hr = 0x%x", "%s: Failed to create a new IDownloadProgressChangedCallback. hr = 0x%x", "4!5/595S5w5", "jQSh8 ", "%s: Failed to set the session's client application ID. hr = 0x%x", "du.dll", "WVPhp}", "%s: COM is already initialized in apartment-threaded mode on thread ID 0x%x.", "<$<20R0]0u0", "VPh86", "98:U:g:", "GUID_DEVCLASS_BLUETOOTH", "%s: Failed to get RevisionNumber property from update identity. hr = 0x%x", "ConvertStringSidToSidW", "6<6T6^6|6", "GetSystemTimeAsFileTime", "memset", "%s: Failed to get online service ID GUID from string %s. hr = 0x%x", "DU::CDUUpdateCollection::RemoveItem", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ComponentUpdate\\FeaturesOnDemand", "5c5z5", "GetTickCount", ":::?:W:^:d:j:u:", "ExtractUpdateFromCache3", ".CRT$XIZ", "??4ClientApplicationInfo@DU@@QAEAAU01@ABU01@@Z", "CoInitializeEx", "Datacenter", "152v2", "GUID_DEVCLASS_BIOMETRIC", "CompanyName", ",86RWMce4/9OiZIOWPWcP2jaIRxIc5d0DN25pxwB0tWc=0Z", ".L7Gq", ">,>7>W>", "IUpdateDownloader2 is not available; will proceed with download", "%s: Failed to append open parenthesis. hr = 0x%x", "HeapDestroy", "Minor", "CoUninitialize", "Custom volume is in use in IUpdateDownloader!", "uNPPV", "LocalFree", "SPBuild", "InputLanguages", "2!353C3W3e3q3", "1 1&1*1", "585L5S5Y5_5k5w5", "%s: Failed to get current WU driver applicability property to ignore installed drivers. hr = 0x%x", "%s: Failed to get generate well-formed GUID string from update ID string %s. hr = 0x%x", "InternalName", "%s: Update %d was not downloaded because of error hr = 0x%x.", "Microsoft Corporation1.0,", "WindowsGetStringRawBuffer", "VS_VERSION_INFO", "ProductName", ".didat$4", "%s: Failed to get string from volatile service ID GUID. hr = 0x%x", "%s: Failed to create a new Registry manager. hr = 0x%x", "1.1<1", "PShXl", "%s: Failed to set the values for the Client Application Info Version. hr = 0x%x", ">D>z>", "404U4q4z4", "250701214655Z0|1", "=*=;=B=I=U=f=z=", "%s: Failed to get update number %d from the collection. hr = 0x%x", "~qud}pc", "%s: Failed to end IUpgradeInternalSession. hr = 0x%x", "WindowsDeleteString", "OutputDebugStringW", "7*797S7Z7`7f7q7}7", "ConstructPartialMsgVW", "OLEAUT32.dll", "%s: Failed to copy update from the WU cache using IUpdate8. hr = 0x%x", "%s: Network has cost-related restrictions with best cost 0x%x; will not download.", "%s: Failed to initialize COM on thread ID 0x%x. hr = 0x%x", "RaiseFailFastException", "SPhTW", "_except_handler4_common", "<;%>,>2>8>C>O>c>", "607J7", ".text", "?!?&?/?4?=?B?K?P?Y?^?g?l?u?z?", "VWhXw", "shell\\cpls\\internationalsettings\\duplugin\\lib\\inputlanguagesduplugin.cpp", "Translation", "api-ms-win-core-winrt-string-l1-1-0.dll", "%s: Failed to remove update number %d from the IUpdateCollection. hr = 0x%x", "%s: Failed to set the Completed event", "Build", "%s: Failed to append volatile service ID string %s. hr = 0x%x", "%s: Failed to get move update %s from WU cache using IUpgradeInternalSession. hr = 0x%x", ".rdata$r$brc", "GUID_DEVCLASS_BATTERY", "%s: Ending asynchronous search", "FormatMessageW", "%s: Invalid Operation Result code (%d) after download.", "VPh`:", "DU::CRegistryManager::CreateVersionValues", "GetModuleHandleW", "}qvd}pc", "Language", "Using IUpgradeInternalSession", ".?AUIDownloadCompletedCallback@@", "SetupUpdate:", "??4Version@DU@@QAEAAU01@ABU01@@Z", "DU::CDUUpdateCollection::Initialize", "%Microsoft Windows Production PCA 20110", "joVh8 ", "xDU::CDUSession::WaitForUpdateEvent", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "GUID_DEVCLASS_NODRIVER", "Enable", "%s: Failed to clean up the search operation. hr = 0x%x", "GUID_DEVCLASS_AVC", "10.0.19041.572", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "%s: Failed to end the asynchronus search. hr = 0x%x", "%s: Failed to get the IUpdateDownloader2 object for network cost awareness. hr = 0x%x", "DU.dll", "%s: Failed to append driver type clause. hr = 0x%x", "Failed to destroy device info list; Error = %u.", "%s: Failed to get copy update %s from WU cache using IUpgradeInternalSession. hr = 0x%x", "%s: Failed to get the Operation Result Code of the search. hr = 0x%x", "??4ImageInfo@DU@@QAEAAU01@$$QAU01@@Z", ".?AVCServiceIdReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@", " http://www.microsoft.com/windows0", "%s: Failed to append closed parenthesis. hr = 0x%x", "DU::CDeviceIDIterator::Initialize", "?H?O?U?[?f?r?", "%s: Failed to create the Type registry key for Component updates. hr = 0x%x", "%s: Failed to build version override criterion value. hr = 0x%x", "%s: Failed to create the Type registry key for features on demand. hr = 0x%x", "jTWh8 ", "??4SearchOptions@DU@@QAEAAU01@ABU01@@Z", ".?AVCDownloadProgressChangedCallback@DU@@", "GUID_DEVCLASS_PRINTER", "%s: Failed to get current WU internal configuration property for targeted scans. hr = 0x%x", " Microsoft Corporation. All rights reserved.", ".?AVCDUUpdate@DU@@", "WShpC", "/ServiceEnvironment/WUClientData/ServiceName", "eDU::CDownloadProgressChangedCallback::Invoke", "%s: Failed to create the root device ID registry key. hr = 0x%x", "GetModuleFileNameA", "; ;4;N;^;", "VWhHb", ".?AUIDownloadProgressChangedCallback@@", "8*8;8_8", "ResolveDelayLoadedAPI", ".?AUIDUObject@DU@@", "SVWjl", "_vsnwprintf", "Server", "DU::CDUUpdateCollection::~CDUUpdateCollection", "!This program cannot be run in DOS mode.", "%s: Update %d was not downloaded because of network cost policy restriction.", "RegDeleteTreeW", ">%>*>3>8>A>F>O>T>]>b>k>p>y>~>", "Washington1", ".rsrc$01", "DU::CDUUpdate::UnpackContents", "%s: Failed to create a new IUpgradeInternalSession. hr = 0x%x", "5 5e6", ":$:+:2:>:I:]:s:", "?)?V?", "9!9D9u9", "1$1,141<1D1L1T1\\1d1l1t1|1", "CreateMutexExW", "DebugBreak", "%s: No valid update type found; invalid update", "GUID_DEVCLASS_APMSUPPORT", "GUID_DEVCLASS_VOLUME", "%s: Failed to remove the invalid update from the collection. hr = 0x%x", "%s: Beginning asynchronous download", "_unlock", ":4;H;Z;a;g;m;u;", "??4Version@DU@@QAEAAU01@$$QAU01@@Z", "%s: Failed to create the Image Info registry keys. hr = 0x%x", "x AND VersionOverride='", "ReleaseMutex", "Microsoft Corporation1200", "%s: Failed to allocate client application info version structure. hr = 0x%x", "??4DownloadOptions@DU@@QAEAAU01@ABU01@@Z", "?)?0?D?e?y?", "DU::CDUSession::BuildSearchCriteria", ".gfids", "8+8@8T8[8a8g8s8~8", "%s: Failed to put service ID %s for IUpdateSearcher. hr = 0x%x", "4 4'434?4d4}4", "DUStartup", "zv |y", "HeapAlloc", "WSh0O", ".rsrc$02", "=(=I=W=^=d=m=x=", "UnregisterTargetedSyncService", "RtlDllShutdownInProgress", "GetLastError", ".?AVCDUDownloadCompletedCallback@DU@@", "memcpy_s", "CloseHandle", "jsSh8 ", "QueryPerformanceCounter", "GetModuleHandleExW", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", "GUID_DEVCLASS_GPS", "(caller: %p) ", "GUID_DEVCLASS_1394", "ebfc1fc5-71a4-4f7b-9aca-3b9a503104a0", "GUID_DEVCLASS_NET", "%s: Failed to append version override criterion prefix. hr = 0x%x", "Enterprise", "%s: Failed to get Windows driver update interface from update; hr = 0x%x", "8@9G9e9l9J:", "030O0X0h0o0u0{0", "HardwareID:", "GUID_DEVCLASS_DISKDRIVE", "GUID_DEVCLASS_NETTRANS", ">\">'>B>", "6,=P\"", "6(6A6H6N6S6[6f6k6", "DelayLoadFailureHook", ".CRT$XCZ", "%s: Failed to get the update type from its description. hr = 0x%x", "WaitForMultipleObjects", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\DriverUpdate\\DeviceIDs", "FileDescription", "FileVersion", ":7:Q:", "9 :<:`:|:", "ntdll.dll", "949;9A9G9h9o9u9{9", "696T6", "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\DriverUpdate", "_XcptFilter", "CharLowerW", "%s: Failed to build destination path for update number %d from the bundled updates collection. hr = 0x%x", "??4DownloadOptions@DU@@QAEAAU01@$$QAU01@@Z", "GUID_DEVCLASS_MTD", ".?AVCDUUpdateCollection@DU@@", ".rdata$zzzdbg", "8(9/959;9F9Q9e9u9", "6!606", "%s: Failed to get update description. hr = 0x%x", "Found default AU service at index %d", "%s: Failed to allocate the description CString", "CreateEventW", "_amsg_exit", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "20>0F0^0f0s0{0", "%s: Failed to begin IUpgradeInternalSession. hr = 0x%x", "%s: Failed to create event. GLE = 0x%x", "%s: Failed to set the value for the Image Info installation type. hr = 0x%x", "%hs(%d) tid(%x) %08X %ws", ".idata$6", "%s: Failed to get IUpdate8 interface from update. hr = 0x%x", "20201009052650Z0w0=", "%s: WaitForUpdateEvent failed", "=(=/=5=;=G=S=g=w=", "%s: Failed to set the value for the Image Info architecture. hr = 0x%x", "Unreleased DUUpdate interface during DUUpdateCollection release", "CompareStringW", "??0exception@@QAE@XZ", "%s: NULL category ID provided at index %d. hr = 0x%x", "9$9<9L9\\9d9", "wcschr", "OpenSemaphoreW", "%lu.%lu.%lu.%lu.%hu.%hu.%hu.%u" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "625ddb9f09b7a10609d14e7c08cd8bfc015d3d4992ccfb7021385ff89a2c21d5", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/625ddb9f09b7a10609d14e7c08cd8bfc015d3d4992ccfb7021385ff89a2c21d5", "guest_paths": [ "overlay" ], "size": 8512, "crc32": "7C6D1F3A", "md5": "1735fdc5fb7ab6628ccdba63bc229561", "sha1": "5857b0a7f912ad6a9e99c7554af5e91e9d106f2a", "sha256": "625ddb9f09b7a10609d14e7c08cd8bfc015d3d4992ccfb7021385ff89a2c21d5", "sha512": "6d5ee195d42fdb82290fe4dc6972094a65d793c5a32ba6f606fc3025ea3c2b2d1dd7a6788a82694f4544590d34994448ef260c71df03fdc22e45a1e3f8ec502f", "rh_hash": null, "ssdeep": "96:/4DXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGueDXcjwfV8bBDqh+oDF:TF2q8hDBQABJdc8bVT/gqnajKsLZhr", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1ED0218D18F6C5407DA96798013E8F587BD3E53CF28208062159BF6A01D837C6DB49AAD", "sha3_384": "3fb8ebc30f6b89daf3753deb2fdccfd3bfa13c2354735eb0af7d1cfe5f49a08fdeb7c91bdf43251e449344ed2b177fff", "data": null } ], "extracted_files_time": 0.0007609500025864691, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "diagerr.xml" ], "path": "/opt/CAPEv2/storage/analyses/3/files/627782227a05e7418af9947be6bb5d3dfa1c2ccd6ce712a620acdf33c0fc9f8d", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" ], "size": 2210, "crc32": "AB07733D", "md5": "c3be1a5ebce6585b404ec9a8a08374c5", "sha1": "1c97c240cc7bacb73d354b8a3449e1d52097c5a4", "sha256": "627782227a05e7418af9947be6bb5d3dfa1c2ccd6ce712a620acdf33c0fc9f8d", "sha512": "72c2d5dc4d792a598668f337371121b8449747a11acaddc2915a467483d039df2ae74cf13eb541241350d7f95881aed53485460c74c6dd40edc669d684d13028", "rh_hash": null, "ssdeep": "24:5I5aVbJDP+tUI0X3AN0/1Cvf/g3vvQ/1Cv8Gh/1Cvze/g3vO/1CvVL/1CvR/g3v2:5MwiGI0P4GsfT/7YQPoko", "type": "Unicode text, UTF-8 (with BOM) text, with very long lines (319)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1E341EA2DB1951EBB5C9406B9DFD038C26F8097794106A03795C4FDAFA275082F5B17C9", "sha3_384": "f7f42b075e703b2f322ea7ecbfd5cd597ebe3dab2fc9bafd29ad3052ccd40923d805bede4b58e91ccfd52a6d1f0d945b", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\\xfeff\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "diagerr.xml" ], "path": "/opt/CAPEv2/storage/analyses/3/files/6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6", "guest_paths": [ "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" ], "size": 1908, "crc32": "7CDC5D6D", "md5": "d1e75542ec8d1b4851765a57ac63618e", "sha1": "a231451f545d3133e5d6a0487a59c5dbd01ee50e", "sha256": "6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6", "sha512": "89d3c182833b97b0899ecd45de1439f8341bf2ea11578e2085375a4db3cc18fad221998dc4b6f4407381d2134cb43d78025349ded1e50b6a4eea5919b18b168c", "rh_hash": null, "ssdeep": "24:5I5aVbJDP+tUI0X3AN0/1Cvf/g3vvQ/1Cv8Gh/1Cvze/g3vO/1CvVL/1CvR/g3v9:5MwiGI0P4GsfT/7eLy", "type": "Unicode text, UTF-8 (with BOM) text", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1A0416229B1992EBB5C9446F8DFD038C26F8097794106A03391C4FDAFA239082F5B17CA", "sha3_384": "5cedf9502288ae47d70a36befbafa8692653e4067a2c5f662320a0bbfbef5698b6baab12b9b5c8e0b937cde482d4180c", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\\xfeff\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "setupact.log" ], "path": "/opt/CAPEv2/storage/analyses/3/files/3e88dadeec5703a9c9a3d4c218a27650e006198acece7b2946d3e39ea8fb564b", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" ], "size": 21723, "crc32": "6EFA9CEE", "md5": "7f64604ff6139a5ebd2ed62a0c285784", "sha1": "4d21ba58bfcd83d616813e56aec1e2e053f1b9be", "sha256": "3e88dadeec5703a9c9a3d4c218a27650e006198acece7b2946d3e39ea8fb564b", "sha512": "c153625d72f15558a31fca0d9b85c21f4276085ff94dc82090ca2e1b8a95418fde7702d2f20c2d86315f33ddc3b8010e42da2b2eb9efd12e6c5a615236d4a733", "rh_hash": null, "ssdeep": "192:iqMR72dUPmjkzUxJew+EzkHijcSjsNo5O4pM55euZUH95+l0nu+CERNUkcSeb5Tc:TBfll1JpJD5P2Dc", "type": "CSV Unicode text, UTF-8 (with BOM) text", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T150A249257FBB103227AA6901B345AB0D3A133C4A33D8609F73BF86599B01364CADDBD5", "sha3_384": "a3fc902b3393f899f4f34eeb13a24a3e97b1093f1be7790f21b7415ce44f26809fa7d2ff0251c395a7b4c3279cf9dc30", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\\xfeff2026-05-28 15:53:00, Info MOUPG *************** SetupHost Logging Begin ***************\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: ModulePath = [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: WorkingPath = [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: LoggingPath = [C:\\$Windows.~WS\\Sources\\Panther]\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: MediaPath = []\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: InstallFilePath = []\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: ActionListFilePath = []\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: CmdLine = [/Download /Web ]\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: Mode = [0x8]\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: Scenario = [0x7]\n2026-05-28 15:53:00, Info MOUPG SetupHost::Initialize: Flags = [0x800]\n2026-05-28 15:53:00, Info MOUPG SetupHost: Setup build version is: 10.0.19041.572 (vb_release_svc_prod1.201007-1724)\n2026-05-28 15:53:00, Info CONX pGetHostCSDBuildNumber: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0\n2026-05-28 15:53:00, Info CONX Host OS version: 10.0.19045.0 (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1\n2026-05-28 15:53:00, Info CONX Source OS: Host SKU Info: Edition = 'Professional', Edition Type = 'Client', Installation Type = 'Complete', Product Name = 'Windows 10 Pro', Arch = amd64, StationType = Client Workstation, Stage type = Staged Image\n2026-05-28 15:53:01, Info MOUPG Host OS License State [ Not-Genuine ]\n2026-05-28 15:53:01, Info MOUPG Host OS Architecture [ x64 ]\n2026-05-28 15:53:01, Info MOUPG Host OS Language Id [ 1033 ]\n2026-05-28 15:53:01, Info MOUPG User UI Language Id [ 1033 ]\n2026-05-28 15:53:01, Info MOUPG Host OS Edition [ Professional ]\n2026-05-28 15:53:01, Info MOUPG Host OS Version [ 10.0.19045 ]\n2026-05-28 15:53:01, Info MOUPG Host OS Build String [ 19041.1.amd64fre.vb_release.191206-1406 ]\n2026-05-28 15:53:01, Info MOUPG SetupHost::InitializeComponents\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll]...\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading complete.\n2026-05-28 15:53:01, Info MOUPG CInstallUI::Initialize\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading ID: [3d3ad714-f8d8-4c84-ad5f-10938c2f3339] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\n2026-05-28 15:53:01, Error MOUPG CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading complete.\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading AutomationManager manager...\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading ID: [edac948b-844e-4a51-9ba9-34520bd9ff9f] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\n2026-05-28 15:53:01, Info MOUPG SetupHost: Loading complete.\n2026-05-28 15:53:01, Info MOUPG SetupHost: Initializing automation...\n2026-05-28 15:53:06, Info MOUPG SetupHost: Automation information not found. Releasing automation object.\n2026-05-28 15:53:06, Info MOUPG SetupHost: Attempting to initialize OneSettings values\n2026-05-28 15:53:06, Info MOUPG OneSettings: OS [windows]\n2026-05-28 15:53:06, Info MOUPG OneSettings: OsVer [10.0.19041.3803.amd64fre.vb_release.191206-1406]\n2026-05-28 15:53:06, Info MOUPG OneSettings: ScenarioId [7]\n2026-05-28 15:53:06, Info MOUPG OneSettings: EditionId [Professional]\n2026-05-28 15:53:06, Info MOUPG OneSettings: InstallationType [Client]\n2026-05-28 15:53:06, Info MOUPG OneSettings: Sku [48]\n2026-05-28 15:53:06, Info MOUPG OneSettings: DeviceId [{088B0758-31C5-47D8-9C4B-32E98EB1AB80}]\n2026-05-28 15:53:06, Info CONX Target OS version: 10.0.19041.572\n2026-05-28 15:53:06, Info MOUPG OneSettings: AppVer [10.0.19041.572]\n2026-05-28 15:53:06, Info MOUPG OneSettings: Branch [vb_release_svc_prod1]\n2026-05-28 15:53:07, Info MOUPG OneSettings: Initialization succeeded, but no values found.\n2026-05-28 15:53:07, Info MOUPG SetupHost: OneSettings Initialized -> [No]\n2026-05-28 15:53:07, Info MOUPG SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\SetupMgr.dll]...\n2026-05-28 15:53:07, Info MOUPG SetupHost: Loading complete.\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: WorkingPath = [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: MediaPath = []\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: InstallFilePath = []\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: ActionListFilePath = []\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: Mode = [0x8]\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: Scenario = [0x7]\n2026-05-28 15:53:07, Info MOUPG SetupManager::Initialize: Flags = [0x800]\n2026-05-28 15:53:07, Info MOUPG SetupManager: Working Directory: [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:53:07, Info MOUPG SetupManager: Local Media Path: [C:\\$Windows.~WS]\n2026-05-28 15:53:07, Info MOUPG SetupManager: Scratch Path: [C:\\$Windows.~WS\\Sources\\Panther]\n2026-05-28 15:53:07, Info MOUPG SetupManager: ESD Download Path: [C:\\ESD\\Download]\n2026-05-28 15:53:07, Info MOUPG SetupManager: Media Path: []\n2026-05-28 15:53:07, Info MOUPG SetupManager: Drivers Path: [C:\\$Windows.~WS\\Drivers]\n2026-05-28 15:53:07, Info MOUPG SetupManager: LangPacks Path: [C:\\$Windows.~WS\\LangPacks]\n2026-05-28 15:53:07, Info MOUPG SetupCore::Initialize\n2026-05-28 15:53:07, Info MOUPG SetupCore::RegisterSetupActions\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered IMAGE_EXIT action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered DU_SETUP action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered DU_IMAGE action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered COMPAT_SYSREQ action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered COMPAT_GATED action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered COMPAT_DOWNLOADREQ action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered DISKSPACE_DOWNLOADREQ action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered DISKSPACE_INSTALLREQ action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered COMPAT_MIGCHOICE action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered PKEY_VALIDATE action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered EULA action\n2026-05-28 15:53:07, Info MOUPG SetupCore: Registered COMPAT_INSTALLREQ action\n202 FontSize", "e Failed to get top-level setting info for %s", "WpxXmlNode::HasAttribute", "}hCM28j", "SmiStore::GetSparseNodeChildren::ChildNameEnum::CheckExistsInStore", "p:Constraints", " ", " Failed to add list index node to document", " Couldn't export post-audit generalize option", "Extend", "eUILanguage", "WpxConfig::GetPhaseCondition", "yHSh=", " Couldn't iterate over child paths of %s", " MuteTimeout", "RtlNtStatusToDosError", "@pattern", " FolderLocations", "4 4,4L4T4\\4h4", " ", "2.2<2Z2h2", "y#Vhk", "@language", "9s`v5", ".?AV?$CAutoRelease@PAUIWpxConditionEnum@@@RAII@@", " mobilecore_internal_Audio-AudioCore.man", "4%4*4/4=4", "7D7L7p7", "[%hs]", "060?0Q0s0", "4,474J4O4T4k4u4", "WpxSetting::IsVisible", "4^4x4", "wcm:keyValue", " systemos_internal_LegacyClientCore-Audio-AudioCore.man", " MaintainServerList", " Couldn't export drivers", "WpxUnattendWriter::WritePassSettings", " Failed to write action attribute to item node", " ", ">$>0>", ".?AUIWpxImage@@", " ShowCompatibilityViewButton", " Networking-MPSSVC-Svc-MobileCore.man", " Couldn't write find criterion", ">8?k?", " Invalid option for WillReboot: %s", " ", " ExternalAdapter", " Failed to get text answer for %s", " Failed to read variant-specific settings", " >Microsoft-Windows-Security-Licensing-SLC-UX", ".?AVWpxPackage@@", " Couldn't write display color depth", "wpaf:InstallWindows", "515?5D5`5n5s5", "?'?R?u?", ".idata$5", " ", "080l0", "wpaf:WimImage/wpaf:ImageIndex", " Failed to allocate szRegValue.get()", ".?AV?$CAutoRelease@PAUIWpxTargetStateEnum@@@RAII@@", "3\"3.3E3T3r3", " Failed to iterate over search directories", " Couldn't iterate over features", "= =9=B=T=z=", " OverlayWarningThreshold", "u:package", ".?AVEnum@?1??EnumTargets@WpxConfig@@UAEJPAPAUIWpxTargetEnum@@@Z@", "?&?8?W?j?t?", "FinishOfflinePhase", ";3;J;O;T;`;", " Couldn't filter settings for pass %u", " ", "040904B0", "Microsoft Time-Stamp Service0", ":t:y:~:", " Failed to iterate over allowed map keys", "<7=]=s=", " ", "2G3W3", "yOWh(", ".data$r$brc", "VSj{Z", "Redmond1", "1;1R1e1", " Couldn't iterate over elements", " ", "Letter", "9(9B9a9", ":':/:]:r:|:", "5 5)5.5A5R5W5\\5w5", " Couldn't get child setting %s of %s", "WpxSetting::RemoveListItem", "=F=s=", "9#989J9e9", " Failed to iterate over allowed integer values", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "9-92979E9^9~9", "?)?.?3?A?N?S?X?f?", "restriction\\enumeration", "4/4@4X4\\4`4d4h4l4p4t4~4", " Couldn't export prevent-pending-actions flag", "1$1H1[1", "7 7p7", "= =%=:=d=", " %s: Can't coerce %s as a bool string", "=*=D=I=N=^=v=", ".?AUIWpxWriteOpt@@", "<0", " Couldn't get answer file root node name", " Failed to write variant-specific settings", " Failed to check if left schema enumerates allowed values", " Failed to allocate data", "4M4=5", "=$=B=P=n=|=", " Couldn't create value of %s with key %s", " Incomplete package path given", "1?1D1I1X1s1x1}1", "<'<<<_", "3&3B3x3}3", "t Root node type must be an element", "y0Vhf", "TargetRef", "StringFileInfo", "IcmpRedirectsEnabled", "AhSVW", "5!5&5{5", " ", ".?AUIWpxTarget@@", " Failed to get child nodes", ":/:;:M:k:w:", "<>ControlTab", "Microsoft-Windows-Deployment", " Couldn't parse '%s' as an integer", " ", "2%2=2c2", "768Q8", " Failed to allocate *Extensions", " Unable to load SMI schema hive", "WpxSetting::GetVisibility", "tQjaXjzYf;", "WpxWpafWriter::StripTempListIndices", " Created, but could not retrieve map value %s", "?(?L?T?\\?d?l?t?|?", "DeplUnattendImporter::Clean", " BrowserRefresh", " ", "5 5(5@5D5\\5`5x5", ".?AVEnum@?1??EnumTargetStates@WpxTarget@@UAEJPAPAUIWpxTargetStateEnum@@@Z@", ".?AV?$CAutoCleanupBase@PAD@RAII@@", "", "091u1z1", " EnableLUA", "onecore\\base\\ntsetup\\wpx\\core\\path.cpp", " Couldn't export ignore-check flag", "=&=;=U=p=", "specialize", "WpxUnattendWriter::GetComponentNode", "WpxSetScratchDirectory", "4(4,4<4@4P4T4d4h4x4|4", " Failed to allocate value", " Failed to allocate prop", "%s .%s", " Link2Text", "0(030K0`0x0", ">,>8>X>d>", "Thales TSS ESN:F87A-E374-D7B91%0#", "HZo6m|", " InternalIsBridge", "InstallWindows", "?C?X?^?l?r?", "memmove", " ", "@source", "WpxSetting::ClearAssetTargetPath", " Error getting hive key at %s", "WpxSmiSetting::FindTypeDecl", "%s '%lld'", " ", " Failed to get common settings tree", " Windows", "74797>7J7", " Failed to get pass from pass condition", " Failed to allocate disk", " Couldn't get child node names from unattend map", "%s %s %s", "8'8,8;8]8o8", ";V", "wpaf:Preserve", "?0?8?D?d?p?", "?0?c?h?m?y?", " Scan", " ", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "<@<|<", " Couldn't enumerate map value paths", "InstallToAvailablePartition", " Couldn't get text value from IWpxSchemaAllowedValue", " Failed to check if left schema has a default value", "%s: %lld", "3-3X3e3}3", "m Couldn't count number of items below %s", "9-9A9O9e9{9", "=9=>=C=O=i=", "=\"='=F=T=Y=x=", "/WpxUnattend/Setting", " Couldn't write bool setting %s", " ", "=<=A=F=R=i=t=", "wpaf:Payload", "y3Vh'", "memmove_s", ";$;(;@;D;\\;`;x;|;", "`.data", " Conditions: Argument cannot be NULL", " AppUserModelId", "4'4c4h4m4y4", " Couldn't count list items under %s", "969;9@9N9c9w9", " Couldn't export assembly name", "wpaf:Common", "/u:unattend/u:settings[@pass='oobeSystem']/u:component[@name='Microsoft-Windows-Deployment']/u:Reseal", " CopyProfile", " moderncore_internal_Audio-AudioCore.man", "wpaf:Display/wpaf:Resolution/wpaf:Width", "DeplUnattendImporter::ImportInstallImage", " TapiUnattendLocation", "%s: %s and %s cannot both appear under the same %s node", " Microsoft-Windows-RecoveryAgent.man", "e Couldn't find declaration source node", "DeplUnattendImporter::ImportOnlineDepl", " ", ".?AV?$CAutoHeapFree@PBG@RAII@@", ">!>3>O>\\>", "858:8?8N8c8", ":<:g:", "DeplUnattendExporter::ExportInstall", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:UILanguage", "ActivateWhenSupported", "Check", " Failed to allocate node", "WpxWpafWriter::Write", "6.7O7n7", ":*:5:M:b:w:|:", "y@WjEh", " ", " Failed to serialize package state %u", " >Microsoft-Windows-WwanUI", "848<8D8L8T8`8", "2!353_3", " Couldn't export package permanence", "210303183039Z0p1", "5*585V5u5", " shwebsvc.man", " Couldn't iterate over allowed values", "/wpaf:Settings/wpaf:Customizations/wpaf:Variant", "C ;G u", "0'0M0R0W0i0", "787@7H7P7X7`7l7", "u:UpgradeData", " Couldn't write initial customization blob path", "Width", "SmiStore::Release", "7&7B7R7]7|7", "8$8)878I8N8S8a8n8s8x8", "6*7M7p7", " ", " Failed to query subkey %u of SMI hive root key", "y-Sh/", " Failed to extract file extension from %s", "wpaf:ModifiedPartitions/wpaf:Partition", "8+8F8]8", " Couldn't get answer for %s", "DeplWpafExporter::ExportEvents", "", "494l4", ".?AV?$CAutoRelease@PAVFilter@?1??FilterExcludedChildren@SmiStore@@AAEJABVWpxPath@@PAUIWpxStringEnum@@PAPAU5@@Z@@RAII@@", ".?AV?$CAutoCleanupBase@PAUIWpxDeplImporter@@@RAII@@", "6\"6,6Q6e6{6", "4)5T5", " ", " Color", "9 969J9h9~9", " ", "9regfu`", " ", "InternalName", " Couldn't validate whether %s is in the allowed values enum", "%s is not a valid file path", "8#9(9-9<9T9i9n9s9", ".?AVWpxConfig@@", "DeplUnattendExporter::ExportDriver", " Feature selection missing required @name attribute", ":(:,:D:H:`:d:|:", "6 6,6L6T6`6", "RtlNumberOfSetBits", " ", "SharedLocalDataFile", " arch: Argument cannot be NULL", "SettingNode::GetDefaultInt", ">;>@>E>Q>j>", ";8;`;", " ", "<+LicensingMode", ">!?>?V?n?", "WindowsPE", " Answer enumerator failed", "5;5Z5c5w5", "? ?3?E?]?z?", "Translation", ".?AUIWpxVisibilityStateDesc@@", " Couldn't write firewall enabled setting", "0-02070F0V0x0}0", " ", " Filter callback returned a failing error code", " Can't get parent schema node for %s", "U(9M ", "memcpy", "WindowsDown", " Couldn't parse boolean value %s for UpgradeData Upgrade", " ", "3'4,414=4", "y4Wh<", "y3VhK", " >Microsoft-Windows-AllUserInstallAgent", " Couldn't check whether %s has a list item friendly name", "Parse error (0x%08x)", "g Couldn't get answer for bool setting %s", "versionScope", ".?AV?$CAutoCleanupBase@PAVWpxUnattendMap@@@RAII@@", " EnabledScenarioExecutionLevel", ".?AVTextEnum@?1??GetAnsEnumValues@SmiSchemaNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@", "e Unknown processor architecture %u", " http://www.microsoft.com/windows0", " WindowsComma", " ", " ", " ShowMenuBar", "<3TerminalServices-LocalSessionManager.man", " Couldn't add Targets node to document", "2,2J2v2{2", " publicKeyToken=\"31bf3856ad364e35\"", "wpaf:SkipLicenseCheck", "203<3", "y0PhV", "1/2S2y2", " Couldn't set namespace prefix on document", "8'8,818b8|8", "?8?c?}?", "y&Wh2", " Terminalservices-LicenseServer.man", " WindowsPageDown", " DisplayName", " Couldn't get the system scratch directory", " ", "ProductKey", "8#999R9", " Failed to allocate meta", "151D1U1Z1_1j1", "wpaf:SearchDirectories/wpaf:Directory", "4+4C4Y4f4q4", "WPh<]", " ", "353X3]3b3m3", " Couldn't find setting schema for %s", "6+666O6[6`6e6", "j XPhL", " >Microsoft-Windows-MobileCore-Audio-AudioCore", " Couldn't open schema store from %s image %u", " >Microsoft-Windows-NetBT", "/wpaf:Settings/wpaf:WindowsPE", "GetModuleHandleExW", " Failed to initialize WpxXmlNode", "PPh4j", "2;2O2|2", "ImageTimeOnly", " Failed to iterate over elements", " Package source missing required location attribute", "82878<8H8U8`8x8", " Must specify both a metadata XPath and a text value", " Failed to write dependency %u", "y Wj@h", "DeplUnattendExporter::WriteValue", " Failed to parse policy for package %s", ".?AV?$CAutoCleanupBase@PAVKnobsAllowedValue@@@RAII@@", "2$3)3.3E3O3g3y3~3", " production\\coresystem_prod_Audio-AudioCore.man", " Source for setting %s missing required @Path attribute", " Failed to parse boolean value for ProvisionDisk node", "?$?>?V?`?e?x?", " Couldn't set answer for %s", "WpxWpafWriter::WriteMetadata", " Networking-MPSSVC-Svc.man", "Installed", "FinishOfflinePhase/Action", "wcschr", "OpenSemaphoreW", "797>7C7O7f7q7", "onecore\\base\\ntsetup\\wpx\\file\\wpafreader.cpp", "3<5e7", "y-VjCh", " Failed to get integer value from IWpxAllowedValue", " Couldn't export feature name", "u:ImageName", " Failed to open schema hive key %s", " Couldn't delete answers for item %llu of %s", " ", "?O?]?{?", "restriction\\maxLength", " OEMName2", " CEIPEnabled", "y*VjOh<]", " Failed to parse value %s for FinishAuditMode node", " ", "RtlReleaseSRWLockExclusive", " ", "6;6f6", ";9;O;_;m;", "DeplUnattendExporter::ExportDiskID", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:Restart", " Couldn't write primary UI language", ":):=:U:v:", " Couldn't record default answer", " Failed to set answer for %s", "SmiStore::GetSparseNodeChildren", " Failed to allocate itemNode", "0(080H0X0h0x0", "Minimum", "Windows Provisioning XML", "7C7H7W7u7", "=\"=)=4=;=F=M=u=z=", "0 0(0,040<0@0H0P0X0p0t0", "6'6?6Z6", "091I1", "5:5R5w5", "/u:unattend/u:settings[@pass='auditUser']/u:component[@name='Microsoft-Windows-Deployment']", "1,1I1j1o1t1", " ", "WpxWpafWriter::WritePassSettings", ".?AUIWpxDeplInsSettings@@", ";~0sM", " ", "WpxAnsTree::EnumChildPaths", " Failed to scan policy XML for setting declarations", " Couldn't write EULA action", " Couldn't export package prevent-pending-actions flag", "1*1F1h1w1", " Failed to prune non-existent path %s from the unattend map", "GetProcessHeap", "@name", "WpxStore::GetChildrenUnder::ChildEnum::GetNext", " Failed to import element", " Failed to read multivariant targets", ".?AV?$CAutoRelease@PAVMcsfStore@@@RAII@@", ".?AVKnobsStore@@", " Failed to allocate feature", "calloc", " Couldn't write OOBE-phase reseal mode", "%s '%s'", "0!1K1P1U1a1u1", "7_8o8z8", "5$565A5T5l5x5}5", " Couldn't import packaging operation", ":):4:?:R:d:w:}:", "Vj\\h0", " Unknown find condition operator %s", "u:component[@name='%s']", "", "MaxItemCount", "<#<(SetRegionSpecificPrivacyAccessPolicy", " Couldn't read common settings", " Failed to write computer name", " Couldn't export error %u to validation report", "e element missing required @Name attribute", " Failed to record default answer", "5/54595S5]5p5w5~5", " Failed to retrieve converged store contents from WIM", "WpxConfig::GetVariantSetting", "WPX_FOOTPRINT_RESOURCE_TYPE", "SlicedEncryptionMinSize", "444P4U4Z4e4y4", "6/6G6S6X6]6}6", "ModifyPartitions", "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:ProductKey", "%s xmlns='%s'", "WpxSetting::GetAnsMaxLength", "<#<(<-<<LmAnnounce", " TargetIDs: Argument cannot be NULL", "y_WhN", " ", "WpxUnattendReader::ReadBoolValue", " Failed to allocate enc", "\"Microsoft Window", " ", "9M;\\;o;u;", " Failed to allocate path", "G;~(r", "GreaterThan", ";,;7;V;[;`;k;", " Couldn't read image information", "MinMajorVersion", "WPX.DLL", ";$;,;8;X;`;h;p;|;", "b=f=l=p=v=z=", " Couldn't write common settings tree", " ForceOffAccessibility", " Microsoft-Windows-IE-ESC.man", " Couldn't set @name attribute", "DeplWpafExporter::ExportEnvUser", "u:Password", " Value %lld is below the inclusive minimum %lld", ":_:l:", " Don't know how to present SMI type 0x%08x as a map key", " Failed to enumerate children below %s", " Failed to allocate image", "ADVAPI32.dll", ":%;=;V;|;", "KnobsStore::Initialize", "settings", "t(WjGh|7", "WpxUnattendReader::ReadComponent", "9&9A9n9s9x9", " Couldn't get deployment settings WPAF importer", " DiagCpl.man", " Couldn't get common settings tree", "7*7K7W7b7w7", " Missing .appx path (Path) / .appxbundle path (Bundle)", "WpxUnattendWriter::WriteCommonTree", "remove", "676c6", " Couldn't get or create configuration's deployment settings", " ", ".?AVKnobsVisibilityRule@@", " ", "=3=D=]=b=g=s=", "525<5N5e5~5", " ", ".?AV?$CAutoRelease@PAVWpxValidation@@@RAII@@", "?#?(?-?9?M?Y?e?j?o?", "WpxSetting::GetListItem", " Failed to write condition parameter name", " IntranetCompatibilityMode", ".?AV?$CAutoRelease@PAUIWpxDeplImporter@@@RAII@@", " Invalid boolean value %s for DynamicUpdate Enable", " Gadget1", "u:OptIn", " Couldn't get root schema node", ".?AV?$CAutoCleanupBase@PAVWimStoreEnum@@@RAII@@", " ", "u:InstallFrom", "wpaf:DataMigration", " AutoLogon", " Couldn't check if map key has a maximum length", "?)?B?G?L?d?o?", ">8>=>B>N>d>", "y,Vj0h", "8,808H8L8d8h8", " Couldn't find footprint resource %s", ">4>9>>>J>f>", " ", " specialize", " TBP", ":I:Z:", " Can't initialize disk using partition table type %u: unattend only supports 'auto'", " ", ";v<|<", "7'7,717<7U7`7z7", "WpxSetting::GetDefaultBool", "%s xmlns:%s='%s'", "WIMCloseHandle", "PSQQj", " ", " HideAllBootUI", "wpaf:Language/wpaf:InputLocale", " Security-Licensing-SLC-UX.man", " auditUser", ";6;;;@;O;l;", ".?AVEnum@?1??EnumTargets@WpxVariant@@UAEJPAPAUIWpxStringEnum@@@Z@", ";5;A;F;K;", " Failed to parse %s as a setup pass", " ", ":#;8;C;[;o;", " Couldn't change item index below %s", "5/5O5n5s5x5", "QSVj0f", "<\"<'<2OfflineUserAccounts", "2.2E2Z2j2u2", "=6=J=O=T=`=z=", "1\"2]2", " ", "wpaf:WdsImage/wpaf:FileName", ".?AV?$CAutoCleanupBase@PAVWpxSimpleAllowedValue@@@RAII@@", " embeddedeshell.man", ".idata$3", ":.:H:_:l:w:", " ", ".?AV?$CAutoLocalFree@PAG@RAII@@", " WindowsDeploymentServices node missing required ImageSelection node", "DeplUnattendExporter::ExportFeature", "WpxSetting::GetMapKeyMinLength", "WpxWpafWriter::WriteTextSetting", "Value", "WpxSmiSetting::GetMaxOccurs", " ", " ", " Map settings %s has multiple value nodes", "9;9@9E9T9", "@passes", " Failed to get item count for list setting %s", " ", " Couldn't write input layered driver", " Not setting scratch dri to '%s' because the directory was not found", ">1>6>;>V>a>", "D$(Ph", ".?AV?$CAutoRelease@PAVMcsfLeafNode@@@RAII@@", " ", "McsfLeafNode::ParseRegistryType", " Failed to check whether schema has a fixed set of allowed file extensions", "", "DeplWpafExporter::ExportEnvLanguage", "\\Windows\\Provisioning\\Microsoft-Common-Provisioning.dat", " ", "WpxWpafReader::ReadPhaseSettings", ";, to the document tree", " ", ":#;^;", "WpxPathTree::RemovePath", " Couldn't iterate over nodes matching %s", "ShutDown", "Loaded unattend mapping", "??0exception@@QAE@ABQBD@Z", "=#=-=O=c=", "DeplUnattendExporter::Export", "444R4q4v4{4", " Failed to check if left schema has a pattern", "7+7G7_7q7", " ", " Failed to record asset target path %s", ">,>4><>D>L>T>\\>h>", ";);H;];h;~;", "@xsd:maxOccurs", " Couldn't extract SMI hive %s from WIM image to %s", " ", " ", " Failed to query maxOccurs for %s", "1 101T1\\1d1l1t1|1", "6 6(606H6L6d6h6", "u:Username", "?,?0?D?H?`?d?h?|?", ".?AV?$CAutoRelease@PAVSmiSparseNode@@@RAII@@", "WpxSetting::MoveListItem", "WpxCondition::GetVariant", " UserAuthentication", " Failed to iterate over elements", " ComputerName", " Couldn't write WIM metadata text", " ", "DeplWpafExporter::ExportEnvLogFilePath", " Couldn't read key for item in map setting %s", " ", " Failed to add map key node to document", " ", "/u:unattend/u:settings[@pass='auditSystem']/u:component[@name='Microsoft-Windows-Deployment']", ".?AV?$CAutoCleanupBase@PAVWpxValidation@@@RAII@@", " Couldn't export feature %u", " Couldn't create phase condition for phase %u", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:UILanguageFallback", " WillReboot is not allowed in this setting pass", "; <%<*<7<{<", "?'?C?M?R?", " Couldn't enumerate child nodes", " ", "j(XQPh", "WpxValidation::ValidateInt", "WpxSmiGetHiveValue", "3$3,343<3D3L3T3\\3d3l3t3|3", "FriendlyName", "y*Vj\"h", " >Product-coresystem__Microsoft-Windows-Audio-AudioCore", "RtlValidRelativeSecurityDescriptor", "7#7F7a7|7", " Couldn't get int value from IWpxSchemaAllowedValue", " Couldn't read error reason from IXMLDOMParseError", "8-9l9", "8!8K8P8U8d8{8", " Failed to get integer answer for %s", " DomainProfile_EnableFirewall", " Couldn't export encrypted disk setting", "GetFinalPathNameByHandleW", " ", " MaxDecryptRequests", "metadata\\elements\\%s", "Payload", " >Microsoft-Windows-WorkstationService", " RestartEnabled", "DeplWpafExporter::ExportSvcFeatures", " Couldn't write accept EULA setting", "112n2s2x2", "WpxWpafWriter::PostProcessDocument", " PublicProfile_LogDroppedPackets", "y Vj>h", " >Microsoft-Windows-PnpSysprep", "y3Wh3", " CustomPowerApplication6", "DeplWpafExporter::ExportInsOptions", ">9>S>k>v>}>", " Failed to delete %s[%s] in order to overwrite it with answer file value", " %s does not allow any passes suitable for phase %u", "2'2A2\\2v2", "y#VhH", " shsetup.man", "WINDOWS/VERSION/SPLEVEL", " Couldn't export assembly language", "292L2V2h2w2", " Themes", " ", "6'6/6E6M6q6z6", "cAMDuE", " Couldn't export user organization", "50545L5P5h5x5", "CompanyName", " PreventAutoConnect", "wpaf:ComputerName", "FullName", " Skipping unrecognized child %s specified for tree setting %s", "0,1l1", "9-989H9S9d9t9", " This store does not publish %s", " Specifying both or with in the same disk is not allowed", ":C:`:e:j:v:", "=,=9=L=U=", "SmiSchemaNode::GetMapKeyPattern", " ", "1D1|1", ".?AVEnum@?1??GetVisibility@WpxAllowedValue@@UAEJPAPAUIWpxVisStateEnum@@@Z@", "y2Ph;", "WpxConfig::GetLoadedStores", "e Warning: %s could not be unregistered from answer tree", "676O6o6", "WpxWpafWriter::WriteVariants", "ImageMetadata", "SkipLicenseCheck", ".?AV?$CAutoRelease@PAUIWpxAllowedValueEnum@@@RAII@@", ".?AV?$CAutoCleanupBase@PAUIWpxSchemaAllowedValue@@@RAII@@", "<&", ">3?\\?", ".?AV?$CAutoCleanupBase@PAVWpxReadOpt@@@RAII@@", ";/<4<9", " Error while trying to validate the Common settings tree's answers", "<:", "4 515N5d5i5n5z5", ".?AUIWpxStringEnum@@", "7N7S7X7d7~7", "=)=.=3=?=N=c=", " Couldn't set friendly name for %s", "8'9?9K9]9{9", "2H2U2m2", "8B8m8", "1$1,141@1d1l1t1|1", " Gadget3", " Phase: Argument cannot be NULL", "e Failed to allocate children", "jiXVPh", "wpaf:Language/wpaf:SystemUI/wpaf:FallbackLanguage", "4\"4.4L4", " Failed to export disk criterion", "j!XWPh", "8#878W8r8", " PanningDisabled", "9^0v0", " FallbackOrder", " WindowsU", ";4;B;W;\\;a;m;", "WpxConfig::GetPhaseSetting", " Failed to write item index to element", " Failed to check if right schema has a pattern", "DeplUnattendImporter::ParseBool", " Couldn't write CompactOS flag", "33383=3U3`3v3", "DeplUnattendExporter::ExportCreatePart", ".?AV?$CAutoRelease@PAUIWpxSchemaAllowedValue@@@RAII@@", " Failed to read list index of list item %s", "QueryPerformanceCounter", "$Microsoft Ireland Operations Limited1", "6D6W6k6}6", "2 2(20282@2H2P2X2`2h2p2x2", "y1Vh(", ".?AVConditionEnum@?1??EnumConditions@WpxConfig@@UAEJPAPAUIWpxConditionEnum@@@Z@", " ", " Failed to convert base type %s of setting type %s for setting %s to an SMI type", "SmiSchemaNode::GetAnsEnumValues", ".?AV?$CAutoRelease@PAUIWpxTargetEnum@@@RAII@@", " Couldn't write integer setting %s", " Failed to allocate reseal", "7(7=7J7U7n7", "DeplUnattendImporter::ParseReseal", "Atomic", " Failed to check if left schema has an upper bound", " >Microsoft-Windows-BrowserService", " Couldn't retrieve answer at path %s", "WpafTempListIndex", ">6>;>@>W>a>", "848@8`8l8", "WpxWpafWriter::GetPhaseTree", " Couldn't write audit mode computer name", " ", "PWVSV", " ", " ", "y&Vh[", "=!=2=I=[=z=", " Feature selection missing required @state attribute", "WpxSetting::GetParent", " >Microsoft-Windows-SystemMaintenanceService", " Cannot specify extra files along with a .appxbundle", " Failed to allocate paths", "0#0.0F0`0z0", " IEHardenAdmin", ".?AVSettingNode@@", " TrustedSites", "7`7e7j7v7", "s Couldn't create answer for %s", "1#1@1Z1j1u1", "boolean", "y,Vhq", " Couldn't validate answer for setting %s", " Failed to export use-boot-disk flag", "wpaf:UserInfo/wpaf:Name", "WpxStore::EnumSources::SourceEnum::GetNext", "455:5?5K5m5", " >Microsoft-Windows-MobilePC-Sensors-API", " Couldn't allocate ns", "DeleteFileW", "", " >Microsoft-Windows-MigrationWizardApplication", " ", " Load contents of resource, but can't get Unicode length", ".?AUIWpxVisibilityRuleDesc@@", "DeplUnattendExporter::ExportPackage", ">!?&?+?7?Q?i?y?", " Failed to iterate over the configuration's variants", ".?AV?$CAutoCleanupBase@PAUIWpxVisibilityRule@@@RAII@@", " ", "<(<:", "SVWjL", "919<9T9h9", " Failed to iterate over dependency files", "WpxConfig::GetCommonSettings", "y#VhT", "5(656M6", "WpxSetting::Clone", "=4=@=V=[=`=l=", " Must specify a destination drive, partition index, or allow any partition index", "2 2,2T2p2", ".CRT$XCU", ".?AVChildNameEnum@?1??GetChildrenUnder@WpxUnattendMap@@QAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@", " ", "WpxSmiSetting::GetChildNames::SubKeyEnum::GetNext", "2 2%212G2L2k2p2u2", "1(181U1f1r1~1", "3 3'303;3X3]3b3n3", "KnobsStore::GetRoot", ">3>m>", " RestartMinute", "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:DataImages", "2,202H2L2d2h2", "is invalid (no details available)", ">$?G?b?", "9!9&989X9", "yBSjth", " Couldn't export assembly processor architecture", "4#4/4E4Y4^4c4r4", " WindowsEscape", "y-Vjmh", ": :%:6:G:R:o:t:y:", "SmiSparseNode::Initialize", " ", " ", " fAllowToGetHelp", " Failed to iterate over visibility rules", "7\"7'767J7\\7a7f7u7", "5,545<5D5L5T5\\5l5t5|5", "4*4C4H4M4X4e4p4", "3<3o3", "u:Diagnostics", " Error initializing bool data.", ".?AV?$CAutoRelease@PAUIWpxStateDescEnum@@@RAII@@", " Failed to find type declaration %s for setting %s", "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableDynamicUpdate", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "2%2*2/2:2N2S2X2c2u2", " NumItems: Argument cannot be NULL", "WpxAllowedValue::GetVisibility", " Couldn't enumerate child paths of %s", "u:ModifyPartitions/u:ModifyPartition", "4$4,444@4d4l4t4|4", ".?AV?$CAutoCleanupBase@PAVKnobsVisibilityState@@@RAII@@", " LocalIntranetSites", "1&1@1X1e1p1", "RunAsynchronous", "WpxSmiSetting::ParseBuiltInType", "McsfLeafNode::Initialize", "QQSVWj0", " EnableSPADLaunchErrors", " Failed to write universal app path", "jIXWPh", ": :$:(:@:D:X:\\:t:x:|:", "\\jaXf;", " CacheLimit", " Couldn't initialize WpxSettingIssue", ":2:Q:", "string too long", "yEWh9", "MobileOperator", " Couldn't compute length of base64-encoded buffer for %s", ".?AV?$CAutoCleanupBase@PAUIWpxAllowedValue@@@RAII@@", " ", "/wpaf:Settings/wpaf:Provisioning/wpaf:ProvisioningPackages", ".?AV?$CAutoCleanupBase@PAUIXMLDOMDocument3@@@RAII@@", "7#8(8-898S8g8q8", "<'PrintBackground", "y+Wh/", ".?AV?$CAutoRelease@PAVWpxSource@@@RAII@@", "1K1X1j1", "y=Wh\"", " ", ">$>,>4><>D>L>X>x>", "StrToIntW", " >Microsoft-Windows-LUA-Settings", "WpxSetting::GetAnswer", " RemoveMXDW", " Couldn't write subtree under %s", " %s: Can't marshal (WPX_SMI_TYPE)%u as an integer", " Couldn't set @VERSION_SCOPE attribute", "/0E0c0", " No entry in unattend map for setting %s", "t$pVQ", " Couldn't write page file size", " Couldn't iterate over synchronous commands", "?4?8?P?T?l?p?", "4W5{5", "MinMinorVersion", " ", ".?AV?$CAutoCleanupBase@PAUIWpxStateDescEnum@@@RAII@@", ":,:5:::N:j:u:", " >Microsoft-Windows-EnhancedStorage-Adm", "8'8]8e8p8", " Couldn't iterate over disks in DiskConfiguration", " Couldn't write disk index", "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:InstallWindows", "SettingNode::GetDefaultBinary", " Couldn't export provisioning packages", "= =%=3=K=j=o=t=", ".?AV?$CAutoCleanupBase@PAUIWpxConditionEnum@@@RAII@@", " Failed to write destination partition", " Incomplete access credentials (username and password are required)", " Couldn't serialize partition table type %u", "9{|v5", ".?AUIWpxAllowedValueEnum@@", ".?AV?$CAutoRelease@PAVWpxReadOpt@@@RAII@@", " Failed to get variant from condition", "wpaf:Network/wpaf:Enabled", " Couldn't load image %u from WIM file %s", " Failed to allocate profiles", " ", " ", " Must specify an existing partition index on entries of ", "374O4[4m4", "F;spr", " >Microsoft-Windows-NetworkLoadBalancing-Core", "SmiStore::FilterExcludedChildren::Filter::GetNext", "WpxSetting::SetListItemName", ">$>>>V>c>n>", " ", " RemoveMPDW", ";\"WindowsTab", "WpxXmlNode::AddChild", "Ordered", ".?AUIWpxPackage@@", " Failed to append child node", " Failed to serialize the common settings tree", " Package path %u is incomplete", "u:UserLocale", " PersistAllDeviceInstalls", "SVWj|", "111019184142Z", ":9:M:i:", "Display/Resolution/Width", " versionScope=\"nonSxS\"", " Couldn't iterate over node children", "0M0R0W0c0", " ", ".rdata", "0*040C0S0]0l0", ">1>8>>>H>]>", "WpxSmiSetting::ParsePasses", "1 1,141h1x1", "2\"2Y2", "DeplUnattendImporter::ImportPackaging", " ", ".?AV?$CAutoCleanupBase@PAVWpxVariant@@@RAII@@", " language=\"neutral\"", " Couldn't find schema for answer path %s", "/u:unattend/u:settings[@pass='auditSystem']/u:component[@name='Microsoft-Windows-Deployment']/u:Generalize", "DeplWpafImporter::ImportPackage", " Unrecognized option for : %s", "DeplUnattendExporter::ExportEnvironment", "DeplUnattendImporter::ImportAuditSysDepl", "585=5B5S5", "2O2T2Y2m2x2", "!Vjzh", " FindProvidersURL", " International-Core.man", "WpxWpafReader::ReadVariants", "> >1>A>R>W>\\>", " Failed to strip %s attribute under %s", " Failed to allocate targets", "Feature", " Can't enumeration children of a complex setting", "DeplUnattendImporter::OrderNodes", "y/Vh{", ":%:@:E:J:V:q:v:{:", " ", ">6?B?T?x?", " Incomplete WIMBootFrom node (DiskID and PartitionID are required)", "5#5,555J5_5n5v5", " Must specify either a package file path or a package keyform", ":\":-:D:d:i:n:y:", " LinearityData", " Shell", "DeplWpafExporter::ExportSvcSessions", "ProvisioningPackage", "y#Vhn", " FlyoutAutoPowerScheme", "? ?$?(?,?0?4?8?Microsoft-Windows-TerminalServices-RemoteConnectionManager", ">&><>O>d>i>n>z>", " Couldn't load schema for %s", "5.53585G5q5", "0+00050D0`0", ">*>]>", "%s: Variant references undefined target state '%s'", ";#;C;_;q;", " >Microsoft-Windows-OutOfBoxExperience", " Invalid migration option %u", "8#8(848O8j8|8", " Couldn't write value for setting %s", " ", "&WjQh", " >Microsoft-Windows-UnattendedJoin", "y-Vho", "RtlRunOnceBeginInitialize", " ", "y/WhZ", "?-???V?d?", "3 3$3(3<3L3P3T3l3p3", "u:InstallImage", " Couldn't write refresh rate", "package/state", "wprintf", " OutOfBoxExperience.man", "memcmp", " HKCUuseDefaultOverscanMargins", "u:UserData", ".?AV?$CAutoRelease@PAUIWpxVisibilityState@@@RAII@@", "/wpaf:Settings/wpaf:WindowsPE/wpaf:ComputerName", " Failed to initialize WpxXmlNode (item %u of %u", " Item node for map setting %s doesn't declare a key (%s)", " Couldn't export implicit-session packages", " Failed to parse document", " Couldn't add comp to document", ".?AV?$CAutoRelease@PAUIWpxAnswerFileReader@@@RAII@@", " NotificationArea", "WpxSettingIssue::BuildDescription", " ", "4'4k4", "?-?K?g?t?", " Couldn't export OS install image", " Can't specify for entries of ", " ", "0(151M1", "@xsd:type", "UniversalApps", "< =6=I=N=S=_=", " element does not have a @pass attribute", " Image InstallTo disk must have a single Index=(...) criterion", " BTSearchIntervalOnDC", " ", "h This tree doesn't have an entry for %s", "v Couldn't iterate over WindowsPE drivers", "1!111<1M1`1{1", "2'272C2J2P2U2Z2{2", " ", ".?AVEnumerator@?1??GetVisibility@KnobsAllowedValue@@UAEJPAPAUIWpxStateDescEnum@@@Z@", ":0:=:H:`:w:", " Couldn't iterate over provisioning packages", "4A5h5u5", "282H2Y2^2", "WpxTarget::RemoveTargetState", " ", "<\"<0", " PartnerId", ",kGyqWihIdz3igX5CMycIIyZVdDhWRuUV9/PZf6wjxkQ=0Z", "SSSQW", " Fax", "?8?=?B?N?m?", "3;3l3x3", " ", " 0?0I0N0", "l Contents: Argument cannot be NULL", " TerminalServices-CentralPublishing.man", "package/@permanence", "2B3v3", " Couldn't check whether the decl for %s has an @key", "%s: Key must have at least %lld character(s)", "y-PhC", " WorkOffline", " ", " Failed to clear source path from answer object", "WpxSetting::IsMapValue", " Couldn't run query: %s", " Not recording default answer for list/map/tree setting", " Failed to allocate driver", "OLEAUT32.dll", "%s: Inside node %s, can't parse '%s' as a binary", " Values: Argument cannot be NULL", " Failed to allocate visibilityRule", "3-3E3K3e3v3", "u:InstallToAvailablePartition", " WPAF doesn't support temporary package paths (use unattend instead)", "4!5&5+575G5]5p5u5z5", "y-Sj~h", " IWpxDriver missing required Path parameter", "f9A4sMht", "0(1S1~1", " Issue: Argument cannot be NULL", " FavoriteBarItems", ".?AVWpxDeplSettings@@", "202H2U2`2y2", "y%Vh$", "u:HorizontalResolution", "9 9(909H9L9d9h9", "WIMGetImageCount", " ", ".?AUIWpxDeplImporter@@", "?*?=?", " Couldn't write main UI language", " Failed to serialize answer file to string", "8-82878C8", "SmiStore::Initialize", "8\"8'8,8L8[8q8~8", " Couldn't clear answer at %s", "5+5L5k5p5u5", "u:Value", "WpxSmiHive::Mount", "WindowsDeploymentServices", " RegistryExceptionsUserDefined", ">#>H>]>o>|>", "/wpaf:Settings/wpaf:AuditMode", "y#Whn", "/u:unattend/u:servicing", " WindowsRight", "0=0I0N0S0v0", "2%2C2P2r2w2|2", "DiskID", " Icon", "WpxSmiSetting::GetDefault", " Couldn't generate unique file name in %s", "Package/Install", " Couldn't iterate over CreatePartitions", ";,;0;H;L;d;h;", " Couldn't enumerate names of children under %s for Windows %s %s", " WindowsB", ".?AV?$CAutoRelease@PAVWpxSmiHive@@@RAII@@", "1$1,141<1D1L1T1\\1d1l1t1|1", "8>8C8H8`8k8", " Receipts", ";(;8;H;X;h;x;", " EnableICS", "/wpaf:Settings/wpaf:Servicing/wpaf:Packages", " %s node missing required Order parameter", ".?AVout_of_range@std@@", ".gfids", ".?AV?$CAutoRelease@PAVWpxConfig@@@RAII@@", ".?AV?$CAutoCleanupBase@PAVWpxCondition@@@RAII@@", " Couldn't import disk", ".rsrc$02", "WINDOWS/VERSION/BUILD", "RtlDllShutdownInProgress", " ", "memcpy_s", "%I64u", "GetTempFileNameW", ";#;z;", "%s is not one of the allowed values", "y-ShA", " fvefilterdriver.man", " ", "yBWh9", "7 7(70747<7D7H7P7X7\\7d7l7p7x7|7", " Can't query whether setting %s has a maximum", " ModifyPartition requires a PartitionID", "WpxSmiOpenWimStore", "component", "%s/p:Setting[@Name='%s']", "_amsg_exit", ".?AV?$CAutoCleanupBase@PAE@RAII@@", "4/4]4j4", ".?AV?$CAutoRelease@PAVWpxSetting@@@RAII@@", " ", "3*4/444@4Z4", " Couldn't query for attribute %s", "wpaf:Condition", "8-979`9e9j9", " ", ".?AV?$CAutoRelease@PAVKnobsStore@@@RAII@@", " LsaCfgFlags", "y-Vhj", " wlansvc.man", "Microsoft", " Failed to allocate res", "FailFast", "wpaf:WdsImage/wpaf:ImageName", "Equals", " Couldn't import package", " DisableAutoDaylightTimeSet", "141<1H1l1t1|1", "UnhandledExceptionFilter", " ", "__dllonexit", "3$3=3B3M3k3p3u3", "OptIn", " ", "11161;1G1V1o1x1", " ", ">-?X?", " ", "878T8t8", "2%2E2K2z2", " >Microsoft-Windows-DeviceAccess", ";-;b;", ".?AV?$CAutoRelease@PAVKnobsAllowedValue@@@RAII@@", "2\"3E3J3O3^3z3", " Couldn't write variant-specific settings tree(s)", "UserData", "WpxSetting::GetListItemName", "Apply", " Cannot instantiate %s: left schema (Windows %s %s) and and right schema (Windows %s %s) have different schemas", "7@7U7u7", " MaxLength: Argument cannot be NULL", "Drivers", "u:OSImage", "5D6y6", "VSjRZ", "y4Wh?", "UILanguageFallback", "invalid string position", "SmiSchemaNode::GetAnsEnumValues::IntEnum::GetNext", " InstallTo is required for WDS images", "74797>7I7`7o7~7", "0 0%010C0P0[0z0", " Error initializing int data.", ".giats", "y-WhV", " Failed to load excluded URIs from footprint files", "", " Couldn't write user locale", " Failed to allocate logs", "McsfApplyInfo::GetResolvedTargetPath", " Failed to allocate finishOffline", "y-Pjlh|7", "0+050e0", " Couldn't case NODE_ELEMENT IXMLDOMNode to IXMLDOMElement", " Couldn't export language settings", " DuplicatorDescription", ">(>8>H>X>\\>l>p>", " ", "?1?t?", " Microsoft-Windows-Fax-Service.man", " coresystem_internal_Audio-AudioCore.man", "2c3z3", " Failed to traverse to %s in %s", "wpaf:IgnoreCheck", ">9>D>Y>w>", " Must specify a VHD file path", "4*4/444B4]4t4", ":':B:p:", "DataOnly", " Failed to allocate modified", " Couldn't parse Type attribute", "FallbackLanguage", " Too many sections in package ID: %s", "989L9a9", ".?AV?$CAutoCleanupBase@PBE@RAII@@", " IWpxVisibilityState enumerator failed", " '%s' is too short (keys must have %u characters minimum)", "8)8t8", " Failed to export session %u", "0G0[0v0", " Failed to write force-install flag", "CFG_DATATYPE_INTEGER", " Failed to decode base64 binary value for %s", ".?AVValueEnum@?1??GetIntEnumValues@WpxSmiSetting@@QAEJPAPAUIWpxIntEnum@@@Z@", ":1:>:I:b:y:", " ", " >Microsoft-Windows-RemoteAssistance-Exe", "2&2;2S2]2b2g2", " Couldn't read line position from IXMLDOMParseError", "0@0c0", "DeplUnattendImporter::ImportModifyPart", " Failed to get newly-inserted item %llu of %s", " Couldn't set @publicKeyToken attribute", "EvalValueContains : Not yet implemented", "<)<.<3w>", " ", " element missing required @Path attribute", "8W8c8w8", "4 4@4H4X4|4", " Unknown package state %u", " Incomplete feature (name and enabled are both required)", " Can't query whether setting %s has a pattern", "ImageCustomizations", "QSVWj", "0\"0'0,080J0_0}0", " Failed to allocate startOOBE", " ", "9'999>9C9U9y9", ":w:}:", "DeplUnattendImporter::ImportOobeDepl", "7-787P7g7", "DeplUnattendImporter::ImportDisk", " Couldn't set text for element <%s>", "778|8", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:UserLocale", ";';,;H;~;", " SecurityLayer", ";-;2;7;F;", "WpxPathTree::AddPath", "9regfuD", " Failed to create new target state", " Setting: Argument cannot be NULL", "4!4D4I4N4Z4v4", "WpxSetting::GetMapKeys", "9*9[9b9g9", "8/8D8O8`8s8", " OEMInformation", "towupper", "=(=H=P=X=h=", "KERNEL32.dll", "hCMScSP", ".?AV?$CAutoRelease@PAVWpxUnattendMap@@@RAII@@", " Couldn't add element to document", "s Failed to allocate svc", ".?AV?$CAutoCleanupBase@PAUIWpxVariantEnum@@@RAII@@", " Couldn't write partition filesystem type", "y%Whs", "090f0", "Microsoft-Windows-Foundation-Package", "u:Domain", ".?AV?$CAutoDelete@PAVWpxDriver@@@RAII@@", "WpxWpafReader::ReadIntValue", "2:3?3D3O3d3i3n3|3", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:LogPath", "y6Sh)", " ", " Couldn't create element %s", " Missing image destination information", "WpxWpafReader::Read", " Couldn't export package assembly ID", "?3?T?Y?e?", " Couldn't get base type for simpleType %s of setting %s", "0\"0'0,070Q0k0z0", " Couldn't export deployment settings", "3$3)3.3a3{3", "WpxUnattendWriter::WriteBinarySetting", "3X3e3}3", " package missing required assemblyIdentity parameter", ";);.;3;>;Q;b;n;z;", "MaxMajorVersion", " VolumeControl.man", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:UseConfigurationSet", "494\\4{4", "=7=<=A=O=T=", ";(<@CustomPowerApplication1", " Couldn't sort modified partitions", "<$<,<8?`?e?j?v?", " Failed to allocate deps", "SmiStore::GetSparseNodeChildren::ChildNameEnum::Initialize", " RequirePlatformSecurityFeatures", " Couldn't write WDS image group", ".?AUIWpxPartition@@", "4,4;4O4f4{4", "Extended", ".?AUIWpxSchemaAllowedValue@@", "SVWj@", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:DiskConfiguration", " CtrlWin", " ", " ", " Couldn't parse macros in policy path %s", ":':5:::Y:t:", "<$<1LaunchMediaSelect", "QQh4j", "0C0V0`0o0", "C$;G$u", "@processorArchitecture", " ", "WpxSetting::InsertListItem", "4/5_5u5", ">3?S?h?z?", "y-VjGh", "/wpaf:Settings/wpaf:Provisioning/wpaf:ProvisioningCommands", " ", " Failed to load Knobs schema hive", " ", "/wpaf:Settings/wpaf:Deployment/wpaf:Install/wpaf:Online", ">3>E>^>c>h>v>", "#0>0X0]0b0n0", "VSjYZ", "<*<5", " Couldn't set binary answer for %s", " ", " Invalid boolean value for EnableFirewall", " Failed to allocate creds", "CspSource", ":1:B:V:a:y:", " WindowsQ", " SensorPermissions", "EnableNetwork", "?K?c?h?m?x?", " ", "/u:unattend/u:settings", "y-Vhn", " TapiConfigured", "AnsUpperBound", "WpxValidation::ValidateAnswer", " Couldn't check if answer has a minimum length", " >Microsoft-Windows-GPIOButtons", " Size", " PlaySound", "1-1F1c1", " ", "0/04090E0W0z0", "4-42474E4U4f4k4p4", "9F9W9_9s9", "ImageSelection", " Couldn't write post-generalize reseal mode", " Failed to allocate asmid", " Couldn't write auditSystem reseal shutdown flag", " RFC1156Agent", " Returning false because this isn't an integer setting", "LockResource", "474S4k4", ".?AVKnobsAllowedValue@@", " production\\moderncore_prod_Audio-AudioCore.man", " stobject.man", " ", " Failed to move target item from temp index to %llu", "http://schemas.microsoft.com/WMIConfig/2002/State", " Failed to allocate sync", "WpxSetting::GetAnsUpperBound", " ", "???D?I?", " PerfCenterCPL.man", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", " Couldn't get parent setting of setting %s", ":*:5:A:U:`:l:", "(Sjuh", "y-Vh%", " Couldn't export disk wipe setting", " Can't specify for entries of ", "WpxWpafWriter::WriteAssetSetting", "9)9.939?9k9", "y.Vhj", ":1:K:`:p:", "?6?;?@?L?^?}?", " Couldn't adding %s to path tree", " SidebarOnByDefault", "_except_handler4_common", " ", "e Couldn't get setting at answer path %s", " SqmApi.man", "4 5:5X5w5|5", " >Microsoft-Windows-DiagCpl", "s Couldn't query if %s has a maximun number of occurrences", "onecore\\base\\ntsetup\\wpx\\core\\visibility.cpp", " Couldn't write command description", ":$:,:4:<:H:h:p:x:", "9U9_9y9~9", "", "6%6=6", " ", "?6?R?W?\\?t?", "?0?", ";+;8;C;\\;", " Failed to allocate strIndex", " HKLMProxyEnable", "Removable", " Failed to get map value setting %s", "EnableFirewall", "242<2D2L2T2\\2d2l2t2", " >Microsoft-Windows-Embedded-ShellLauncher", " ", " WindowsW", " ", " ", "?3?8?=?K?[?", "Vjih4j", "yIShV", "7-7=7B7G7S7`7e7j7v7", "WpxWpafReader::ReadSettingsTree", "WpxExclusionList::Load", "989e9j9o9~9", " Couldn't enable XML parse error reporting", " ", ";3;?;K;P;U;x;", " ", " >Microsoft-Windows-Fax-Service", "DeplWpafExporter::ExportEnvDisplay", "? ?.?Gadget2", "WpxValidation::ValidateString", " DisableComplexStretchesOnConsole", "0-0f0k0p0", " ", " ", " Failed to get boolean answer for %s", "9O:n:", "e Failed to allocate state", " HKUSERSuseDefaultOverscanMargins", " Source for setting %s missing required @Type attribute", "8'8F8g8", "=,>@>O>[>`>e>", " Couldn't validate whether %u is in the allowed values enum", " SearchScopes", " ", " ", "10151:1E1W1\\1a1l1", " PrivateProfile_EnableFirewall", " Couldn't serialize criterion operator %u", "1(232D2X2l2", " Unable to parse content of StartAuditMode node: %s", " Failed to allocate disp", "0(0H0P0\\0|0", "9O:v:", "303a3", "%hs: User requested %u bytes, but RegGetValue only read %u", "5\"5g5z5", " Condition missing required @Name attribute", " Couldn't find schema path for %s under %s", "WpxWpafWriter::WriteTarget", "9hbinu", " Failed to write Id attribute", "wpaf:VhdImage/wpaf:Path", ".?AV?$CAutoDeleteArray@D@RAII@@", "WpxXmlDocument::LoadFootprint", "8\"878B8Z8n8", " ", "EvalValueLessEqual : Not yet implemented", " ", "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-PnpCustomizationsWinPE']/u:DriverPaths", "yBWhT", "<*<@EnableLinksBar", "484K4P4U4a4", " systemos_internal_Audio-AudioCore.man", " Couldn't find declaration for type %s", " Failed to allocate driverNode", " Couldn't import CreatePartition", ".?AV?$CAutoCleanupBase@PAUIXMLDOMNode@@@RAII@@", "MetaData", "1%1*1/1:1S1`1e1|1", "=$=(=0=8=P=T=l=p=", "<1WindowsPageUp", " ", "Loaded image %u from WIM file %s", "malloc", "1 1%1*161d1", ".?AV?$CAutoRelease@PAUIWpxVisRuleEnum@@@RAII@@", " SkipAutoActivation", "7<8X8~8", "8 848D8h8t8|8", "229879+4583620", "93989=9I9]9b9w9|9", " Couldn't export provisioning package %u", " Couldn't write value '%s' for metadata field %s", " Couldn't export network enabled flag", "yEPhe", " Failed to check if element %u of path %s is a map key", "WpxStore::SupportsRuntimeProvisioning", " TerminalServices-RemoteConnectionManager.man", "WpxUnattendReader::ReadTextValue", ">;?S?", " ", "u:VerticalResolution", " Can't specify extra files for a .appxbundle", ">*>:>E>^>", "wcsstr", " Map schema node has multiple child nodes", " Couldn't parse element", " ", ";(;-;2;A;N;h;q;", " ", "t Failed to allocate text", "DeplUnattendImporter::ImportAuditDepl", " partmgr.man", " ", " Failed to allocate source", "Category", " ", "not present", " Couldn't get element %u of %s", "646<6D6L6T6`6", "u:WillReboot", "9&919_9j9", "u:ImageInstall", ";J$>(>0>8><>D>L>d>h>", "2'2b2m2", "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableConfigurationSet", "5)545M5a5v5", "Dependencies", "Logical", "<(<3MaxEncryptRequests", "= =D=L=T=\\=d=l=t=|=", " Found but could not determine size of resoure %s", ".?AVValueEnum@?1??GetTextEnumValues@WpxSmiSetting@@QAEJPAPAUIWpxStringEnum@@@Z@", "WpxCondition::CheckSetting", " Schemas differ for property %s (left: %s, right: %s)", "Display/RefreshRate", " Failed to export store app %u", " ", "WpxTargetState::AddTargetCondition", ";7;<;A;O;^;j;o;t;", " Failed to query setting visibility", " ", "UnattendedSetup", "onecore\\base\\ntsetup\\wpx\\depl\\model.cpp", "WpxVariant::AddTarget", " >Product-clientcore__Microsoft-Windows-Audio-AudioCore", "ApplyAfterSetting", " Targets: Argument cannot be NULL", "y#Vh2", "u:Upgrade", "=.=T=Y=^=u=", ";$;);.;:;I;", " ", " Failed to load SMI schema hive", "1@2p2", "Continue", " The OS doesn't have a WPX-compatible settings store", "DeplWpafExporter::NewChild", " CtrlF4", "McsfLeafNode::ParseValidation", " Couldn't get unattend deployment setting importer", "9\\$D|", "Filename", " clientcore_internal_Audio-AudioCore.man", " StartTiles", "Microsoft Corporation1", "MinLength", "OSImage", " OEMWelcomeCenterLinks", " Skipping unknown child %s below %s", "wcscspn", "SmiStore::GetSchemaNode", ".?AV?$CAutoCleanupBase@PBG@RAII@@", " Attributes for conflicting condition types both specified", " Couldn't set node text for %s", "WpxSetting::GetAllowedFileExtensions", " ", "WpxXmlDocument::Initialize", " ", "9:9?9D9S9", "6/6n6", " ", "2!3(3=3G3", "909D9`9s9", " Couldn't write command reboot flag", "This node isn't an element, returning NULL", "%s for the asset's source path", " ", " Couldn't query allowed passes for %s", "1#131>1W1c1h1m1", "DeplWpafExporter::ExportSvcUniversalApps", " Failed to initialize SMI setting store", "wow64", " Couldn't enumerate child paths below %s", "0]0b0g0v0", " Can't read type of value %s", " oobeSystem", " WindowsPlus", ";/;P;g;u;", " Couldn't get string for reboot option %u", "95:F:\\:a:f:q:", "WaitForSingleObjectEx", "WpxUnattendReader::Read", "wpaf:WimImage/wpaf:Path", " Internal IWpxVisibilityStateDesc enumerator failed", ">%>B>O>q>v>{>", " Failed to allocate conditions", "5r6w6|6", " windowsPE", "3 3:3T3k3x3", "7(70787@7L7l7x7", " WindowsSlash", " Failed to write package description", ";*;F;K;P;g;r;", "8#8D8I8N8Z8o8", ">!>5>N>z>", " Clusters", "4,41464M4W4e4", "SelectionNamespaces", ".?AUIWpxTargetCondition@@", " Couldn't write dynamic update setting", "LayeredDriver", "<(<0<< node: %s", "FinishAuditMode", "y-Wjah", "2'2?2T2n2", "='=,=1=H=R=q=", "3n4w5", "DeplWpafImporter::ImportAudit", "=-=2=7=P=[=p=x=", " ShowGallery", " ", " Couldn't write custom partition type", ":8:@:H:P:`:", " Couldn't enumerate children of %s", " ", " Failed to set document namespace prefix for unattend namespace", " InstalledBrowserExtensions", " Failed to get schema for item of %s", "McsfStore::GetSchemaNode", " ProductKey", " ", "WpxXmlDocument::EnableErrorReporting", " Failed to copy string, insufficient buffer.", ".?AVWpxWpafReader@@", " DisableAntiSpyware", "%s is missing", "8*8/848A8", "hCMcsSh", " Failed to iterate over synchronous commands", " Couldn't write package permanence value", "<\"", " Couldn't read value of asset setting %s", " MSCompatibilityMode", " WindowsSpace", "u:Login", " Failed to get text value from IWpxSchemaAllowedValue", "6)7b7}7", ".?AVDeplWpafImporter@@", " Failed to write access username", "y&VhE", " ", "3(4]4", " Unable to query if the setting %s has a display name", "Cx;s|r", " Unable to query if the setting %s has a description", " Missing required child element Component", "HeapReAlloc", " PrivateProfile_LogFile", "%0`0j0x0", "<8HKLMHistoryPerUserItem", " EnableAuthenticationTraps", " Driver PathAndCredentials missing required Path parameter", " Failed to remove answer object from answer tree", "7*7D7i7", ";!;.;3;>;[;`;e;q;~;", " IEHardenUser", "<9Gadget4", "7$7D7]7", " Couldn't import settings from %s", "WpxPopulateFromConvergedStore", "5B5S5k5p5u5", "Deleting temporary Knobs hive at %s ...", " ", ".?AV?$CAutoRelease@PAUIWpxVisibilityRule@@@RAII@@", " Microsoft-Windows-IE-InternetExplorer.man", "DataImage", " >Microsoft-Windows-Wlansvc", "?,?Security-Malware-Windows-Defender", ";. element", "7 7$7(7@7D7X7\\7t7x7|7", " Failed to write destination partition is automatic", "5 6D6f6z6", ".?AVIntEnum@?1??GetAnsEnumValues@SmiSchemaNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@", "DeplWpafExporter::ExportSvcCommands", " ", " Couldn't write UpgradeData flag", " StartPanelLinks", ">.>F>S>^>", " ", ",PjRh", " shell-sidebar.man", ": :(:0:4:<:D:H:P:X:\\:d:l:p:x:", "RestrictSearch", "wpaf:Size", "3+3?3K3W3\\3a3", " ", "y&Vhs", "QSVWjL", " SyncDomainWithMembership", ".?AVChildEnum@?1??GetChildrenUnder@WpxStore@@QAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@", " Failed to allocate crit", "506<6Q6^6", "50585D5d5l5x5", "Values", "343c3", "WpxAnsTree::ClearAnswer", "DeplWpafExporter::ExportEnvCommands", "0,1:1?1R1l1", "8-8[8", " Can't specify for entries of ", " >Microsoft-Windows-Store-Client-UI", " ", "uNPPV", " Invalid setup pass %u", " ", "0 0$0(0,0004080<0@0D0H0L0P0T0X0`0h0p0x0", "WpxConfig::GetPhaseSettings", ";#;=;V;t;", " IWpxSetting instance is not an instance of WpxSetting", "InstallTo", " ", "Microsoft Corporation1.0,", "><>_>", ":':=:N:k:", "y-Phn", " Couldn't get existing child at index %u", "1;1`1t1", " Failed to get the host Windows directory", "y-VjNh", "161D1f1}1", " ", " Failed to write access password", "PathFileExistsW", "<+<<", "3#3.3D3P3[3q3}3", "SettingNode::SetDefaultText", "8 888<8T8X8p8t8", " Couldn't write answer file", "wpaf:Description", "wpaf:Permanent", "WpxValidation::ValidateSettingTree", "0+0m0r0w0", "WpxConfig::EnumConditions", "FormatMessageW", "8$8:8E8y8~8", "GetModuleHandleW", " ", "82878<8K8\\8m8r8w8", ":-:H:a:s:", " Couldn't get schema node at path %s", "s Failed to iterate over elements", "y3Vh*", "yEWhN", " ", " Schema hive contained unknown primitive type %s", " Couldn't get error %u", "7\"7D7c7h7m7y7", " Couldn't get parent node for %s", " Failed to open knobs store while populating converged store", "1!1T1Y1^1m1", " ", "SettingNode::GetAllowedFileExtensions", "DeplWpafExporter::ExportDiskCrit", "ModifiedPartitions", " >Microsoft-Windows-TerminalServices-LocalSessionManager", "@wcm:keyValue", " ", "=,=F=]=j=u=", ";C;Y;^;~;", " ", ".?AV?$CAutoCleanupBase@PAVOrderedNodeEnum@DeplUnattendImporter@@@RAII@@", "WakeAllConditionVariable", ">T>v>", " WindowsI", "6@6W6r6~6", " ", "wpaf:Execute", ">)>.>3>?>]>r>", " ", " Couldn't iterate over drivers", ">5>:>?>O>", " Failed to allocate store", "6-6;6Q6V6[6s6~6", " Failed to add target to variant", "ReleaseMutex", "u6F;w", "y-Shw", " Expected IWpxCondition to be of type WpxCondition", "0%020<0A0F0b0h0q0", ";:;e;", ".?AV?$CAutoCleanupBase@PAUIWpxSetting@@@RAII@@", "WpxUnattendWriter::WriteIntSetting", "=$=,=4=<=D=L=T=`=", " ", "6t7{7", ".tls$ZZZ", ".?AVWpxCafWriter@@", "MBSDriverSet", " production\\prod_Microsoft-Windows-IE-InternetExplorer.man", "WpxVisibilityRule::IsSatisfied", ";$;,;4;<;D;L;T;\\;d;l;t;|;", "FileDescription", ";(;3;S;b;", "_XcptFilter", " ", "1'1,111?1U1`1", "WpxOpenStoreFile", "90:l:", " ", " ", " WindowsShiftUp", " Failed to allocate m_FoundationPackage", ".?AV?$CAutoRelease@PAUIWpxVisibilityRuleDesc@@@RAII@@", " Failed to clear target path from answer object", "WINDOWS/VERSION/MINOR", "DeplWpafExporter::ExportDriver", "*[local-name()='%s' and @%s='%s']", "LessThan", " TerminalServices-Publishing-WMIProvider.man", "DeplUnattendImporter::InferImageType", "3)3B3Y3f3q3", "WpxPathTree::HasChildren", " ", "ClusterSize", ".?AUIWpxDeplSettings@@", " ", "/wpaf:Settings/wpaf:SetupEvents/wpaf:StartAuditMode", "5:5D5\\5a5f5r5", "868a8|8", " ", "727M7p7", " DisableStatefulPPTP", "4@4k4", ";O;y;~;", " Couldn't read value of textual setting %s", "DeplUnattendImporter::ImportWdsImage", " Can't create IXMLDOMDocument3 instance", " ShiftControlEscape", "e missing required @action attribute", "4*484S4s4x4}4", " Couldn't export data image %u", "0&020D0{0", ".?AV?$CAutoCleanupBase@PAVSmiSchemaNode@@@RAII@@", "5:5P5m5", " Failed to allocate multipleErrorMessages", "20201008032758.968Z0", " _^[]", "y/Phd", ".?AVWimStoreEnum@@", " InstalledBHOList", " TCGSecurityActivationDisabled", " Couldn't remove attribute %s", " Failed to parse state for target %s", "wpaf:Username", " IWpxDriver %s has incomplete access credentials", "%s is too long", "DeplUnattendExporter::ExportServicing", "/wpaf:Settings/wpaf:SysprepGeneralize", " StoreContentModifier", " LeftShiftLeftAltNumLock", " Couldn't import ", "3$3:3", "5 6%6E6e6", " ", " ", "4/4;4@4E4s4", " Value for Validate/Option must 0 or 1 for boolean settings", "2.2L2h2q2|2", " ", "WINDOWS/EDITIONID", ".?AUIWpxDeplSvcSettings@@", " PublicProfile_LogFile", "5,5<5L5\\5l5|5", "WpxSetting::NumListItems", " Failed to initialize schema hive node for %s", " RegisteredOwner", "jaZjz", ".?AV?$CAutoRelease@PAUIWpxTargetCondEnum@@@RAII@@", "00040L0P0h0l0", " Couldn't iterate over created elements", ".?AUIWpxTargetState@@", "f91uIf", "0<0A0F0R0v0{0", "@deprecated", "0?0_0}0", " Failed to export driver %u", " ", " Failed to enumerate visibility rules, will return FALSE", "TargetRefs", "627<7[7l7", " Couldn't get system temp path", "?(?,?D?H?`?d?|?", " Failed to allocate visibilityState", " ", "7$7,747<7D7L7T7\\7d7l7x7", "6D6w6", " ", " UserLocale", "AnsMinLength", "amd64", " .sku.xml missing required field /WpxStore/Version", "7&8O8T8Y8e8", " ", "DataImages", "wcsncpy_s", " ", "7.73787D7Q7V7[7g7", "747M7]7r7", " Couldn't parse validation information", ">&>W>b>n>", "/u:unattend", "7<7A7F7R7", "R!s4Z", "0-090>0C0o0t0y0", ":@:J:", " ", " Failed to rerieve SMI setting %s for %s", " Failed to read variant settings", "%s.%s", "L$ QQ", "WpxSetting::Release", " EnableCaptureMonitor", " ", " ErrorReportingCore.man", " WindowsHome", " PreventDeviceEncryption", " Failed to move item %llu to %llu", "t Failed to allocate schema", "WIMGAPI.DLL", " Failed to allocate doc", "< <6<;<@", "g Failed to allocate setting", "2$3:3Y3^3c3n3{3", " Couldn't remove old path %s from path tree", " Couldn't export log directory", "wpaf:TargetState", " ", "182E2]2", ">%>>>P>i>v>", " Failed to allocate net", "8(868L8Q8V8b8q8", " Couldn't write partition processing order", "9,999L9U9", " TCPIP.man", "6(6R6W6\\6j6", ".?AV?$CAutoCleanupBase@PAX@RAII@@", "%hs!%p: ", " Couldn't parse %s as a boolean", "wpaf:AccessCredentials", " RadioLocation", " Can't specify ", "platformEdition", "Translation", "RWVQPh", "2W2^2l2", "CSetupHost::CheckSetupMutex", "DecompressChunkedFile", "5!6Q6", "ve-ZA", ".tls$", "FACILITATORURL", "nl-BE", "::BUCL::Rtl::Add( *pcElements, 10, NewCapacity)", "tzm-Latn", "t$4t%S", "tr-TR", "fr-HT", "WimBufferToHexString", "7$74787H7L7d7h7", "3R4|4", "CloserElement = this->AllocateStreamObject()", "We were unable to clear the study id.[0x%X]", "mr-IN", "FormatMessageW", "TargetOsVersionMajor", "memcpy", "SetupHost: OneSettings initialization failed: [0x%X]", "3i4s4", "NoDriversNoLCU", "kernel32.dll", "GetModuleHandleW", "UnexpectedEvent", "stQVRW", "SetupHost::Create local server event reporter result: [0x%X]", "3$3-353F3T3\\3", "^##P#", "L$djo_", "<5=C=_=m=", ".CRT$XLZ", "xSSWhPfB", " Host OS License State [ UNAVAILABLE ]", "GetSystemInfo", "0#0'0,060A0F0L0Q0W0[0`0j0v0{0", "RRA'.l", "cannot read WIM header", "D$ X A", "WhpI@", "7/777e7", "aYd(z_C", "6}7,888?8", "4.5;5B5", "?a?~?", "#comment", "?=?R?Y?o?v?", "<#=-=S=", "MicrodomImplementation::CDomLayoutCache::FindObject", "gl-ES", "PhAllocateStreamObject()", "%-20S %-10S [0x%06x] %-6S %S", "GetTraceLoggerHandle", "7@7R7i7{7", "SetupUI: Modifying tray icon...", "%u/%u/%u", "WSWh@", "HQC!!", "%s %[^", "version", "CopyDirectoryFileCallback: The copy was canceled by the user.", "RegSetKeySecurity", "I~c4&", "DiskSpaceInstallReqExtDriveUsed", "SetupLog", "%s %s", "SetupHost: Error requesting SetupMgr cancel: hr = [0x%X]", ":9:l:", "SetupHost: Skipping diagnostic tool timing trace", " SVW3", "D$ QP", "6V6]6r6", "CSetupHost::SetAutomationResponseArgs", "WIM\\IMAGE", ">:?K?", "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem", "AttachConsole", "ServerDatacenter", "CompressCaptureNode", "bs-Cyrl", "tzm-Arab-MA", "MicrodomImplementation::CMicrodom::Initialize", "5E7L7_7", "_open_osfhandle", "MediaSetupUIMgr.dll", "FLT_UNDERFLOW", "9#979>9W9", "Washington1", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData", "WakeAllConditionVariable", "TimeDiff", "4E5O5", "(Value == 0) || RtlIsLUtf8StringValid(Value)", "TempNodes.Allocate(UpperIndex - TheElement.Reserved)", "RRhlcA", "RtlIsLUtf8StringValid(TagName) || (TagName == 0)", "CSetupHost::SetRunRollbackScript", "False", "u5SSS", "OneSettings: Failed to update UBR: [0x%X]", "?!?=?c?s?z?", "Digital", "CompressChunk", "899E9P9m9", "@*97u", "4a5l5", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode", "ReleaseMutex", "4e4l4", "CElementModification::ChangeTextValue", "SetupHost::Execute", "BUCL::Rtl::Add(DataLength, OldLength, TempSize)", "ShutdownBlockReasonDestroy", "Not-null check failed: String", "%ws\\%ws", "stRVQ", "909P9p9", "wcstoul", "8-8:8^8r8}8", "5!60676B6U6", "%ls\\%ls\\%ls", "RtlpSmartLBlobWritingContextResizePolicy", "SetConsoleCtrlHandler", "The existing WIM file became corrupted", "6`7q7", "fr-MC", "(NamespaceURI == 0) || RtlIsLUtf8StringValid(NamespaceURI)", "t$Vhp", "OneSettings: Failed to get UBR: [0x%X]", "SetupNotify::Remapping disk full error [0x%X] -> [0x%X]", "ProfessionalN", "PostRebootInstall", "SetupUI: ShutdownBlockReasonCreate failed! Error: 0x%X", "GetHandleInformation", "<%<9Signature == ('pSdM')", "9\\$,t", "9g9q9", "1&181G1Y1", ":.;R;X;v;", " language=\"*\"", "te-IN", "7!7%7*747=7B7G7M7V7\\7`7e7q7z7", "CompatSysReqScanTime", "AboveNormal", "L$\\_^[3", "header version mismatch", "FileDescription", "5P6_6", "; hash = ", "SetupHost: Setup build version is: %s", "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)", "5(555y5", "5P6W6f6", "UPDATEMEDIASETUPVERSION", "SetupHost: Creating directory: [%s]", "f9XBt", "_XcptFilter", "2d3v3", "5\"5)5.545P5", "zupkfb^ZVSOLIEB@=:7520-+)&$\" ", "yo-NG", "9\":?:", "Not-null check failed: Params", ";%;1;B;o;", "ChangeWindowMessageFilterEx", "Setup StudyID was [%s]", "PolicyManager_GetPolicy", "ar-KW", "aK!.X)Y", "Log: Cannot convert ansi->unicode.", "GetSystemWindowsDirectoryW", "CSetupDiagnostics: Tracing Data [TIME] -> [%s] [%s][%s][%s][0x%X]", "Windows Setup activity log", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "F8PSj", "S>a>r>z>", "CXmlCursor::XmlAlloc", "ShowWelcomeScreen", "9s v5", "CMoSetupOneSettingsHelperT::AddSettingsAppVer", "CBasicNodeType::ChangeNamespacePrefix", " ", "Wj(Q3", "FreeSid", "0-1115191=1A1E1I1M1Q1U1Y1]1a1e1", "8&8-898@8L8S8f8", "%s.%s.%s.%u.%s.%s.%s", "SaveOffset failed", "/RunRollbackScript", "\\$,VQP", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItemNs", "Not-null check failed: NewXmlStream", "ms-MY", "2#262w2", "OperationIndex", "ounknown", ".?AV?$CMoSetupUnknownImpl@VCSetupDiagnostics@@@@", "AllocChunkInfo", "Business", ";\";q;", "3r3w3", "/BitLocker", "99:n:z:", "<8<`=", "SetupHost: OneSettings Initialized -> [%s]", "RtlRaiseStatus", "BUCL::Rtl::QuickSort(Pairs, CompareStringSlot)", "%VF;+", "UuidCreate", "WimInitXmlInfo", "CustomRunTotalTime", ">>>D>]>d>s>z>", "0:1A1j1q1", "CreateFileA", "http://www.w3.org/2000/09/xmldsig#", ":%:0:=:W:m:z:", "/EnterpriseAttribution", ".rdata$zETW0", "SUPPRESS", "is-IS", "CompatBlockedCategories", "b:zGlABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", "UCS-2", "DiskSpaceInstallReqFixedDriveAutoSelected", "9*9@9W9", "Microsoft Corporation", ";(;b;j;", "BUCL::Rtl::Add( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)", "Buh_[S", "7H8k8r8", "9L<*=", "SetupHost: Creating setup mutex...", "5;5M5", "K{m)>1>7>", "dz-BT", "(KPK~~", "=$=,=4=<=D=L=d=h=x=", "STACK_OVERFLOW", "1%1,1`1", "~ f;F*sp", "= >*>?>F>`>x>", ";!;1;a;l;z;", "<=<[", "1 1/1>1K1X1e1", "617\\7", "212L2j2q2", "PolicyManager_FreeGetPolicyData", "{X_^[", "hostip", "MicrodomImplementation::CMicrodom::CreateInterface", "GetProcessHeap", "appver", "3 4Q4", "System", "EventProviderEnabled", "1'383R3c3y3", "DisableTelemetryOptInChangeNotification", "CMicrodomBuilder::EndAttlist", "LoadLibraryExW", "2H2y2", "__setusermatherr", "SetupUI: ShutdownBlockReasonDestroy succeeded!", "*Q`L]", "WTSAPI32.dll", "{{|||{xqokg_YS", "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )", "%sCore", "m_pTargetObject->IsNamedNodeMapValid(NodeMap)", "9{,u(h", "_errno", "SetEndOfFile", "839R9", "xh-ZA", ">3>C>J>", "D$PVP", "HostOsMajorVersion", "EtwEventRegister", "pt-PT", "2R3a3", "OsUninstall", "{|||{{qokg_[S", "WIMCommitImageChanges", "<@=O=\\=", "3 3,3L3X3x3", "wlPRQ", "243u3", "1)1;1g1y1", "DIAGER", "t2hXF@", "5)5/5?5D5\\5j5", "E0C1)0'", "SetupUI::BlockSystemSleep - CheckConnectedStandby failed: [0x%X]", "/LaunchSetupWithConfig", " />", "/Auto", "jaYjz^j:Z", "010?0u0", "RegSetValueExW", "/DownloadSizeInMB", "OSPartitionDownloadReqFreeSpace", "wLP9^", "o\\#P\\", "0)0O0^0e0m0u0", "StringId < m_Entries.Length", "6+656", "5:5L5U5s5", " ", "EtwEventEnabled", "j-Xf;", "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()", "?(?8?H?X?h?x?", "TargetOsVersionBuildNumber", "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)", "amd64", "MicrodomImplementation::CStringpoolCache::AttachToStringPool", "L$,QP", "t VWP", "hSVW3", "\\lL\\q", "mt-MT", ":):6:d:n:", "<,<3= 3", "3$303<3H3T3`3l3x3", ";%;7;D;", "1a2~2", "9X`v^j", "0'0-01060@0E0K0T0Z0c0i0m0r0{0", "5(545T5`5", "CMicrodomXmlWalker::XmlError", ".?AV?$CSetupObject@VCSystemHelper@@VISystemHelper@@@@", "PowerSetRequest", "9WHvQ", "InstallReqStorageCleanupTime", "Not-null check failed: Root", "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...", "/PreOobe", "`V@Pj", "8P8b8}8", "OneSettingsVersion", "j [0x%X][%d][%s][%d][%s][%d][%d][%d][%d][%s][%d][%I64u][%s][%s][%s][%s][0x%X]", "D$$PR", "2C2}2", ">$>t>{>", "CSetupHost::OnMCTUpgradeNow", "RtlDeleteResource", "", "pToRemoveFrom != 0", "WTSEnumerateSessionsW", "%s:(%d)", "7p8w8", "ADVAPI32.dll", "tg-Cyrl", "md3rQ@", "1/1P1", "2h3o3", "%hs!%p: ", "j}Yf;", "EnterCriticalSection", "DefWindowProcW", "SetupHost: Attempting to initialize OneSettings values", " Host OS License State [ %s ]", "CMicrodomBuilder::Initialize", "settings", "CgEB;", ":':q:", "CMicrodomBuilder::StartAttlist", "Failed", "/MigXmlPath", "DUImageOptIn", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate", "fr-RE", "DOWNLOADFREESPACEREQUIRED", "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)", ".?AVCDlpWimInfo@@", "1V1]1e1", "9S0vmR", "SetupHost: Diagnostic Analysis failed [0x%X]", "/usbdebug", "\" )S6636i", "SetupUI: Creating main window...", ".text$mn$01", "RtlDuplicateLBlob", "GetOverlappedResult", "CompatInstallReqTime", "m_StoredTable.Initialize()", "/Retail", "InstallReqToggledtoExtStorageFlow", "ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo", "?+?a?", "%-20S %-21S %-6S %s", "061F1M1|1", "found", "refreshInterval", "7\"7'7,727;7A7E7J7T7[7`7f7p7v7z7", "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)", "1%1:1", "CBasicNodeType::EncodeLUtf8String", "RtlAllocateHeap", "7/777E7a7", "2K2U2z2", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute", "|d-Vk", "QQSVW3", "Integer overflow after WriteData", "InstallModeFinalizeSkipped", "", "1/0-0", ">->k>y>j?", "TargetOsImageIndex", ":)( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)", "UuidToStringW", "NMTOKENS", "?&?-?", "SourceOsEditionId", "2!3D3o3", "false", "GetVolumeRootFromPath", "pToRemove != 0", "5>5E5v5", "7 787f7|7", "SVWj2", "_onexit", "G^{P&a", "\\\\?\\GlobalRoot", "PhxcA", "Server Workstation", "/Compact", ":QVEE", "CommandLineToArgvW", "busparams", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttribute", "2%2.282Y2a2h2r2", "NewSetupMigChoice", "CSetupHost::FreeWuSecurityInfo", "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))", "L$|_^[3", "SetupHost::Initialize: CmdLine = [%s]", "Client Workstation", ".?AVISystemHelper@@", "Windows::uDom::Rtl::RtlDestroyMicrodomUpdateContext", "RtlGetVersion", "bucketArgument2", "wwwwwwwwwwwwwwwwp", "3<3C3", ";B'>A>[>", "__wgetmainargs", ">p>w>", "WWWWV", "TestId", "!|$<9}", "h2;Q/", "SetupHost: Skipping OneSettings initialization for Azure Host", "CBasicNodeType::ForceValue", "t;f97t6", "TargetBranch", "Fkg_[", "DecompressChunkedFile failed", "SetupHost: Unable to configure diagnostics cleanup - [0x%X]", "/AzureHost", "TheNode != TheNode.InvalidValue()", "526@6\\6", "REQUIRED", "strtol", "~~{w{ok", "WebSetupDownloadTotalTime", "InitializeCriticalSectionAndSpinCount", "CreateWindowExW", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade", "quz-BO", "eu-ES", "SystemTimeToTzSpecificLocalTime", "0m0w0", "bs-Cyrl-BA", "QQPQQQQQQQQ", "LegalCopyright", "debug.log", "3#4F4\\4", "0T1[1v1}1", ";';H;N;n;", "AppVer=%d.%d.%d.%d", "y}gg2i", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "/MediaPath", "AlwaysSuspend", "NewCData = this->AllocateStreamObject()", "HeapCompact", "CSystemHelper::SetShutdownBlockReason", "%hs(%u)\\%hs!%p: ", "Y__^[", ".:<@^", ".idata$3", ":\";P;Y;q;z;", "tzm-Latn-DZ", "se-SE", "dateTime", "towlower", "626X6", "/MigNEO", ":':1:<:\\:b:w:~:", "GetWindowsDirectoryW", "424<4N4V4a4h4o4|4", "_A3DEc", "AzureDownlevel", "$`2X`F", "4a4r4}4", "DiskSpaceDownloadReqFUReservesTotalSpace", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART", "M0K0I", "==>O>p>v>", "Value", "SetFileInformationByHandle", "2.2H2O2", "A previous StudyID was [%s]", "ReadWriteDataInternal", "\\CONOUT$", "CMicrodomUpdateContext::CreateVirtualElement", "GetFileVersionInfoSizeExW", "FindFirstChunk", "??1type_info@@UAE@XZ", "?;?K?X?p?", "qps-plocm", "NativeProcessorArchitecture", "PowerCreateRequest", "=%>R>", "1V2t2", "9L9[9", "|hK,_", "SOFTWARE\\Microsoft\\Sysprep", "{$VWP", "oo{|||{{wjkk_YS", "/busparams", "WWPRh", "/ActionListFile", "8<:C:U:\\:w:~:", "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX", "uz-Latn", "NewTempBytesRequired > TempBytesRequired", ":+:::", "EventRegister", "CMicrodomBuilder::EndElement", "SetupUI: Requesting ShutdownBlockReasonCreate...", "9\":.:O:[:|:", "ShPm@", "RegGetValueW", "SetupUI::Uninitialize - RemoveMainWindow failed: [0x%X]", "%systemdrive%\\$Windows.~BT\\Sources\\Panther", "CMoSetupOneSettingsHelperT::InitializeSettings", "<$<0<< ", ".rdata$zETW1", "UpgLayoutTime", "3!4T4i4z4", "Global\\Microsoft.Windows.Websetup", "__rv.UcsCharacter != (0xffffffff)", "253K3^3p3", "TempElements.Allocate(NewCapacity)", "GlobalSize", "SetupHost::Initialize: ActionListFilePath = [%s]", "GetFileInformationByHandleEx", "NoSeverity", "sd-Arab-PK", "w~~xp", "1\"181H1X1h1x1", "4!5-585[5o5", "es-EC", "WVhXz@", "SetupNotify::Leaving well-known error [0x%X] as-is for WU/Store", "<-", "AddCaptureNodeToImage", "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART", ".data$brc", "Ath_[S", "CoCreateInstance", "HostOSBuildNumber", "EventWriteTransfer", "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)", "Microsoft Time-Stamp PCA 2010", "ujG;}", "6+6q6", "Fail to update WIM header", "D$(PQ", "DownloadReqCleanupTaskTime", "", "sr-Cyrl", "0+050<0F0r0", "?M?z?", "9$9/9?9\\9f9p9z9", "Legal_Policy_Statement", "s4PPPPPPh", "646R6w6", "CSetupDiagnostics::LogString", "FindChunkForOffset", "3g4m4s4", "%s{%s}", "/preoobecmd", "ar-TN", "j,h0*I", "::RtlIsLBlobValid(Data)", "__CxxFrameHandler3", "_wcsnicmp", "4W4b4p4", "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x", "nl-NL", ">MdDtt", "1%2@2U2b2~2", "OneSettings: Ring [%s]", "uz-Latn-UZ", "pa-IN", "dv-MV", "<.<4$>,>4><>D>L>T>\\>d>l>t>|>", "WinHttpQueryHeaders", "SetupNotify: A finalize was already requested. We should not clean up in this case so the other install can resume.", "=G>^>", "Exception", "?.?e?~?", "?V?h?", "4;4\\4c4", "UpdateMediaOptInDefaultValue", "8g", "1(0&0", "ExecutableName: ", "4X5^5t5", "Fvk__", ">5><>M>t>", " ", "hsb-DE", "SetupConfig", "/1394debug", "SetTimer", "/Media", "?'?7?D?v?", "SetupUI: Logging EndSession [0x%X] notification...", "WriteData failed during NULL block copy", "MiniDumpWriteDump", ":9:E:P:i:", "3>3o3", "OSPartitionDownloadReqMinimumRequiredSpace", "?$?0?I>f>l>", "/ConfigFile", "N!@|V", "SetupHost: Diagnostic Analysis timeout value: [%d] ms", "OSPartitionInstallReqSpaceFreedByCleanupTask", "xxwwx", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual", "InitializeSecurityDescriptor", "GetFinalPathNameByHandleW", "SetupHost: Unable to get info from install file. [0x%X]", "CheckTokenMembership", "LoadLibraryW", "SetUnhandledExceptionFilter", "D$@PW", ":#;B;s;", "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%", "> >@>\\>`>|>", "WIM\\IMAGE[*]\\WIMBOOT", "DATATYPE_MISALIGNMENT", "MicrodomImplementation::CDomPositionCache::GetLocation", "GetCommandLineW", "737:7", ":,:2:<:", "WimLayoutTime", "/debug", "/DynamicUpdate", "Failed to get img buf", " ", "DOWNLOADFREESPACEPADDING", "SetupUI: Creating power request...", "u.FAB;", "WinHttpGetProxyForUrl", "%w't%", "qu?Dh", "NONCONTINUABLE_EXCEPTION", "IsCharAlphaW", "PhXuA", "2%2A2H2T2[2b2r2", "191@1P1W1k1v1", "advapi32.dll", "onecore\\base\\xml\\udom_microdom.cpp", "SetupHost: Diagnostic Analysis not requested.", "LayoutISOTime", "arn-CL", "DequeueNextChunk", "OneSettings: OS [%s]", "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())", "L$T_^[3", "appBuildLab", "Finalize", "SetupUI: Setting shutdown block message: [%s]", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::CloseElement", "CMoSetupOneSettingsHelperT::AddSettingsStringParameter", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection", "wH9\\$", "m_PositionList.Allocate(LocationHeader->ulItemCount)", "OneSettings: Initialization succeeded, found %d values.", ".CRT$XIZ", "MicrodomImplementation::CDomLayoutCache::GetNodeChildren", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem", "PANTHER_ENABLE_TELASSERT", "pToRemoveFrom->Element != 0", "1:1O1", "Global\\WdsSetupLogInit", "CompanyName", "MigratePackageRemovedFODRetrievalCount", "CXmlCursor::CompareStrings", "6\"686^6u7|7", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteProcessingInstruction", "575{5", "EditionId", "FLT_OVERFLOW", "Starter", "RtlIsLUtf8StringValid(ElementId)", "= =,=8=<=D=L=T=\\=d=l=x=", ">*>H>]>", "de-LU", "diagerr.mdmp", "D$hPW", "=b=h=", "0123456789abcdef", "CSetupHost::ExecuteDiagnosticAnalysis", "/Package", "http://www.w3.org/2000/xmlns/", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet", "WinHttpSendRequest", "2f2k2r2x2", "<(=7=D=_=d=", "GlobalAlloc", "5O6q6", "?%p!Gn", "7 7,787D7P7\\7h7t7", "SetupHost: Reporting post reboot event failed: hr = [0x%X]", "CreateFileW", "SetupHost: Unable to copy Panther logs - [0x%X]", "SetFilePointerEx", "5 545W5g5{5", "/MeteredNetwork", "sk-SK", ";s s%k", "port=", "Shell_NotifyIconW", "onecore\\internal\\base\\inc\\rtl_object_library.h", "CSetupHost::LoadSetupObject", ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@", "wcsrchr", "/Quiet", "ComplianceProviderBlockMessageIds", "SLC.DLL", "QQQPQ", "t$ 95PnI", "SetupPriority", ".text", "SetupUI: Detecting connected standby capability...", "CreateProcessW", ":MdSpt", " ", "80C0J0", "es-CO", "WIM\\IMAGE[*]\\WINDOWS\\EDITIONID", "en-PH", "LogSharingViolationErrorInfo", "", "fr-CI", "?#?*?N?U?e?l?", "CopyDirectoryEx2: Specified directory [%s] doesn't exist", "NewAttribute = this->AllocateStreamObject()", "<(<=x>~>", "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild", "|$HSQ", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", ">1?H?", "/MigChoice", "Windows Setup error log", "SetupHost: Copying MoSetup log files from: [%s] -> [%s]...", "Not-null check failed: pOutputStream", "10.0.19041.572", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "IMPLIED", "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize", "tn8^\\t", "SetupNotify::ReportEvent - Remapping extended data [0x%X] -> [0x%X] for testing mode.", "RtlReAllocateHeap", "Not-null check failed: fHasAttributes", "/Finalize", "tIWPd", ".?AVCSetupDiagnostics@@", "t$T+t$", "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem", "IsWow64Process", "OSPartitionInstallReqFreeSpace", "SetErrorMode", "L$$_^[3", "ENABLED", "onecore\\base\\xml\\udom_xmlwalker.h", "SetupHost: Cleaning alternate storage path [%s] -> Result: [0x%X]", "LocationHeader->Signature == ('cLdM')", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS", "EventSetInformation", ".?AV?$CMoSetupUnknownImpl@VCSetupHost@@@@", "SWj`j", "=\"=4=M=_=x=", "646;6C6T6]6i6", "SetupUI::UnblockSystemSleep - Power request does not exist!", ":<:H:h:p:x:", "Ph", "SetupHost::Initialize: Scenario = [0x%X]", "DownloadReqOpenDownloadsClicked", "Whhb@", "SetFileAttributesW", "co-FR", "WIM\\IMAGE[*]\\FILECOUNT", "dSVWjD3", "5\"535H5N5q5", "_vsnwprintf", ">*>7>>>", "AllowTelemetry", "SetupUI: Calling registered callback...", "CustomRunTimeout", "MIGUI", "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0", "OneSettings: Sku [%s]", "5)6e6K7i7", "ConstructPartialMsgVW: MALLOC failed", "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)", ".?AVIMitiDiagnostics@@", "InstallReqOpenRecycleBinClicked", "u(VSP", ":':4:@:l:z:", "GetVersionExW", "j>", "Setup360Mode", "TheDocument.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()", "222R2d2", "Microsoft Corporation1200", "UpdateMediaSkipButtonClicked", ";$;J;\\;", "8$8,8K8", "OneSettings: EditionId [%s]", "CSystemHelper::ShowTrayIcon", "UpdateMediaNotSupported", "FatalError", "xxxxxp", "0,0P0T0X0d0", "&010?0", "TelemetryPermission-AllowDisable", ">&>0>J>V>a>u>", "/Success", "CreateUpgradeMedia", "Not-null check failed: Document", "/PostRollbackContext", "DisableDeviceDelete", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentElement", "HeapAlloc", "ar-JO", "WinHttpGetDefaultProxyConfiguration", "Dth_YS", "*************** SetupHost Logging Begin ***************", "WinHttpReceiveResponse", "SetupHost: Loading complete.", "SetupUI: Returning %s to QueryEndSession [0x%X] request...", "sr-Latn-ME", "Disable", "7/767a7k7", "061G1w1", "QueryPerformanceCounter", "WdsLogStructuredException", "(caller: %p) ", "~j\\XPW", "SleepConditionVariableSRW", "t)hXF@", "ug-CN", "9$9,949<9D9P9p9x9", "FlightData", "Not-null check failed: Data", "H>", "CSetupHost::ModifyCommandLine", ":#;*;V;];", "AllowTelemetry_PolicyManager", ";+;8;J;m;t;", "th-TH", "sms-FI", "GetLocalTime", "<_=~=", "Package360", "?$?s?", "SetupNotify: Specifying extended data [0x%X] for error [0x%X].", "sd-Deva-IN", "SetupManager: Diagnostic Analysis Timeout [%d ms] via override.", ">(>8>H>X>h>x>", "50HkP", "818;8a8", "Not-null check failed: NodeList", "pt-BR", ".CRT$XCZ", "939f9y9", "__TlgCV__", "_FC;]", "WIM\\IMAGE[*]\\DIRCOUNT", "uaG;}", "ModuleCollection", """, "toupper", "INT_OVERFLOW", "en-029", "Not-null check failed: Value", "GetUserDefaultUILanguage", "3%383=3D3I3", "6b6x6", "CMicrodom", "3'3A3[3", "be-BY", "CSetupHost::IsDiagnosticAnalysisEnabled", "ne-IN", "VWj0SP", "6 6(61676=6C6M6X6]6b6g6m6u6{6", "OSPartitionInstallReqTotalSpace", ".?AV?$CSetupObject@VCSetupHost@@VISetupHost@@@@", "3 30343H3X3h3l3|3", "CreateEventW", "\\Program Files\\WindowsApps\\", "SetWindowTextW", "FLT_STACK_CHECK", "de-DE", "/MediaArch", "20201008074306.253Z0", "QVQPh0", "D$|PQ", "%?B?", "GlobalMemoryStatus", "PKeyLocationsTried", "CSetupHost::OnSetupExiting", "=FB~G", ">&>@>O>\\>", "ERROR", "ar-SY", ";,;<;R;w;", "SetupHost: Diagnostic results location: [%s]", "FieldName", "D$,`+A", ";$;P;o;", "GetTimeZoneInformation", "?$?3?B?", "WebSetupInstanceId", ".text$yd", "CSetupHost::HasExternalDownloadStorageCapability", "WriteData failed", "%-20S %-21S [0x%06x] %s", "6c7m7", "MIGNEOENABLED", "TelemetryAssertList", ">F?M?", ".CRT$XIAA", "E$j$Z", "2)303E3\\3c3", "setupact.log", "quc-Latn-GT", "DeletePath: Cannot delete .", "ar-YE", "SXYYXXIFB=:", "j0Yf+", "3B3P3", "3#3-383=3C3N3U3Y3^3h3o3u3~3", "SetupHost::Initialize: LoggingPath = [%s]", " S}k6", "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x", "PRIORITYLEVEL", "=8=D=a=k=", "winbrand.dll", "ForceKeepActive", "97u\"3", "0-1@1Z1", "j\\Zf;Ty", "[06xm*.", "SetupUI: Setting main title: [%s]", "SetupHost: Successfully copied Panther folder!", "CMicrodomBuilder::AddString", "Ph jA", "PVVVVh", "6O6a6", "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp", "1/282", "Exception (code 0x%08X: %s) occurred at 0x%p in %s.", "Not-null check failed: pWriter", "NtCreateFile", "=#=(=-=2=8=<=B=L=W=\\=b=g=m=q=v=", "CBasicNodeType::ForceNameSetting", "DeleteFileW", "WinHttpGetIEProxyConfigForCurrentUser", "9.999^9m9z9", "5.6W6d6q6", "Count", "7?7\\7", "RtlXmlDestroyNextLogicalThing(this)", "DisableDiagnosticDataViewer", "u7G;}", "SetupHost: Reporting error event -> [0x%X, 0x%X]", "5 6@6", "GetTraceEnableFlags", "RtlAcquireResourceShared", "\"%s\" /Scenario:Upgrade /ZipLogs:False /Format:%s /Output:%s /RegPath:%s", "~||xp", "ReleaseSemaphore", "Unable to load global log filter.", ";\\Signature == ('pSdM')", "<0<8->C>K>X>r>", "5\"5.5^5", "171>1", ";$;0;P;\\;|;", "===K=[=m=z=", "PKeyDownlevelInstallChannel", "FLT_DIVIDE_BY_ZERO", "Not-null check failed: PseudoKeyOut", "en-AU", "GetProcAddress", "636B6Z6", "FindClose", "2?2m2", "-0N0[0", "CMicrodomBuilder::CFourStringIdTable::Initialize", "6-7G7N7", "InitializeCriticalSection", "/UpdateMedia", "8+8F8S8j8", "BCryptCreateHash", "We are exiting in Update Setup due to compat issues. We should not clean up in this case so we can resume.", "=a>s>~>", "Not-null check failed: pDocument", "SetupHost: Unexpected scenario - defaulting postoobe/rollback commands!", "Microsoft Corporation1&0$", "GetModuleFileNameW", "/SkipFinalize", "ResetEvent", "onecore\\base\\xml\\isolib_parser.h", "=$>+>", "CommandLines", "qps-ploc", "9'9G9r9", "8)9A9T9^9H:", "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)", "GetSystemDefaultUILanguage", "Not-null check failed: DataBlock", "8 909=9", "PostRollbackContext", "TelemetryPermission-DefaultLevel", "GetFileSize", "1=1\\1", "A~vbbS", "W93uH3", "ReleaseSRWLockExclusive", "Software\\Microsoft\\Windows NT\\CurrentVersion", "DEPLOY", "RtlAllocateLBlob", "<<2", "%hs: couldn't get host edition id", "363Z3w3", "Warning", "D$$PQ", "::RtlIsLUtf8StringValid(Candidates[i])", "standalone", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName", "_T^9_Xt&", "6H7u7", "zh-Hant", "RtlIsMicrodomUpdateContextValid(TheContext)", "/PauseId", "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Insert", "'XD}*", "6B7S7b7", "RtlGetCharacterSetDecoder", "JVVVS", "8M8f8", "EqualSid", "6D7u7", "HostOsProductType", ";%<<<", ":&:]:", "/Priority", "6#7e7|7", "t?h@F@", "UTF-16", "gd-GB", "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)", "Applicable", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface", "1 1,181D1P1\\1h1t1", "8*8<8D8I8N8p8v8}8", "Recovery360", "::RtlIsLBlobValid(Destination)", ";$;4;;;H;O;V;", "WriteDataCallback", "0'040K0R0u0", "D$$;D$", "< <26D6I6N6T6]6c6g6l6v6{6", "ServerComputeCluster", "CSetupHost::GetWuSecurityInfo", " Windows", "3/464i4|4", "+RjjQ3", "t-j._f;9u", ";);q;", "p!c5Mf", "Euh_YS", ",f~|z[WP", "DispatchMessageW", "6S6^6l6", "5!5(545;5g5q5", "2K2c2", "es-US", "5#5'5,565A5F5L5Q5W5[5`5j5u5z5", "Pairs.Allocate(m_StringTable.GetEntryCount())", "Parameters", "CommandCount", "566A6H6", "WebSetupInputDefaultArch", "ShhT@", "Not-null check failed: ComparisonResult", "CustomCount", "_wfopen", "9+979A9M9|9", "*41;D$MdSpt", "jXhP-I", "RtlIsLUtf8StringValid(Source)", ":^;m;", " true", "99:@:F:L:l:q:", "DownloadReqExtDriveReqSatisfied", "es-AR", " PostRebootInstall", "InstallationType", "RtlAcquireResourceExclusive", "y/VhV", "SetupUI: ShutdownBlockReasonDestroy failed! Error: 0x%X", "Logs\\MoSetup", "rw-RW", "7=7D7", "wcsncmp", "BusinessN", "Cabinet.dll", "hu-HU", "LegacySetupInterrupt", "InstallReqOpenDownloadsClicked", "y)Vhy", "_cexit", "CSystemHelper::ExecuteAsync", "CSystemHelper::RemoveMainWindow", "RefreshAfter", ">8>y>", " level=\"asInvoker\"", "8!8&80878<8B8L8R8V8[8e8j8o8t8z8", "WIM\\IMAGE[*]\\WINDOWS\\INSTALLATIONTYPE", "616A6V6r6", "[ybVh", ":>H>^>", "/Telemetry", "CMoSetupOneSettingsHelperT::GetSettingAsBool", "DiagnosticAnalysisResult", "MultiLayoutTime", "haw-US", "**************** SetupHost Logging End ****************", "TargetOsServicePackBuildNumber", "Global\\SetupLog", "az-Cyrl", "DownlevelProductName", "header type/size mismatch", "<$ [%s]=[0x%X] [%s][%s][%s][0x%X]", "Not-null check failed: Decoder", "m_Entries.Allocate(PoolHeader->TotalCount)", "?)?9?F?`?r?", "Not-null check failed: fHasChildNodes", "7M9d<", "WinHttpOpen", "User is cancelling Media Setup on compat report. We should not clean up in this case so we can resume.", "TheEndElement = this->AllocateStreamObject()", "zh-Hans", ";\"::CreateTearoff", "GetCurrentProcessId", " PreInstallUX", "LoadCursorW", "Sources", "&9q0u", "GetTraceEnableLevel", "VerQueryValueW", ";D;L;j;", "deviceId", "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x", "(NewName == 0) || RtlIsLUtf8StringValid(NewName)", "ru-RU", "LocalFileTimeToFileTime", ";D$", "SetupHost: Cleaning alternate storage paths failed: hr = [0x%X]", "CBlackboard::Close: %s.", "MicrodomImplementation::CMicrodom::GetElementById", "t;Sh0", "95\\oI", "HostOsWimBoot", "_gov{~~Q", "(SourceCount == 0) || (Sources != 0)", "898K8n8", "D2J5A", "CSystemHelper::SetTrayTitle", "SourceOsBuildQFE", ".?AVISetupDiagnostics@@", "CMicrodomBuilder::CElementNameToAttributeListTable::Find", "hr-BA", "2E2o2", "el-GR", "DeleteFileA", "w8hH`@", "NoLCU", "es-PR", "NtYieldExecution", "334M4S4[4u4{4", "CSetupHost::OnSetupFail", "Complete", "GetVolumePathNamesForVolumeNameW", "1\"2/2p2", "NtQueryInformationFile", "NDATA", "#,|6d", ".CRT$XIA", "MIGROLLBACKENABLED", "; ;';5;?;", "6/7X7", "DataSetting", "MigratePackageRemovedFODRetrievalStatus", "1.252T2_2v2", "HostOsBuildNumber", "tIVS3", "pap-029", "/FlightData %s", "5L5S5", "ko-KR", "5!5'5@5`5", "210303183038Z0p1", "::RtlIsLUtf8StringValid(String)", "zh-CN", "8G8l8", "TlsAlloc", "InitLZMSDecompression", "Error", "495J5O5", "757r7", "chr-Cher", "SetupCore.dll", "111019184142Z", "DecryptionKey", "GetCurrentDirectoryW", "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.", "=X>q>v>", "WebSetupTransport", "G QQVP", "<-", "es-PY", ":9:T:d:", "CreatePath: Unable to create [%s]; GLE = 0x%x", "Af;H(s", "FindFirstFileW", "4$4)43494=4B4L4Q4W4`4e4l4r4v4{4", "4_5d5i5s5x5}5", "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]", ".rdata", "D$pSVW", "'FC=P", "CSetupHost::TraceDiagnosticAnalysisStartTime", "%-10S [0x%06x] %-6S %s", ">\"?)?", "TargetOsInstallationType", "ProvTemp", " 9{Du5", "Params->fRequireUtf8", ";J=m=t=", "7\"7(787D7J7Q7Z7`7h7n7{7", "SetupUI: Requesting ShutdownBlockReasonDestroy...", "NtQueryLicenseValue", "SetupHost: Successfully copied Rollback folder!", "pToInsert != 0", ";D$4uV", ";B;W;", ".text$di", "/LaunchSetup", "I9/.]", " ", "6)6/686B6I6O6U6]6w6", "9.9?9N9Z9v9", "'", ":\":&:7:;:C:G:M:Q:W:[:a:e:k:o:u:y:", "not found", "/ImageIndex", "eHomeEdition", "/PartnerID", "DeleteFileEx: hardlink given to us is: %s", "%S(%d) : ", "Client", ":b'^^!", "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c", "tXVWj", ".w.t,", "2I2Q2_2h2", "1^2d2", "OriginalFilename", "4S5k5", "UpgradeNow", "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert", "smj-SE", "quz-EC", "95XoI", "tWVPj", "default", "az-Latn", "%hs: couldn't get host product name", "CSystemHelper::GetShowUIMsgID", "se-FI", "Not-null check failed: Out", "Microsoft Corporation1%0#", "/NoAutoExit", ">\">P>b>}>", "2H2l2", "Undefined", "/DiagnosticPrompt", "0\"080H0X0h0x0", "ca-ES", "6>7P7", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteEscapedString", "WinHttpSetOption", "?0?:?", "ar-LB", "ur-IN", "pl-PL", "@.reloc", "WTSQueryUserToken", ">*>/>5>:>@>D>J>T>_>d>j>o>u>y>~>", "/ShowOobe", "moh-CA", "__rv.NewCursorValue != 0", "S,_^[", "\\\\?\\Volume{", "LogHr", "344T4Z4`4f4", "We are exiting in Media Setup due on compat report page. We should not clean up in this case so we can resume.", "9(:3:X:r:}:", ">5?M?", "TargetOsServicePackLevel", "Verbose", "bF-~cYZ", "j:Yf;", "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d", "RtlFreeHeap", "UninstallReason", "7&8-8:8", "si-LK", "8 8(80888D8d8", "U0S0Q", "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent", "HomePremium", "CSystemHelper::BlockSystemSleep", "1n2u2", "E SVW", "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x", "StandardSetupLogFilter", "Trace", " ", "5#5J5S5d5k5", "bin-NG", "NewChild->Element.Allocate()", "%WINDOWS_LONG%", "", "SetupHost: Skipping check for HasExternalDownloadStorageCapability.", " @H!BXo", "Isolationp::Parse::CTemplatizedStringIterator::Attach", "%-21S %-6S %s", "ShowWindow", "7r7z7", "t[VW3", "MicrodomImplementation::CMicrodom::GetElementsByTagName", "DownloadReqOpenRecycleBinClicked", "4.696G6", "fr-ML", "qsort", ">&>=>d>|>", "9$909<9H9T9`9l9x9", "88882200..", "DestinationMaximumLength >= SourceLength", "BREAKPOINT", "bn-IN", "DiskSpaceDownloadReqExtDriveUsed", "RtlReallocateLUtf8String", "93:@:M:U:b:", "8$8,848@8`8h8t8", "t4f97t", "WPh wA", "InitializeAcl", "<:http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "DownloadReqLearnMoreLinkClicked", "tn-ZA", "prs-AF", "ru-MD", "7'8f8y8", "PrevStudyID", ".?AVISetupNotify@@", "0 131y1", "Update360", ">@.6Y", "tmj\\W", "6-747i7", "x/j\\Xf;E", "8P9_9", "97:F:r:{:", "PKeyLocationFound", "wprintf", "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength", "::Initialize", "en-NZ", "RevertToSelf", "1 1O1^1u1~1", "3%474`4r4", "9=`nI", "@.rsrc", "memcmp", "AddAccessAllowedAce", "az-Latn-AZ", "/ResizeRecoveryPartition", " AzureDownlevel", "chr-Cher-US", "4SVWj.", "Microsoft Time-Stamp PCA 20100", "/PreDownload", "ARRAY_BOUNDS_EXCEEDED", "sl-SI", "Not-null check failed: String2", "NtPowerInformation", "\\D~bx", "restored", "fr-BE", ":9;D;R;P<", "GetStartupInfoW", "D$tHP", "InstallReqExtDriveReqSatisfied", "TargetOsArchitecture", "ProductKeyEditionId", "6O6]6", "WinHttpQueryDataAvailable", "Decline", "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]", "ACCESS_VIOLATION", "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x", "::RtlIsLUtf8StringValid(Destination)", "CMicrodomBuilder::ConsumeEntityDecl", "9&909a9h9!:(:J:T:", "CBlackboard::~CBlackboard", "DefaultAttribute.Allocate()", "SetProcessPreferredUILanguages", "CreateMutexA", "VWj 3", "Azure360", "CSystemHelper::GetHWND", ".idata$2", "7#7)7/797C7K7P7V7\\7b7l7r7|7", "@\\jdPQ", "><>B>K>Z>d>", ";-;4;E;O;^;e;p;", "FH;A8", "SetupHost::Create IWUInstallationSession2 result: [0x%X]", ".CRT$XCL", "ObjectLength", "RtlIsLUtf8StringValid(LocalName)", "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)", ":\":(:.:3:F:X:t:", ":%:,:8:v:", "InitLZMSCompression", "SetupUI::Uninitialize - RemoveTrayIcon failed: [0x%X]", "ShowEula", "CreateMedia", "SSSPhd", "LeaveCriticalSection", "en-ZA", "GetEnvironmentVariableW", "::GetSettingAsString", "5(5/545:5H5N5R5W5a5f5k5p5v5", "MessageBoxTimeoutW", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute", ")`yJb", "8,8T8s8", "C(;C$", ".rdata$T$brc", " ", ";';;;d;", "CSetupHost::SetPartnerID", "D$DPj", "HeapCreate", " AzureFinalize", ":3:O:_:n:", ";+<2<;<", "DiagnosticAnalysisStart", "CustomRunErrorGUID", "TmpNodes.Resize(cNecessary)", "ProductVersion", "=C>O>Z>", "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x", "GetVolumeInformationW", "NewInstance.Allocate()", "WinHttpConnect", " />", "81989L9~9", "We are exiting in Setup because we do Compat Scan Only command line. We should clean up in this case.", "### q", "DownlevelBuildNumber", "~~vkkg", "9H:U:", "NewProcessingInstruction = this->AllocateStreamObject()", "6!6,636:6e6", "CMoSetupOneSettingsHelperT::AddQueryStringParameters", "SetupHost: GetSecurityData result: [0x%X].", "kn-IN", "VirtualAlloc", "WinHttpSetCredentials", "SetupHost: Diagnostic Analysis - START", "4!4=4^4", "CSetupHost::SetReportingInfo", "imageName", ":C;t;", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "%wPtG", "=*>F>", "(FixedSizeBuffer != 0) || (DynamicBuffer != 0)", "Detected existing websetup mutex... exiting.", "( cElements, 10, NewCapacity)", ";&<,<", "es.T#=\"", "CSetupDiagnostics: Tracing Data [CUSTOM] -> [%s] -> [%s][%s][%s][%s][%s][%s][%s][%d][%d][%d][0x%x][0x%X][%d]", "7h7}7", "5+565O5b5o5", "", "VWhlC", "VS_VERSION_INFO", "ms-BN", "808:8}8", "dCSDBuildNumber", "ar-IQ", "SetupUI: Button click detected - no registered callback.", "; <(", "1 1@1L1l1x1", "LocalAlloc", "uMG;}", "af-ZA", "3l4{4", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes", "6h8M@", "OutputDebugStringW", "<7=B=\\=", "ScenarioId", " ", "2(242@2L2X2d2p2|2", "/Override", "DeleteFileEx: Unable to open [%s]; GLE = 0x%x", "sma-SE", "OLEAUT32.dll", "#?JPd", "CMicrodomBuilder::StartDocument", "UNINSTALLENABLED", ">$>/>6>y>", "O0M0K", "go{{|||~H", "UPDATEMEDIAENABLED", "Requesting full cleanup.", "\\StringFileInfo\\%04X%04X\\%s", "WIMCloseWIM", "uz-Cyrl-UZ", "HomeBasicN", ";(;,;0;D;H;L;T;l;p;x;", "2+2K2]2", "2Y2`2|2", "InstallReqSysDriveReqSatisfied", "PQh`gA", "OneSettings: Initialization failed -> [0x%X]", "=>=X>_>i>", "7d8g9", "6V7]7", "mn-MN", "4@4p4", "5G6S7X7n7", "DigitalPKeyCmdUsed", "SetupHost: Skipping diagnostic tool result trace", "imageSize", "SetupDiag.exe", "VERSION.dll", "2\\3P4", "5.5Z5u5", "PreInstallQuiet", ".rdata$r$brc", "IMAGE", "TestMode", "DeviceIoControl", "627;7@7W7", "GlobalCollection", "D$lSP", ">U>k>", "CreateDestinationFileEx", "Failed to get decoder context", " ", "5$5-525A5", "ConX::Setup::Common::COSInfoHelper::GetTargetOSVersion", ";=;D;", "9$9B9b9", "GetMetadataPadding", "FindNextFileNameW", "0*0G0S0t0{0", "?0?N?l?", "DownloadReqStorageCleanupTime", "HostOsSuiteMask", "Enable", "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence", "qps-Latn-x-sh", "CreateFileMappingA", "HomeBasic", "FLT_INEXACT_RESULT", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "settings-win.data.microsoft.com", ";X^>", "RtlInitializeResource", "9::U:\\:h:o:~:", "Global\\MoSetup", "[%s:(%d) -> %s] %s", "D$$hp", "=#=)=2=8=<=A=K=S=\\=b=k=q=u=z=", "/ReportId", "Thales TSS ESN:E5A6-E27C-592E1%0#", "Not-null check failed: Result", "SYSTEM", "ulLocation < m_PositionList.Length", "9=PnI", "tJj\\P", "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)", "so-SO", "mn-Mong", "CBlackboard::m_lAccessSpinLock = %d for BB=\"%s\"", " publicKeyToken=\"6595b64144ccf1df\"", "3Z3e3", "jaYjz_j:Z", "~~~~~yyyyxxxxxx", "%s, LOG: [0x%X] [%s] [%s]", ">(>4>@>L>X>d>p>|>", "trPWQ", "92:C:", "5e6l6", "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)", "GetModuleFileNameA", "YY_[^", "CSetupHost::Execute", "4!4+494]4g4u4", "HostOsMinorVersion", "WIM\\TOTALBYTES", "ha-Latn", "Not-null check failed: Blob", "3'3S3Y3l3r3}3", "sv-FI", " || SourceFunction: ", "/MigrateDrivers", "AssertWithArgs", " ", "COMPACTOSENABLED", "SetupManager: Diagnostic Tool override found: [%s]", "CustomRunErrorExitCode", "t;h@E@", "DefaultPKeyUsed", "8,8@8X8", "\\Windows\\WinSxS\\", "2I2p2", "1)1P1b1", ".rsrc$01", "cm4t5", "1+282E2e2q2x2", "001y1", "4%454<4U4\\4t4{4", "1$1,141<1D1L1T1\\1d1l1t1|1", "BelowNormal", "_vsnprintf", "Valid flags check failed: Flags", "DebugBreak", ":':;:I:", "IDREFS", "RtlCopyLBlob", " Host OS Architecture [ %s ]", ";T ", ".gfids", "(Value != 0) || RtlIsLUtf8StringValid(Value)", "<]=q=x=", "=Q?w?", "SetupHost: Reporting failure event failed: hr = [0x%X]", "RefreshInterval", "zh-TW", "sr-Cyrl-ME", "/MediaEdition", "5T6_6m6", "OneSettings: Found [%s] -> [%s]", ".rsrc$02", "SOFTWARE\\Microsoft\\SQMClient\\Windows", "SetupHost: Copying failure log files from: [%s] -> [%s]...", "GetLastError", "memcpy_s", "DeleteFileEx: Unable to allocate hardlink path buffer", "%I64u", "677{8", ";^n?u?", "ExtDriveDownloadReqRequiredSpace", "OSPartitionInstallReqFreeSpacePostUpgrade", "WINPE", " PreInstallQuiet", "SetupUI: No registered callback.", ".<>I(", "`03*:", "inf\\setup.cfg", "GetLongPathNameW", "/tempdrive", "PreDownloadUX", "%S\\%s", "2$2)2/282>2B2G2Q2X2]2c2l2r2v2{2", "en-BZ", "ResultCode", "4<4N4f4", "/Selfhost", "Not-null check failed: String1", "NMTOKEN", "ntdll.dll", "MoSetup", "GetNativeSystemInfo", "NewAttlist = this->AllocateStreamObject()", ">W?^?", "/Action", "5)5N5w5", "fclose", "pChild->pBasicNode != 0", "9A:?;r;'6>Q>g>u>", "WIM_Verbose_Logging", "(>^>h>", "CMoSetupOneSettingsHelperT::BuildStringUpdateUBR", "=<>k>", "Succeeded", "]_^[]", "SecureBootCheckFailure", "?D?e?{?", "\\$ ;E", "=3=?=J=j=", "=*=M=j=}=", "InstanceId", "=hK2/;", "stVRQ", "ProcessIdToSessionId", "Scenario", "Global\\OneSettingQueryMutex", "Process %s is accessing file wim %s", "kr-Latn-NG", "pHeader->ulSignature == ('dHdM')", "OSPartitionDownloadReqFreeSpaceAfterResponse", "536E6Q6`6", "%s%-20S%S", " Host OS Language Id [ %d ]", ":`:}:", "DiskSpaceInstallReqFUReservesClaimedSpace", "UpdateWIMHeader failed", "SINGLE_STEP", "GetFullPathNameW", "<2=m=", "=K>v>", "DIAGNOSTICANALYSISTIMEOUT", "CSetupHost::OnSetupPostReboot", ".giats", "A,;F8u", "3>DI\\+", "InstallReqFreeUpSpaceButtonClicked", "j(hx)I", "en-SG", "GetProcessPreferredUILanguages", "SYSTEM\\Setup\\MoSetup\\Volatile", "u|G;}", "uz-Cyrl", "uJG;}", "j:Yf9H", "ConfigureTelemetryOptInChangeNotification", "Vh|sA", "BUCL::Rtl::AddInPlaceWithOverflowCheck(&cbRequired, (*EncodingSizer)(ucsch))", "w|PPP", "m.Reserved < m_NamedNodeMaps.Size()", "3!373@3E3M3S3X3`3f3k3s3y3~3", "/MediaLangCode", "UninstallComment", "+T$\\+", "SetupUI: Requesting main window removal...", "/DefaultApps", "191113214033Z", "CMoSetupOneSettingsHelperT::GetBuildLabEx", "user32.dll", "3E4P4`4", "/FlightBVT", "ar-BH", "7)737", "AllocateAndInitializeSid", "failed", "s(Ph8", "2.2A2H2Q2d2k2t2", "CMicrodomUpdateContext::Construct", "HSVW3", "SetupHost: Loading AutomationManager manager...", "Source.Length >= 2", "CMicrodomUpdateContext::CreateVirtualTextual", "?(?4?@?L?X?d?p?|?", "L$4_^[3", "_fdopen", ">\">'>1>6><>E>J>O>U>Y>^>h>m>s>x>~>", ")Microsoft Root Certificate Authority 20100", "Settings", "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x", "CSetupDiagnostics: Tracing Data [QUADWORD] -> [%s]=[0x%I64x] [%s][%s][%s][0x%X]", "4#4/484=4C4H4N4R4W4a4j4p4u4}4", "8S?\\?", ">K>V>]>C?N?U?", "/InstallLangPacks", "sq-AL", "AcquireSRWLockExclusive", "100701213655Z", "en-IE", "9MdHdt", "EXTERNALFREESPACEPADDING", "iu-Latn-CA", "es-PA", "WaitForSingleObject", "x1iYk", "WTSRegisterSessionNotification", ".::;?0_", "SetupUI: Calling ShutdownBlockReasonDestroy...", "#rSPo", "SetupUI::Uninitialize - UnblockSystemSleep failed: [0x%X]", "JaaZ92-,+", ";;;G;7X>_>", "CMoSetupOneSettingsHelperT::SetServerEndpoint", "", "L$,_^[3", "SetupHost: Reporting post reboot event -> [0x%X, 0x%X]", "=!>3>A>a>g>", "4Y4k4|4", "TargetOsAllowUninstall", "OutputDebugStringA", "DecodeChunk", "zh-SG", "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x", "SetupHost::Create inproc event reporter result: [0x%X]", " ", "en-IN", "RtlIsLUtf8StringValid(NamespaceURI)", "4 4,484D4P4\\4h4t4", "SLGetProductSkuInformation", ";#;G;Y;_;q;w;", "DISABLED", "T$(94", "ENTITY", "IN_PAGE_ERROR", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5p5x5", "RaiseException", " ", "&>V>\\>", "SetupHost: Loading ID: [%s] from [%s\\%s]...", "Final=0x%X", "ulIndex < UpdateChildNodes.Size()", "]..%Fo", ">D>p>}>", "fo-FO", "040k0", "CBasicNodeType::ChangeNamespace", "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement", "D$,_^[3", "/UpdateAndShutdown", "=!=>=N=U=", "9?9j9q9}9", "/WaitForDebugger", "m_StoredTable.Find(Pair, ppusAttrListNumber)", "om-ET", "0\"0?0e0", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet", "*** Source File: %s, line %ld", "8-878F8Q8X8h8o8", "api-ms-win-eventing-provider-l1-1-0.dll", "/Install", "6f6m6", "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "1$1+121J1a1m1r1|1", "_wcsicmp", "cZ[D3-++", "4 4>4G4", "QQSV3", ";m=w=", "SetupHost: Using automation file: [%s]...", "Ph@O@", "3 4'4.454<4C4J4p495f5", "CMoSetupOneSettingsHelperT::GetUBR", ".idata", "GetFileAttributesW", "it-CH", "fr-LU", ".?AVCSystemHelper@@", "[%hs(%hs)]", "Y2{#z", "SummaryTime", "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)", " OsUninstall", "0\"0)0", ";0AllocateStreamObject()", "platformInstallationType", "setuprollback.cmd", "-Tz4q", "smn-FI", "E(SVW", "3+3L3d3k3", "=$=+=>=O=W=^=", "es-ES", "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom", "f;D$Pu", "0#0Q0c0~0", "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize", "2O3c3", "Not-null check failed: Params->Source.pBlob", "070C0", "261019185142Z0", "not restored", "de-LI", "lb-LU", "CoInitializeSecurity", ">\">O>m>t>", "RtlIsLBlobValid(Source)", "es-NI", "DestroyWindow", "MicrodomImplementation::DecodeXmlCharacterToUcsChar", "ILLEGAL_INSTRUCTION", "GetLogicalDrives", "CodeIntegrity.Telemetry", "UUUUf", "onecore\\base\\lstring\\ucsdecoders.cpp", "j(hh$I", "ReadFile", "", "PerformMediaUpdate", "CXmlLogicalState::{dtor}::::operator ()", "onecore\\base\\lstring\\lblob.cpp", "USER32.dll", "client", "1!1&10151;1D1J1S1Y1]1b1l1q1w1", "ClientId", ":9:V:[:t:{:", ">9?@?v?", "CSetupHost::ReportStorageLocation", "QSVWj", "=\"='=.=5=V=", ";)<3", "?(?0?8?@?H?P?\\?|?", "f9FHu", "8&999", "SetupDiagResults.xml", "Setup360Extended", "Not-null check failed: Writer", "Ph8fA", "WimFindClose", "WIM_Enumerate_Directory_Reparse_Point", "X?_?{?", "454V4d4", "9_@tD", "setuplog.cfg", "PQQjB", "SetupHost::Initialize: InstallFilePath = [%s]", "pToInsertInto != 0", "SetupHost: Looking for automation file...", "9p:~:", "9^@u)h", "3'3F3d3", "towupper", "DiskSpaceInstallReqFUReservesTotalSpace", "WebSetupInputSelectedLang", "DiskSpaceInstallReqBlocked", ":,:<:@:D:H:L:P:X:p:t:", "UnregisterTraceGuids", "gu-IN", "CMoSetupOneSettingsHelperT::GetSettingsParameters", " Microsoft Operations Puerto Rico1", "CSetupHost::GetDiagnosticAnalysisTimeout", "6$6T6[6f6m6x6", "KERNEL32.dll", "GetDriveTypeW", "SetupHost::Create IWUInstallationSession result: [0x%X]", "diagerr.xml", "=0>x>", "CSystemHelper::SetUserSessionChangedCallback", "\"CBlackboard::Close", "mn-Mong-MN", "pContext != 0", "Index", "?6?=?W?^?k?r?", "2p2x2", ".!0*Y", "2[~TM", "smj-NO", "L$8;U", "20201008151940Z", "WINHTTP.dll", "CopyFileW", ":1:C:_:q:", "1%1,1E1Z1o1", "8(848@8L8X8d8p8|8", "SetEvent", "?\"?:?T?[?", "MoveCaptureNode", "WimLazyInitialize", "GetMessageW", "LocationHeader != 0", "/progressCLSID", "<& >,>8>D>P>\\>h>t>", "PQQQQQQ", "7#7@7J7S7[7o7~7", "GetVolumeNameForVolumeMountPointW", "SetupUI: Waiting for message thread...", ":MdLct", "95loI", "5'595\\5n5", "=?>W>e>", "UpdateMediaUIShown", "PPPPjdh", "4'484L4T4m4", ".rdata$zETW2", "SetupHost: External Download %s", "CMicrodomBuilder::StartElement", "HostOsEditionType", "L$HQRP", "QQSVW", "AllocConsole", " ", "onecore\\base\\xml\\udom_xmlcursor.cpp", "RpcStringFreeW", "4O5\"696", "j\\Xf9DN", "D$,VP", "0$000<0H0T0`0l0x0", "2#2Q2c2~2", "SetupUI: Connected standby: [%s]", " Setup360MitigationSummary", "0?1m2", "?#?)?3?8?>?B?G?Q?V?\\?a?g?p?v?z?", "%s;AppVer=%d.%d.%d.%d", "syr-SY", "= =,=8=D=P=\\=h=t=", "=+=F=X=", "Pj2jl", "8!868h8", "es-UY", "WindowsUpdateSuccess", "StandardSetupLogFormatter", "UncompressFileBase", "/optinsqm", "u/G;}", "OneSettings: Invalid boolean value [%s] for setting [%s].", "CMoSetupOneSettingsHelperT::GetOsVer", "Web360", "kernel32", "CreateDirectoryW", "es-CR", "es-VE", "OMLvjWcElu", "=7=C=N=", "9\\$`t", "0!1(1", "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART", "Entity.Length != 0", "M>B~1", "=(>9>", "7&818k8x8", "SetupHost: Proceeding without decryption key.", "SourceMicrodom != 0", "D$ h<", "MicrodomWriterImplementation::CMicrodomWriter::CreateInterface", "CSetupHost::SetUIInfo", " PreDownloadUX", "sr-Latn-RS", "hr-HR", "MSCFu", "HostOsSkuName", "?(?:?f?x?", "W9{HuI", "RPCRT4.dll", "838O8c8", "SetupUI: Power request granted!", "BCryptHashData", "j]Zf;", "UTF-8", "T$@j[P", "HWARE", "454\\4", "SetupUI: Setting system sleep block message: [%s]", "GetCurrentProcess", "QQQQQQP", "292@2", "?9?Z?a?", "Virtual", "1&252B2i2q2", "ExitProcess", "Cancelled", "SetupHost: Automation information not found. Releasing automation object.", "? ", ";y-{e", "D$$d*A", "PKeyINeedAPkeyClicked", "en-US", "233:3I4", "8&858j8", "sv-SE", "NewAttdef = this->AllocateStreamObject()", "Accept", "_wtol", "080X0", "Microsoft Windows0", "Unknown", "SetupNotify::CleanupCachedFile - Cleaning up cached file [%s].", "7@8^8", "CMicrodomBuilder::ConstructAndWriteMicrodom", "1::&*a`", "< m_LayoutCache.DocumentId()", "EventType=0x%X", "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))", ".CRT$XCAA", "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext", "TlsFree", "3O3^3", " Operating System", "SystemPartitionFreeSpace", "%u-%u-%u", "/Compat", "9~HtI", "060E0{0", "VhpsA", "_initterm", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment", "9):D:P:[:x:", "yQ^?%?", "qps-ploca", "m_StoredTable.Find(Pair, ppAttDef)", "Z_hn{}Q", "5#5w5", "<#<.<4<@E>R>y>", "Boot360", "Extended=0x%X", "SetupNotify::Remapping missing decrypt key error [0x%X] -> [0x%X]", "D$4PQ", "6$6D6L6X6x6", "%d-%02d-%02d %02d:%02d:%02d,", "AzureFinalize", "7<7M7T7_7l7", "?!?+?>?L?x?", "Requesting full cleanup for unpack errors.", "2$2)2/242:2>2C2M2X2]2c2h2n2r2w2", "_wcmdln", "C^?i?", "Staged Image", "ActivationBlocked", "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x", "sah-RU", "SetupNotify::ReportEvent - RecordInstallationResult [%s,0x%X,%s,%s,%s]", "__p__commode", "oK0D$\"<", "_lock", "CSetupHost::Register", "RtlDuplicateLUnicodeStringToLUtf8String", "HostOsStageType", "onecore\\base\\telemetry\\permission\\product\\telemetrypermission.cpp", ".rdata$brc", "PostQuitMessage", "CallContext:[%hs] ", "CMicrodomBuilder::GetXmlDomSize", ":\";1;>;", ";,;N;o;u;", "HostOsLanguage", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteRawString", "CSystemHelper::Initialize", "=/>V>", "9 ;k;", "Windows Blue Setup Host", "UpdateWindow", "u;9_0t6", "rv.UcsCharacter < 0x110000", "D$0Pj", "D$0;D$(", " SVWj", "Not-Genuine", "OSPartitionInstallReqRequiredSpace", "::RtlIsLUtf8StringValid(StringIn)", "293G3", "RtlAppendLBlobToLBlob", "CreateFile failed", "t9jT3", "P{(G}", "CompatMigScanTime", "Properties.Length == Results.Length", "SourceDom != 0", "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize", ";B::CreateTearoff", "TlP0X", ": :.:5:W:^:n:u:", "SetWindowLongW", "&", "\\\\?\\GLOBALROOT", "Not-null check failed: StringIn", "=$>+>7>>>", "vi-VN", " Setup360MitigationResult", "'F!X8^", "WebSetupInputSelectedArch", "RegistryCount", "WinDLP System Reboot", " ", "020C0V0i0|0", "WimCloseImageFile", "?#?)?/?5?;?A?I?M?Q?U?Y?]?a?e?i?y?", "kl-GL", "ResAddFromFileAndHandle", ":H;~;", "EventWrite", "j\\Yf9", "__p__fmode", "CXmlCursor::DecodeExtent", "0\"0)040F0M0", "Not-null check failed: pStream", ".rdata$sxdata", "3!323?3h3s3", "HostOsBranchName", "{6c104913-738b-4411-a4ec-8b594e314f6b}", "this->ChildList[u]->Text != 0", "base\\ntsetup\\conx\\mosetup\\setuphost\\DiagnosticsImpl.h", "/WUCachedFileName", "t\"Wh8o@", "IgnoreWarning", "server", "3<3f3", "wcscpy_s", "CSetupHost::LogBuildInfo", "464Y4|4", "Locals.Allocate()", "InitiateSystemShutdownExW", "RemoveDirectoryW", "PSSSSSSSj", "3H3w3", "POSTUPGRADEFREESPACEREQUIRED", "<8<><==O=\\=v=", "GetSystemTimeAsFileTime", "memset", "ne-NP", " Downlevel", "/CopyLogs \"%s\"", "739:9N9", "01070@0G0", "GetTickCount", "OSPartitionInstallReqMinimumRequiredSpace", "CoInitializeEx", "mn-Cyrl", "DependsOn", "\\\\.\\SAC", "<$<,<4<<m_LayoutCache.TotalObjectCount()", "3$3E3N3c3r3{3", "ParseChunkRegionInternal", "95`oI", "MediaLayoutTime", "ProductName", "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)", "sr-Latn-BA", "CreateProcessA", "__iob_func", "VerifyFileByHandle", "Xf9ABt", "UE~n]", "TargetOsVersionMinor", "SetupHost::GetEulaFile result: [0x%X]. Proceeding without EULA.", "CopySid", "NtQuerySecurityPolicy", "OSPartitionInstallReqFreeSpaceAfterResponse", "%s\\%s", "<$<00E0y0", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings", ".?AV?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@", "::RtlIsLUtf8StringValid(Source)", "BUCL::Rtl::Multiply(WorkingBufferSize, MultiplicativeGrowthFactor, WorkingBufferSize)", "7)797`7{7", "wo-SN", "la-001", ".?AV?$CMoSetupUnknownImpl@VCSystemHelper@@@@", "fa-IR", "tPSVP", "454J4e4", "7?7E7|7", "MicrodomImplementation::CMicrodom::GetDocumentNodeSet", "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode", "8+8;8M8i8x8", "RtlGetPersistedStateLocation", "$bSr6'QF78S9", "1+181M1c1n1", "CMoSetupOneSettingsHelperT::GetSettingAsDword", "_wtoi", "SetFileTime", "6C6J6b6", "xmlns", "SetupHost: Tracing post reboot failure event", "/InstallPrivates", "OSPartitionDownloadReqFreeSpaceBeforeSilentCleanup", "_set_errno", "onecore\\base\\xml\\udom_builder.cpp", "Not-null check failed: Destination", "ReportId", "WTSUnRegisterSessionNotification", "-eQkU", "95 =I", "rXBGW", "SusClientId", "", "diagwrn.xml", "/CorrelationVector", "PreInstallUX", "%Microsoft Windows Production PCA 20110", "SetupNotify::Remapping internal cancellation request [0x%X] -> [0x%X]", "WebSetupInputDefaultEdition", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length", "7\"7V7]7s7", ";](s?", "ExtDriveInstallReqRequiredSpace", "RtlIsMicrodomUpdateContextValid(HostUpdate)", "?wText.Allocate()", "|||v|xp", "DUSetupOptIn", "C<+C(", "CSetupDiagnostics: ReportEventMitigationSummary -> [0x%X][%d][%d][%d][%d][%I64u][%s][%s][%s][%s][0x%X]", "NewPcData = this->AllocateStreamObject()", "LayoutUSBTime", "=$=,=4=<=D=L=T=\\=d=l=t=|=", "NewAttlistClose = this->AllocateStreamObject()", "mn-Mong-CN", "f@f#E", "6%6>6C6l6~6", "lt-LT", "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x", "Windows::Rtl::IsValid(ptr)", "9r$tL;", "%d.%d", "CopyDirectoryDirCallback: The copy was canceled by the user.", "SetCurrentDirectoryW", "", "SetupHost: Tracing post reboot event failed: hr = [0x%X]", "6?6M6i6|6", "DeleteFileEx: Trying to set back attributes on: %s", "windows", "ResExtract", "GetDiskFreeSpaceExW", "WebSetupClientVersion", "whichElement != Windows::Microdom::Rtl::Element::InvalidValue()", "GetProductInfo", "CMicrodomBuilder::ConsumeProcessingInstruction", "OpenThreadToken", "OpenProcessToken", "QQQQQQQW", "DUCATEGORIES_FLAG", "preoobescript.cmd", "CloseHandle", "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]", "^[w\"QRW", "1$1*1.141>1J1O1T1Y1_1c1i1s1", "as-IN", "PKeyValidateTime", "SetupUI: Power request cleared!", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", "mni-IN", "3\"3P3a3j3t3}3", "9#939=9C9K9Q9_9f9l9p9y9", ":7:>:W:^:l:s:", "858n8", "J0V;A", "WriteFile", "Media360", "MicrodomImplementation::CDomPositionCache::AttachToPositionList", "?]?d?", "GetVersion", "Ph0gA", "0X0~0", "WIM\\IMAGE[*]", "strncpy_s", "Windows::Rtl::CRtlObjectTypeDescription::CreateInstance", "j}Zf;", ">!>3>L>^>w>", "T$(9GL|X", "][YZ_^_^[", "WaitForMultipleObjects", "777a7h7y7", "SetupHost::InitializeComponents", "DiskPartitionTime", "scenarioId", "FileVersion", "0 0,080D0P0\\0h0t0", "RtlDuplicateLUtf8String", "StudyID", "m_AttdefListTable.FindOrInsertIfNotPresent( ulElementName, NewAttdefList, &pAttdefList)", "ATTLIST", "LoadIntegrityInfo", "SetupHost: Reporting pending reboot event failed: hr = [0x%X]", "(Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)", ".rdata$zzzdbg", "3+464D4", "D$(4^A", "j---.7", "H0YM O", "OneSettings: DeviceId [%s]", "?#?(?.?2?7?A?L?Q?W?`?f?j?o?y?", "6 60686@6P6X6h6l6p6|6", "030I0P0Z0q0x0", "SystemPartitionTotalSpace", "rqsppnmmTP84211h", "OSPartitionInstallReqFreeSpaceBeforeSilentCleanup", "oc-FR", "GetFileType", "3B3]3", "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild", "VWRQSU", "Lg ;M@c", "HostOsSkuId", "", "aLimitEnhancedDiagnosticDataWindowsAnalytics", "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon", "SetupUI: Calling PowerSetRequest with type [0x%X]...", "CompareStringW", "=E>L>^>e>", "PPPPh@", "/RollbackSys", "%-20S %-21S [0x%06x] %S", "SHELL32.dll", "CreateThread", "3e4p4~4" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "e32c76ebad7261cce80aee4db54d1bf22c0fd8c3cf52876d66fe14bc029508b6", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/e32c76ebad7261cce80aee4db54d1bf22c0fd8c3cf52876d66fe14bc029508b6", "guest_paths": [ "overlay" ], "size": 8504, "crc32": "25CEDC9E", "md5": "3e466cc0253fcc1330590f60aff9c02e", "sha1": "c68ad7ca6814a9e2ace380a5d27b0753eee84436", "sha256": "e32c76ebad7261cce80aee4db54d1bf22c0fd8c3cf52876d66fe14bc029508b6", "sha512": "61de38fd84de2dbc06db38c6c955fc5dd1b2389bbff219c30061dab37123ea07da70c45335f1c4458badba926b819f7bd07107df394bba5c1313a757eeaad6de", "rh_hash": null, "ssdeep": "96:bH0DXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGuGDXvQQsi2DuU4tDfr:zF2q8hDBQABJYh35jWqnajNQX", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1BB022BD28FAC5047D9A7BC405398F8877D3D83CB1864846619ABF6E52C437C6DF08A6D", "sha3_384": "2d31e695a811303dce2e64ef637847ba1f66d65f2add67114eb3ea200f82dd09dd8e694ba6d37fc5e4a12b4c9a5bb10c", "data": null } ], "extracted_files_time": 0.0005436009996628854, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "WinDlp.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/26b66b81267dfda7a78890f20a4ed0d104db1cd350d2d9f649fdb496b6c11333", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\WinDlp.dll" ], "size": 1165624, "crc32": "F8E27C3A", "md5": "6f12ba2d5cb564f73d9813d105e5c1fe", "sha1": "b634e34149f99f4336efc0c5de5e850c61be48e1", "sha256": "26b66b81267dfda7a78890f20a4ed0d104db1cd350d2d9f649fdb496b6c11333", "sha512": "4462f38b0a4eca1d09eb747853cc15c804e2e42e91812604a0aef25de06d5fa5a5a4d79731aeb462f61ed46d63dd904d0a943919aabd5adb771f94c63e6a175a", "rh_hash": null, "ssdeep": "24576:sHChbi7VH3Cg3G49W4qjbuK5nwTShiPGm/ap:Bhbi7VHSCGF7wTDOzp", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T12A452A117FECDA5BF1B37A3166756222457EBA227E35C4CF02A0890D79B0A81DD3472B", "sha3_384": "a26b269d614bb978585d0c02ac30198cd0f1f39d84f4bec88624e5674eb9b9ccbbf3df6c9284db42f57d3e124918c331", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x000f16a0", "ep_bytes": "8bff558bec837d0c017505e845050000", "peid_signatures": null, "reported_checksum": "0x0011de38", "actual_checksum": "0x0011de38", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "WinDlp.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x100fc3b4", "name": "wcsnlen" }, { "address": "0x100fc3b8", "name": "_ultow_s" }, { "address": "0x100fc3bc", "name": "towupper" }, { "address": "0x100fc3c0", "name": "strcpy_s" }, { "address": "0x100fc3c4", "name": "_wcsupr" }, { "address": "0x100fc3c8", "name": "strncmp" }, { "address": "0x100fc3cc", "name": "iswspace" }, { "address": "0x100fc3d0", "name": "memcpy_s" }, { "address": "0x100fc3d4", "name": "swscanf_s" }, { "address": "0x100fc3d8", "name": "wcsncmp" }, { "address": "0x100fc3dc", "name": "_wcstoi64" }, { "address": "0x100fc3e0", "name": "strncpy_s" }, { "address": "0x100fc3e4", "name": "_strnicmp" }, { "address": "0x100fc3e8", "name": "_wcsrev" }, { "address": "0x100fc3ec", "name": "qsort" }, { "address": "0x100fc3f0", "name": "wcstok_s" }, { "address": "0x100fc3f4", "name": "bsearch" }, { "address": "0x100fc3f8", "name": "memmove_s" }, { "address": "0x100fc3fc", "name": "wcschr" }, { "address": "0x100fc400", "name": "wcscpy_s" }, { "address": "0x100fc404", "name": "_snwscanf_s" }, { "address": "0x100fc408", "name": "_wcstoui64" }, { "address": "0x100fc40c", "name": "_purecall" }, { "address": "0x100fc410", "name": "wcstoul" }, { "address": "0x100fc414", "name": "_vsnwprintf" }, { "address": "0x100fc418", "name": "_wcslwr" }, { "address": "0x100fc41c", "name": "iswalpha" }, { "address": "0x100fc420", "name": "_vscwprintf" }, { "address": "0x100fc424", "name": "_wtoi" }, { "address": "0x100fc428", "name": "__iob_func" }, { "address": "0x100fc42c", "name": "wcsstr" }, { "address": "0x100fc430", "name": "_wcsnicmp" }, { "address": "0x100fc434", "name": "memmove" }, { "address": "0x100fc438", "name": "_except_handler4_common" }, { "address": "0x100fc43c", "name": "?terminate@@YAXXZ" }, { "address": "0x100fc440", "name": "_onexit" }, { "address": "0x100fc444", "name": "__dllonexit" }, { "address": "0x100fc448", "name": "_unlock" }, { "address": "0x100fc44c", "name": "_lock" }, { "address": "0x100fc450", "name": "_initterm" }, { "address": "0x100fc454", "name": "malloc" }, { "address": "0x100fc458", "name": "free" }, { "address": "0x100fc45c", "name": "_amsg_exit" }, { "address": "0x100fc460", "name": "_XcptFilter" }, { "address": "0x100fc464", "name": "_wcsicmp" }, { "address": "0x100fc468", "name": "wcsrchr" }, { "address": "0x100fc46c", "name": "fflush" }, { "address": "0x100fc470", "name": "_vsnwprintf_s" }, { "address": "0x100fc474", "name": "fwprintf" }, { "address": "0x100fc478", "name": "swprintf_s" }, { "address": "0x100fc47c", "name": "memcpy" }, { "address": "0x100fc480", "name": "memcmp" }, { "address": "0x100fc484", "name": "_ftol2_sse" }, { "address": "0x100fc488", "name": "_ftol2" }, { "address": "0x100fc48c", "name": "__CxxFrameHandler3" }, { "address": "0x100fc490", "name": "wcscat_s" }, { "address": "0x100fc494", "name": "memset" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x100fc0ec", "name": "GetVolumePathNamesForVolumeNameW" }, { "address": "0x100fc0f0", "name": "SetFileTime" }, { "address": "0x100fc0f4", "name": "LocalFileTimeToFileTime" }, { "address": "0x100fc0f8", "name": "DosDateTimeToFileTime" }, { "address": "0x100fc0fc", "name": "MultiByteToWideChar" }, { "address": "0x100fc100", "name": "TlsSetValue" }, { "address": "0x100fc104", "name": "TlsGetValue" }, { "address": "0x100fc108", "name": "CompareStringW" }, { "address": "0x100fc10c", "name": "SetPriorityClass" }, { "address": "0x100fc110", "name": "EnterCriticalSection" }, { "address": "0x100fc114", "name": "GetFullPathNameW" }, { "address": "0x100fc118", "name": "WriteFile" }, { "address": "0x100fc11c", "name": "WaitForMultipleObjects" }, { "address": "0x100fc120", "name": "SetThreadPriority" }, { "address": "0x100fc124", "name": "InitializeCriticalSectionAndSpinCount" }, { "address": "0x100fc128", "name": "LeaveCriticalSection" }, { "address": "0x100fc12c", "name": "SetEndOfFile" }, { "address": "0x100fc130", "name": "WaitForSingleObject" }, { "address": "0x100fc134", "name": "CreateFileW" }, { "address": "0x100fc138", "name": "GetFileAttributesW" }, { "address": "0x100fc13c", "name": "CreateEventW" }, { "address": "0x100fc140", "name": "GetExitCodeThread" }, { "address": "0x100fc144", "name": "FormatMessageW" }, { "address": "0x100fc148", "name": "GetTimeZoneInformation" }, { "address": "0x100fc14c", "name": "GetLastError" }, { "address": "0x100fc150", "name": "TlsFree" }, { "address": "0x100fc154", "name": "SetEvent" }, { "address": "0x100fc158", "name": "GetCurrentThread" }, { "address": "0x100fc15c", "name": "GetThreadPriority" }, { "address": "0x100fc160", "name": "DeleteFileW" }, { "address": "0x100fc164", "name": "GlobalFree" }, { "address": "0x100fc168", "name": "CloseHandle" }, { "address": "0x100fc16c", "name": "CreateThread" }, { "address": "0x100fc170", "name": "ResetEvent" }, { "address": "0x100fc174", "name": "GetPriorityClass" }, { "address": "0x100fc178", "name": "SetFilePointerEx" }, { "address": "0x100fc17c", "name": "LocalFree" }, { "address": "0x100fc180", "name": "DeleteCriticalSection" }, { "address": "0x100fc184", "name": "SystemTimeToTzSpecificLocalTime" }, { "address": "0x100fc188", "name": "GetSystemTime" }, { "address": "0x100fc18c", "name": "lstrcmpW" }, { "address": "0x100fc190", "name": "VirtualQuery" }, { "address": "0x100fc194", "name": "IsDebuggerPresent" }, { "address": "0x100fc198", "name": "FlushFileBuffers" }, { "address": "0x100fc19c", "name": "CreateDirectoryW" }, { "address": "0x100fc1a0", "name": "ReadFile" }, { "address": "0x100fc1a4", "name": "GetVolumeInformationW" }, { "address": "0x100fc1a8", "name": "FindFirstFileW" }, { "address": "0x100fc1ac", "name": "GetFileSizeEx" }, { "address": "0x100fc1b0", "name": "SetLastError" }, { "address": "0x100fc1b4", "name": "FindNextFileW" }, { "address": "0x100fc1b8", "name": "RemoveDirectoryW" }, { "address": "0x100fc1bc", "name": "SetErrorMode" }, { "address": "0x100fc1c0", "name": "WriteFileEx" }, { "address": "0x100fc1c4", "name": "GetTempPathW" }, { "address": "0x100fc1c8", "name": "FindClose" }, { "address": "0x100fc1cc", "name": "GetVolumePathNameW" }, { "address": "0x100fc1d0", "name": "LocalAlloc" }, { "address": "0x100fc1d4", "name": "GetVolumeNameForVolumeMountPointW" }, { "address": "0x100fc1d8", "name": "SetFileAttributesW" }, { "address": "0x100fc1dc", "name": "SetVolumeLabelW" }, { "address": "0x100fc1e0", "name": "ReadFileEx" }, { "address": "0x100fc1e4", "name": "LoadLibraryW" }, { "address": "0x100fc1e8", "name": "MoveFileExW" }, { "address": "0x100fc1ec", "name": "CopyFileW" }, { "address": "0x100fc1f0", "name": "GetTempFileNameW" }, { "address": "0x100fc1f4", "name": "GetSystemWindowsDirectoryW" }, { "address": "0x100fc1f8", "name": "QueryDosDeviceW" }, { "address": "0x100fc1fc", "name": "DeviceIoControl" }, { "address": "0x100fc200", "name": "UnmapViewOfFile" }, { "address": "0x100fc204", "name": "CreateFileMappingW" }, { "address": "0x100fc208", "name": "MapViewOfFile" }, { "address": "0x100fc20c", "name": "GetPrivateProfileSectionW" }, { "address": "0x100fc210", "name": "LoadLibraryExW" }, { "address": "0x100fc214", "name": "FreeLibrary" }, { "address": "0x100fc218", "name": "GetLongPathNameW" }, { "address": "0x100fc21c", "name": "GetFinalPathNameByHandleW" }, { "address": "0x100fc220", "name": "GetCurrentDirectoryW" }, { "address": "0x100fc224", "name": "GetDriveTypeW" }, { "address": "0x100fc228", "name": "GetFileInformationByHandleEx" }, { "address": "0x100fc22c", "name": "GetFileInformationByHandle" }, { "address": "0x100fc230", "name": "SetFileInformationByHandle" }, { "address": "0x100fc234", "name": "GetModuleHandleW" }, { "address": "0x100fc238", "name": "CopyFileExW" }, { "address": "0x100fc23c", "name": "ExpandEnvironmentStringsW" }, { "address": "0x100fc240", "name": "GetEnvironmentVariableW" }, { "address": "0x100fc244", "name": "InitializeCriticalSection" }, { "address": "0x100fc248", "name": "GetSystemDirectoryW" }, { "address": "0x100fc24c", "name": "VirtualAlloc" }, { "address": "0x100fc250", "name": "VirtualFree" }, { "address": "0x100fc254", "name": "TlsAlloc" }, { "address": "0x100fc258", "name": "WaitForMultipleObjectsEx" }, { "address": "0x100fc25c", "name": "CreateSemaphoreExW" }, { "address": "0x100fc260", "name": "GlobalMemoryStatusEx" }, { "address": "0x100fc264", "name": "GetVolumeInformationByHandleW" }, { "address": "0x100fc268", "name": "CreateSemaphoreW" }, { "address": "0x100fc26c", "name": "ReleaseSemaphore" }, { "address": "0x100fc270", "name": "DuplicateHandle" }, { "address": "0x100fc274", "name": "OpenProcess" }, { "address": "0x100fc278", "name": "TerminateProcess" }, { "address": "0x100fc27c", "name": "GetCurrentProcess" }, { "address": "0x100fc280", "name": "SetUnhandledExceptionFilter" }, { "address": "0x100fc284", "name": "UnhandledExceptionFilter" }, { "address": "0x100fc288", "name": "GetTickCount" }, { "address": "0x100fc28c", "name": "GetSystemTimeAsFileTime" }, { "address": "0x100fc290", "name": "GetCurrentThreadId" }, { "address": "0x100fc294", "name": "GetCurrentProcessId" }, { "address": "0x100fc298", "name": "QueryPerformanceCounter" }, { "address": "0x100fc29c", "name": "Sleep" }, { "address": "0x100fc2a0", "name": "DisableThreadLibraryCalls" }, { "address": "0x100fc2a4", "name": "GetProcessHeap" }, { "address": "0x100fc2a8", "name": "GetProcAddress" }, { "address": "0x100fc2ac", "name": "HeapAlloc" }, { "address": "0x100fc2b0", "name": "GetModuleHandleExW" }, { "address": "0x100fc2b4", "name": "HeapFree" }, { "address": "0x100fc2b8", "name": "WideCharToMultiByte" }, { "address": "0x100fc2bc", "name": "GetFileSize" }, { "address": "0x100fc2c0", "name": "SetThreadIdealProcessor" }, { "address": "0x100fc2c4", "name": "GetSystemInfo" }, { "address": "0x100fc2c8", "name": "UnlockFileEx" }, { "address": "0x100fc2cc", "name": "LockFileEx" }, { "address": "0x100fc2d0", "name": "SetFilePointer" }, { "address": "0x100fc2d4", "name": "HeapReAlloc" }, { "address": "0x100fc2d8", "name": "GetOverlappedResult" }, { "address": "0x100fc2dc", "name": "GetHandleInformation" }, { "address": "0x100fc2e0", "name": "OutputDebugStringW" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x100fc30c", "name": "UuidToStringW" }, { "address": "0x100fc310", "name": "I_RpcMapWin32Status" }, { "address": "0x100fc314", "name": "RpcStringFreeW" }, { "address": "0x100fc318", "name": "UuidFromStringW" }, { "address": "0x100fc31c", "name": "UuidCreate" } ] }, "imagehlp": { "dll": "imagehlp.dll", "imports": [ { "address": "0x100fc3ac", "name": "CheckSumMappedFile" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x100fc49c", "name": "ZwReleaseMutant" }, { "address": "0x100fc4a0", "name": "ZwOpenMutant" }, { "address": "0x100fc4a4", "name": "ZwCreateKey" }, { "address": "0x100fc4a8", "name": "ZwLoadKey" }, { "address": "0x100fc4ac", "name": "ZwDeleteValueKey" }, { "address": "0x100fc4b0", "name": "ZwDeleteKey" }, { "address": "0x100fc4b4", "name": "ZwEnumerateKey" }, { "address": "0x100fc4b8", "name": "ZwQueryValueKey" }, { "address": "0x100fc4bc", "name": "ZwSetSecurityObject" }, { "address": "0x100fc4c0", "name": "ZwUnloadKey" }, { "address": "0x100fc4c4", "name": "ZwSetValueKey" }, { "address": "0x100fc4c8", "name": "ZwOpenKey" }, { "address": "0x100fc4cc", "name": "ZwAllocateUuids" }, { "address": "0x100fc4d0", "name": "LdrGetProcedureAddress" }, { "address": "0x100fc4d4", "name": "LdrGetDllHandle" }, { "address": "0x100fc4d8", "name": "ZwQueryInformationProcess" }, { "address": "0x100fc4dc", "name": "RtlInitAnsiString" }, { "address": "0x100fc4e0", "name": "ZwQueryInformationFile" }, { "address": "0x100fc4e4", "name": "ZwOpenProcess" }, { "address": "0x100fc4e8", "name": "ZwQuerySymbolicLinkObject" }, { "address": "0x100fc4ec", "name": "ZwDeviceIoControlFile" }, { "address": "0x100fc4f0", "name": "ZwQueryDirectoryObject" }, { "address": "0x100fc4f4", "name": "ZwOpenSymbolicLinkObject" }, { "address": "0x100fc4f8", "name": "ZwOpenDirectoryObject" }, { "address": "0x100fc4fc", "name": "RtlReAllocateHeap" }, { "address": "0x100fc500", "name": "RtlExpandEnvironmentStrings" }, { "address": "0x100fc504", "name": "RtlRaiseStatus" }, { "address": "0x100fc508", "name": "NtYieldExecution" }, { "address": "0x100fc50c", "name": "DbgPrintEx" }, { "address": "0x100fc510", "name": "RtlDowncaseUnicodeChar" }, { "address": "0x100fc514", "name": "RtlGetLastNtStatus" }, { "address": "0x100fc518", "name": "RtlSetControlSecurityDescriptor" }, { "address": "0x100fc51c", "name": "RtlFindAceByType" }, { "address": "0x100fc520", "name": "NtQueryDirectoryFile" }, { "address": "0x100fc524", "name": "NtQueryVolumeInformationFile" }, { "address": "0x100fc528", "name": "NtQueryEaFile" }, { "address": "0x100fc52c", "name": "RtlInitializeResource" }, { "address": "0x100fc530", "name": "RtlAcquireResourceExclusive" }, { "address": "0x100fc534", "name": "ZwQueryKey" }, { "address": "0x100fc538", "name": "RtlReleaseResource" }, { "address": "0x100fc53c", "name": "RtlDeleteResource" }, { "address": "0x100fc540", "name": "NtSetEaFile" }, { "address": "0x100fc544", "name": "NtUnloadKey2" }, { "address": "0x100fc548", "name": "ZwQueryAttributesFile" }, { "address": "0x100fc54c", "name": "RtlAppendUnicodeToString" }, { "address": "0x100fc550", "name": "ZwClose" }, { "address": "0x100fc554", "name": "ZwOpenFile" }, { "address": "0x100fc558", "name": "RtlStringFromGUID" }, { "address": "0x100fc55c", "name": "RtlFreeUnicodeString" }, { "address": "0x100fc560", "name": "RtlGUIDFromString" }, { "address": "0x100fc564", "name": "ZwQuerySystemInformation" }, { "address": "0x100fc568", "name": "RtlImpersonateSelf" }, { "address": "0x100fc56c", "name": "NtOpenThreadTokenEx" }, { "address": "0x100fc570", "name": "NtOpenProcessTokenEx" }, { "address": "0x100fc574", "name": "NtAdjustPrivilegesToken" }, { "address": "0x100fc578", "name": "NtEnumerateBootEntries" }, { "address": "0x100fc57c", "name": "NtTranslateFilePath" }, { "address": "0x100fc580", "name": "NtSetSecurityObject" }, { "address": "0x100fc584", "name": "NtQueryBootOptions" }, { "address": "0x100fc588", "name": "NtQueryBootEntryOrder" }, { "address": "0x100fc58c", "name": "RtlCreateSecurityDescriptor" }, { "address": "0x100fc590", "name": "RtlCreateAcl" }, { "address": "0x100fc594", "name": "RtlFreeSid" }, { "address": "0x100fc598", "name": "RtlLengthSid" }, { "address": "0x100fc59c", "name": "RtlAllocateAndInitializeSid" }, { "address": "0x100fc5a0", "name": "RtlAddAccessAllowedAceEx" }, { "address": "0x100fc5a4", "name": "NtQuerySymbolicLinkObject" }, { "address": "0x100fc5a8", "name": "RtlSetDaclSecurityDescriptor" }, { "address": "0x100fc5ac", "name": "NtOpenSymbolicLinkObject" }, { "address": "0x100fc5b0", "name": "RtlSetOwnerSecurityDescriptor" }, { "address": "0x100fc5b4", "name": "RtlLengthSecurityDescriptor" }, { "address": "0x100fc5b8", "name": "NtQueryValueKey" }, { "address": "0x100fc5bc", "name": "NtOpenKey" }, { "address": "0x100fc5c0", "name": "RtlCompareMemory" }, { "address": "0x100fc5c4", "name": "RtlSetThreadErrorMode" }, { "address": "0x100fc5c8", "name": "RtlGetThreadErrorMode" }, { "address": "0x100fc5cc", "name": "RtlFreeHeap" }, { "address": "0x100fc5d0", "name": "NtQueryDirectoryObject" }, { "address": "0x100fc5d4", "name": "NtOpenDirectoryObject" }, { "address": "0x100fc5d8", "name": "NtSetInformationFile" }, { "address": "0x100fc5dc", "name": "RtlDosPathNameToNtPathName_U_WithStatus" }, { "address": "0x100fc5e0", "name": "RtlAcquireResourceShared" }, { "address": "0x100fc5e4", "name": "NtSetInformationThread" }, { "address": "0x100fc5e8", "name": "RtlAdjustPrivilege" }, { "address": "0x100fc5ec", "name": "RtlGetVersion" }, { "address": "0x100fc5f0", "name": "NtShutdownSystem" }, { "address": "0x100fc5f4", "name": "NtSetInformationProcess" }, { "address": "0x100fc5f8", "name": "LdrAccessResource" }, { "address": "0x100fc5fc", "name": "LdrFindResource_U" }, { "address": "0x100fc600", "name": "NtCreateFile" }, { "address": "0x100fc604", "name": "NtQuerySystemInformation" }, { "address": "0x100fc608", "name": "NtOpenFile" }, { "address": "0x100fc60c", "name": "NtWaitForSingleObject" }, { "address": "0x100fc610", "name": "RtlNtStatusToDosError" }, { "address": "0x100fc614", "name": "NtQueryInformationThread" }, { "address": "0x100fc618", "name": "NtQueryInformationFile" }, { "address": "0x100fc61c", "name": "NtClose" }, { "address": "0x100fc620", "name": "RtlImageNtHeader" }, { "address": "0x100fc624", "name": "NtDeviceIoControlFile" }, { "address": "0x100fc628", "name": "NtReadFile" }, { "address": "0x100fc62c", "name": "NtOpenProcess" }, { "address": "0x100fc630", "name": "NtQueryInformationProcess" }, { "address": "0x100fc634", "name": "NtWriteFile" }, { "address": "0x100fc638", "name": "RtlDosPathNameToNtPathName_U" }, { "address": "0x100fc63c", "name": "RtlInitUnicodeString" }, { "address": "0x100fc640", "name": "RtlAllocateHeap" }, { "address": "0x100fc644", "name": "ZwWaitForSingleObject" } ] }, "WINHTTP": { "dll": "WINHTTP.dll", "imports": [ { "address": "0x100fc34c", "name": "WinHttpCrackUrl" }, { "address": "0x100fc350", "name": "WinHttpConnect" }, { "address": "0x100fc354", "name": "WinHttpReceiveResponse" }, { "address": "0x100fc358", "name": "WinHttpQueryDataAvailable" }, { "address": "0x100fc35c", "name": "WinHttpSendRequest" }, { "address": "0x100fc360", "name": "WinHttpGetProxyForUrl" }, { "address": "0x100fc364", "name": "WinHttpGetIEProxyConfigForCurrentUser" }, { "address": "0x100fc368", "name": "WinHttpCloseHandle" }, { "address": "0x100fc36c", "name": "WinHttpSetOption" }, { "address": "0x100fc370", "name": "WinHttpOpenRequest" }, { "address": "0x100fc374", "name": "WinHttpReadData" }, { "address": "0x100fc378", "name": "WinHttpQueryHeaders" }, { "address": "0x100fc37c", "name": "WinHttpAddRequestHeaders" }, { "address": "0x100fc380", "name": "WinHttpOpen" }, { "address": "0x100fc384", "name": "WinHttpSetTimeouts" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x100fc000", "name": "GetSecurityDescriptorSacl" }, { "address": "0x100fc004", "name": "AdjustTokenPrivileges" }, { "address": "0x100fc008", "name": "GetSecurityDescriptorDacl" }, { "address": "0x100fc00c", "name": "GetSecurityDescriptorGroup" }, { "address": "0x100fc010", "name": "SetNamedSecurityInfoW" }, { "address": "0x100fc014", "name": "GetSecurityDescriptorControl" }, { "address": "0x100fc018", "name": "GetSecurityDescriptorOwner" }, { "address": "0x100fc01c", "name": "ConvertSidToStringSidW" }, { "address": "0x100fc020", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x100fc024", "name": "RegCloseKey" }, { "address": "0x100fc028", "name": "RegSetValueExW" }, { "address": "0x100fc02c", "name": "RegOpenKeyExW" }, { "address": "0x100fc030", "name": "RegGetValueW" }, { "address": "0x100fc034", "name": "CryptDestroyKey" }, { "address": "0x100fc038", "name": "CryptGetUserKey" }, { "address": "0x100fc03c", "name": "CryptGetKeyParam" }, { "address": "0x100fc040", "name": "CryptAcquireContextW" }, { "address": "0x100fc044", "name": "CryptEncrypt" }, { "address": "0x100fc048", "name": "CryptDecrypt" }, { "address": "0x100fc04c", "name": "CryptExportKey" }, { "address": "0x100fc050", "name": "CryptSetKeyParam" }, { "address": "0x100fc054", "name": "CryptImportKey" }, { "address": "0x100fc058", "name": "CryptGenKey" }, { "address": "0x100fc05c", "name": "CryptReleaseContext" }, { "address": "0x100fc060", "name": "AllocateAndInitializeSid" }, { "address": "0x100fc064", "name": "CopySid" }, { "address": "0x100fc068", "name": "OpenProcessToken" }, { "address": "0x100fc06c", "name": "FreeSid" }, { "address": "0x100fc070", "name": "InitializeAcl" }, { "address": "0x100fc074", "name": "SetSecurityInfo" }, { "address": "0x100fc078", "name": "GetLengthSid" }, { "address": "0x100fc07c", "name": "InitiateSystemShutdownExW" }, { "address": "0x100fc080", "name": "AddAccessAllowedAce" }, { "address": "0x100fc084", "name": "OpenThreadToken" }, { "address": "0x100fc088", "name": "GetTokenInformation" }, { "address": "0x100fc08c", "name": "LookupPrivilegeValueW" }, { "address": "0x100fc090", "name": "RegQueryValueExW" }, { "address": "0x100fc094", "name": "RegEnumValueW" }, { "address": "0x100fc098", "name": "RegEnumKeyExW" }, { "address": "0x100fc09c", "name": "RegCreateKeyExW" }, { "address": "0x100fc0a0", "name": "RegFlushKey" }, { "address": "0x100fc0a4", "name": "RegLoadKeyW" }, { "address": "0x100fc0a8", "name": "RegUnLoadKeyW" }, { "address": "0x100fc0ac", "name": "GetSecurityDescriptorLength" }, { "address": "0x100fc0b0", "name": "GetAclInformation" }, { "address": "0x100fc0b4", "name": "SetThreadToken" }, { "address": "0x100fc0b8", "name": "DuplicateTokenEx" }, { "address": "0x100fc0bc", "name": "RegQueryInfoKeyW" }, { "address": "0x100fc0c0", "name": "ReadEncryptedFileRaw" }, { "address": "0x100fc0c4", "name": "CloseEncryptedFileRaw" }, { "address": "0x100fc0c8", "name": "WriteEncryptedFileRaw" }, { "address": "0x100fc0cc", "name": "OpenEncryptedFileRawW" }, { "address": "0x100fc0d0", "name": "RevertToSelf" }, { "address": "0x100fc0d4", "name": "GetSecurityInfo" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x100fc330", "name": "CharUpperW" }, { "address": "0x100fc334", "name": "LoadStringW" } ] }, "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x100fc64c", "name": "CoTaskMemFree" }, { "address": "0x100fc650", "name": "CoSetProxyBlanket" }, { "address": "0x100fc654", "name": "CoInitializeEx" }, { "address": "0x100fc658", "name": "CoCreateInstance" }, { "address": "0x100fc65c", "name": "CoUninitialize" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x100fc2e8", "name": "SysAllocStringLen" }, { "address": "0x100fc2ec", "name": "SysAllocString" }, { "address": "0x100fc2f0", "name": "VariantClear" }, { "address": "0x100fc2f4", "name": "SafeArrayDestroy" }, { "address": "0x100fc2f8", "name": "VariantInit" }, { "address": "0x100fc2fc", "name": "SafeArrayPutElement" }, { "address": "0x100fc300", "name": "SafeArrayCreateVector" }, { "address": "0x100fc304", "name": "SysFreeString" } ] }, "SHLWAPI": { "dll": "SHLWAPI.dll", "imports": [ { "address": "0x100fc324", "name": "PathRemoveBackslashW" }, { "address": "0x100fc328", "name": "SHCreateStreamOnFileW" } ] }, "Cabinet": { "dll": "Cabinet.dll", "imports": [] }, "bcrypt": { "dll": "bcrypt.dll", "imports": [ { "address": "0x100fc38c", "name": "BCryptGetProperty" }, { "address": "0x100fc390", "name": "BCryptDestroyHash" }, { "address": "0x100fc394", "name": "BCryptHashData" }, { "address": "0x100fc398", "name": "BCryptCreateHash" }, { "address": "0x100fc39c", "name": "BCryptCloseAlgorithmProvider" }, { "address": "0x100fc3a0", "name": "BCryptFinishHash" }, { "address": "0x100fc3a4", "name": "BCryptOpenAlgorithmProvider" } ] }, "VERSION": { "dll": "VERSION.dll", "imports": [ { "address": "0x100fc33c", "name": "GetFileVersionInfoSizeExW" }, { "address": "0x100fc340", "name": "GetFileVersionInfoExW" }, { "address": "0x100fc344", "name": "VerQueryValueW" } ] } }, "exported_dll_name": "WINDLP.DLL", "exports": [ { "address": "0x10076060", "name": "CreateDlpManager", "ordinal": 1 }, { "address": "0x100563d0", "name": "CreateDlpRegistrar", "ordinal": 2 }, { "address": "0x100311a0", "name": "DllMain", "ordinal": 3 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000fa7d0", "size": "0x0000007d" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000fc668", "size": "0x0000012c" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x000ff000", "size": "0x0001434c" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0011a800", "size": "0x00002138" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00114000", "size": "0x00009548" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00030920", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x000038a8", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x000fc000", "size": "0x00000664" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x000f984d", "size_of_data": "0x000f9a00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.44" }, { "name": ".data", "raw_address": "0x000f9e00", "virtual_address": "0x000fb000", "virtual_size": "0x00000de4", "size_of_data": "0x00000400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "3.68" }, { "name": ".idata", "raw_address": "0x000fa200", "virtual_address": "0x000fc000", "virtual_size": "0x00002bf6", "size_of_data": "0x00002c00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.79" }, { "name": ".rsrc", "raw_address": "0x000fce00", "virtual_address": "0x000ff000", "virtual_size": "0x00015000", "size_of_data": "0x00014400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "4.23" }, { "name": ".reloc", "raw_address": "0x00111200", "virtual_address": "0x00114000", "virtual_size": "0x00009548", "size_of_data": "0x00009600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.80" } ], "overlay": { "offset": "0x0011a800", "size": "0x00002138" }, "resources": [ { "name": "RT_MESSAGETABLE", "offset": "0x000ff460", "size": "0x000004b0", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "5.64" }, { "name": "RT_MESSAGETABLE", "offset": "0x000ff910", "size": "0x00000b84", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.61" }, { "name": "RT_MESSAGETABLE", "offset": "0x00100494", "size": "0x00000be4", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.33" }, { "name": "RT_MESSAGETABLE", "offset": "0x00101078", "size": "0x00000e1c", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.37" }, { "name": "RT_MESSAGETABLE", "offset": "0x00101e94", "size": "0x00000e38", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.94" }, { "name": "RT_MESSAGETABLE", "offset": "0x00102ccc", "size": "0x00000bcc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.32" }, { "name": "RT_MESSAGETABLE", "offset": "0x00103898", "size": "0x00000bac", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.32" }, { "name": "RT_MESSAGETABLE", "offset": "0x00104444", "size": "0x00000cf8", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.38" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010513c", "size": "0x00000b38", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.53" }, { "name": "RT_MESSAGETABLE", "offset": "0x00105c74", "size": "0x00000d48", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.31" }, { "name": "RT_MESSAGETABLE", "offset": "0x001069bc", "size": "0x00000728", "filetype": null, "language": "LANG_JAPANESE", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.95" }, { "name": "RT_MESSAGETABLE", "offset": "0x001070e4", "size": "0x000006f0", "filetype": null, "language": "LANG_KOREAN", "sublanguage": "SUBLANG_KOREAN", "entropy": "5.17" }, { "name": "RT_MESSAGETABLE", "offset": "0x001077d4", "size": "0x00000d00", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.30" }, { "name": "RT_MESSAGETABLE", "offset": "0x001084d4", "size": "0x00000c1c", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.32" }, { "name": "RT_MESSAGETABLE", "offset": "0x001090f0", "size": "0x00000b70", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.59" }, { "name": "RT_MESSAGETABLE", "offset": "0x00109c60", "size": "0x00000c9c", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.36" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010a8fc", "size": "0x00000bf8", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.91" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010b4f4", "size": "0x00000bdc", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.37" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010c0d0", "size": "0x00000a8c", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010cb5c", "size": "0x000004b8", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "5.48" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010d014", "size": "0x00000cd0", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.34" }, { "name": "RT_MESSAGETABLE", "offset": "0x0010dce4", "size": "0x00000d28", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.30" }, { "name": "RT_VERSION", "offset": "0x0010ea0c", "size": "0x00000380", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_TRADITIONAL", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x0010ed8c", "size": "0x0000039c", "filetype": null, "language": "LANG_CZECH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.56" }, { "name": "RT_VERSION", "offset": "0x0010f128", "size": "0x000003a8", "filetype": null, "language": "LANG_DANISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.51" }, { "name": "RT_VERSION", "offset": "0x0010f4d0", "size": "0x0000039c", "filetype": null, "language": "LANG_GERMAN", "sublanguage": "SUBLANG_GERMAN", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x0010f86c", "size": "0x000003bc", "filetype": null, "language": "LANG_GREEK", "sublanguage": "SUBLANG_DEFAULT", "entropy": "4.03" }, { "name": "RT_VERSION", "offset": "0x0010fc28", "size": "0x000003a0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.50" }, { "name": "RT_VERSION", "offset": "0x0010ffc8", "size": "0x000003ac", "filetype": null, "language": "LANG_FINNISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.54" }, { "name": "RT_VERSION", "offset": "0x00110374", "size": "0x000003c4", "filetype": null, "language": "LANG_FRENCH", "sublanguage": "SUBLANG_FRENCH", "entropy": "3.53" }, { "name": "RT_VERSION", "offset": "0x00110738", "size": "0x000003a4", "filetype": null, "language": "LANG_HUNGARIAN", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.51" }, { "name": "RT_VERSION", "offset": "0x00110adc", "size": "0x000003ac", "filetype": null, "language": "LANG_ITALIAN", "sublanguage": "SUBLANG_ITALIAN", "entropy": "3.48" }, { "name": "RT_VERSION", "offset": "0x00110e88", "size": "0x000003a4", "filetype": null, "language": "LANG_DUTCH", "sublanguage": "SUBLANG_DUTCH", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x0011122c", "size": "0x00000390", "filetype": null, "language": "LANG_NORWEGIAN", "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL", "entropy": "3.49" }, { "name": "RT_VERSION", "offset": "0x001115bc", "size": "0x000003c0", "filetype": null, "language": "LANG_POLISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.52" }, { "name": "RT_VERSION", "offset": "0x0011197c", "size": "0x000003c0", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN", "entropy": "3.48" }, { "name": "RT_VERSION", "offset": "0x00111d3c", "size": "0x000003d8", "filetype": null, "language": "LANG_RUSSIAN", "sublanguage": "SUBLANG_RUSSIAN", "entropy": "3.92" }, { "name": "RT_VERSION", "offset": "0x00112114", "size": "0x0000039c", "filetype": null, "language": "LANG_SWEDISH", "sublanguage": "SUBLANG_SWEDISH", "entropy": "3.51" }, { "name": "RT_VERSION", "offset": "0x001124b0", "size": "0x00000398", "filetype": null, "language": "LANG_TURKISH", "sublanguage": "SUBLANG_DEFAULT", "entropy": "3.55" }, { "name": "RT_VERSION", "offset": "0x00112848", "size": "0x00000380", "filetype": null, "language": "LANG_CHINESE", "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED", "entropy": "3.56" }, { "name": "RT_VERSION", "offset": "0x00112bc8", "size": "0x000003c8", "filetype": null, "language": "LANG_PORTUGUESE", "sublanguage": "SUBLANG_PORTUGUESE", "entropy": "3.49" }, { "name": "RT_VERSION", "offset": "0x00112f90", "size": "0x000003bc", "filetype": null, "language": "LANG_SPANISH", "sublanguage": "SUBLANG_SPANISH_MODERN", "entropy": "3.50" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 下載平台" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0404 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Download Platform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. VÅ¡echna práva vyhrazena." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Operační systém Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0405 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Download Platform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Alle rettigheder forbeholdes." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operativsystem" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0406 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows-Downloadplattform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Alle Rechte vorbehalten." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Betriebssystem Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0407 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Πλατφόρμα λήψης Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Με επιφύλαξη κάθε νόμιμου δικαιώματος." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Λειτουργικό σύστημα Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0408 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Download Platform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windowsin latausympäristö" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Kaikki oikeudet pidätetään." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® -käyttöjärjestelmä" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040b 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Plateforme de téléchargement de Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tous droits réservés." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Système d’exploitation Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040c 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows letöltési platform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Minden jog fenntartva." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® operációs rendszer" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x040e 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Piattaforma download Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tutti i diritti riservati." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Sistema operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0410 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows-downloadplatform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Alle rechten voorbehouden." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows®-besturingssysteem" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0413 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Nedlastingsplattform" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Med enerett." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Operativsystemet Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0414 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Platforma pobierania systemu Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Wszelkie prawa zastrzeżone." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "System operacyjny Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0415 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Plataforma de Download do Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos os direitos reservados." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Sistema Operacional Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0416 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Платформа скачивания Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Корпорация Майкрософт (Microsoft Corporation). Все права защищены." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Операционная система Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0419 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Plattform för Windows-nedladdning" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Med ensamrätt." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Operativsystemet Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041d 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Ä°ndirme Platformu" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Tüm hakları saklıdır." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® İşletim Sistemi" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x041f 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows 下载平台" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0804 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Plataforma de Transferência do Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos os direitos reservados." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Sistema Operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0816 0x04b0" }, { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Plataforma de descarga de Windows" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WinDlp.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. Todos los derechos reservados." }, { "name": "OriginalFilename", "value": "WinDlp.dll" }, { "name": "ProductName", "value": "Sistema operativo Microsoft® Windows®" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0c0a 0x04b0" } ], "imphash": "7508cd4709759e08d5ac01557cc7c022", "timestamp": "2058-11-01 02:46:38", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 14 }, "data": null, "strings": [ "<#=V=", "?5?]?v?", "BiBindEfiBootManager failed %x", " Microsoft Corporation. Med ensamr", "A tarefa BITS est", "FPData", ";6;`;l;w;", ";,:>Y>", "9(9V9", "y0Vh[", "MultiLayout: Initializing Wim Path X86: [%s]", "9sTtr", "4SVWQ", "?MdDlt", "7&7O7V7]7d7", ">&>_>", " operace do", "SendAbortMessage", "=3>o>", "DuplicateHandle", " stato superato il limite di tentativi di riparazione per blocco. Il file ", "czona.%0", "gga till en fil f", "az-Cyrl-AZ", "Angitt handlingsobjekt er ikke initialisert.%0", "UpgLayout: Initializing Wim Path: [%s]", "Range: bytes=%I64u-%I64u", "9'959N9k9", "x*g1\\", "LayoutUsb: Initializing File System: [%s]", "WIM_Chunked_Number_Of_Buffers", "CDlpTask::GetFileByName", "ysWhE", "3 3,383D3P3\\3h3t3", "3=3K3R3", "ServiceDebuggerFiles: %ws does not exist", "0k0o0", "ts-ZA", "GetSystemTime", "ServiceSpaces: Failed to create path %s. Last error = %#x", "4\"484?4N4U4", "7N8b8s8z8", "y6Vhj", "Zadan", "=6>A>O>", "7@8w8", ".idata$5", "6O7V7", "BCD Error: %ws", "RtlTranscodeLBlobs", ">*>q>", "FileCount", "1.1=1Q1m1v1", "041604B0", "Could not retrieve error description from transport for [0x%X].", "ExpandEnvironmentStringsW", "tva.%0", "Blok ba", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART", "scht, da er eine BitLocker-Verschl", "040904B0", "Microsoft Time-Stamp Service0", "t;j#j", "Not-null check failed: MatchIndex", "ncia do Windows", "0/0E0P0", "D$`SVW", "1>1Z1i1v1", "boot\\BCD", "7(747@7L7X7d7p7|7", "OpenEncryptedFileRawW", "PWj@j", "4G5N5", "Redmond1", "0I0P0", "SetPriorityClass", "0$0A0~0", "LockFileEx", "ConnectToSourceUrl: Unable to retrieve proxy info for URL -> [0x%x].", "AddStreamsToImage", "999|9", "SSh @", "StringCchCopyN failed", "Failed to mark system store. File: %ws Status: %x", "+070A0n0", "4C4_4w4", "yi-001", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464", "CDlpTask::ReportDiagTime", "878W8f8s8", "CDlpActionRecoverCrypto::GetSavedCryptedBuffer", "mite de reintentos de reparaci", "RtlDosPathNameToNtPathName_U", "161j1", "MapViewOfFile", "WIM\\IMAGE[*]\\NAME", "FveDisableAuthenticationW", "BcdCopyObjectEx: Failed to copy object. Target: %ws Flags: 0x%x Status: %x", "UncompressFile failed", "TransferFile: User requesting retry...", "MicrodomImplementation::CMicrodom::GetElementNodeSet", "TransferFile: Not updating remote source path.", "ASourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Stream) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::BlobProvider) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Blob)", "DbgPrintEx", "< <*<", "L$t_^[3", "696Z6", "vel adicionar um ficheiro para transfer", "File is not system store. File: %ws Status: %x", "A opera", "3#4W4k4v4", " operace prob", "BiCreateBootEntry: Could not retrieve BCD Object application description. Status: %x", ":F:R:\\:", "ff-Latn-SN", "velet m", "tOj/Xf;", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "CreatePartition", "f;F$u", ";A u3", "fi-FI", "lem zaten duraklat", "autorun.inf", "Wim Capture: Capturing [%u] files from [%s] to [%s], PartSize: [0x%I64X]", ":F:c:", "ho svazku je p", "CXmlCursor::CompareExtents", "CDlpRegistrar::CreateResponse", "ritetty aseman koko on liian pieni.%0", "The requested operation is being cancelled.%0", "RtlAppendLUtf8StringToLUtf8String", "BUILD", "m os dados de descriptografia necess", "ar-DZ", " stata completata.%0", "Zum Entschl", "|SYSPART|\\|EFIDEFAULT|", "bg-BG", "RtlLengthSecurityDescriptor", "Er is een fout opgetreden met de aangevraagde bewerking.%0", ";&;<;\\;c;", "ibb-NG", "HZo6m|", "929@9O9", "memmove", "122M2Z2r2", " ISO ", "080i0", " OEM ", "encoding", "NtOpenKey", "Failed to set boot options. Status: %x", "292h2", "Die angeforderte Volumegr", "7\"707x7", "SVWj@3", "InitVDSServiceNoStatic: Failed to load VDS service; hr = 0x%x.", "3T3e3", ">D>w>", "8?8I8v8", "5,52595\\5h5", "CDlpActionLayoutUsb::GetMaxFileSize", "UnlockFileEx", "9::h:s:", "NewContext.Allocate()", "2'2:2?2t2", "=&=1=g=", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "es-SV", "r das FAT32-Dateisystem.%0", "fr-CD", "0 0+0a0m0", "t$(VW", "The requested volume size is too small.%0", "CDlpWimCapture::WimSplitThresholdReached", "809?9", "EsdLayout: Copying layout to working directory...", "BCryptCloseAlgorithmProvider", "OemWinreWimPath", ":\";M;r;", "2+2F2a2x2", "SSSSSh", "ServicingBootFiles failed. Error = %#x", "CDlpWimCapture::Capture", "Translated a DontSync entry with ID 0x%x", "BiExportStoreAlterationsToEfi failed %x", "quc-Latn", "::RtlIsLBlobValid(Source)", "FreeLibrary", "memmove_s", "`.data", "@\\;B\\t", "pvQ-N", "CDlpManager::GetDwordPropertyByIndex", "3C4P4W4m4", "t$ Ph", "7)8;8", "112T2w2", "7I7W7A8{8", "!E\\H4", "BG_ERROR_CONTEXT_REMOTE_FILE", "CDlpTransportImpl > > >::GetState", "bcrypt.dll", "8(9L9W9R:e:", ">->D>b>", "si lemezk", "|SYSPART|\\|DEST|\\BCD.LOG", "RtlIsLBlobValid(BinaryData)", ">*>I>\\>u>", "uw!\\$", "BitsExecute: Cancelling BITS job due to error: 0x%X", ";0;<;\\;h;", "979>9", "Betriebssystem Microsoft", "CDlpManager::DeleteQuadwordProperty", "CDlpTransportImpl > > >::ResetState", "ulIndex < m_Header->ulTotalNodeCount", "6!6,6^6x6", ":6:B:c:", "Not wiping disk because files exist on a volume that resides on this disk.%0", "210303183039Z0p1", ":C:x:", "3 3|3", "1H2U2", "BiSpacesUpdatePhysicalDevicePath failed %x", "ha-Latn-NG", "LayoutUsb: Initializing Install WIM Path: [%s]", "est pas lanc", "Failed to create Recovery directory. Last error = %#x", "idat pro p", "?7?S?k?", "ReadDirEntry", "BUCL::Rtl::Multiply(Count, TraitsT::TCharSize, cbCount)", "XkZu=", "0)0A1G1v1i2", ";,<;<", "3R4v4", "585D5d5p5", "De gevraagde volumegrootte is te klein.%0", "CheckHttpRequestStatus: WinHttpQueryHeaders Status -> [%d]", "rrelsen er for liten.%0", "2j3w3~3", "8;8E8b8i8~9", "5/6G6Y6f6", "$Microsoft Ireland Operations Limited1&0$", "CDlpActionRecoverCrypto::VerifyWimHasIntegrityData", "2+2G2", "677t7", "6*6>6I6g6", "2T3~3", "WimLayout: Initializing DeleteSource: [%s]", "InternalName", "=7>r>", "KeyName", " poss", "GetVolumePathNameW", " Microsoft Corporation. Tutti i diritti riservati.", "PSWVVh", "FveGetSecureBootBindingState", "kleme dosyas", "The system store is not already loaded", "NewChild.Allocate()", "<)<1 [0x%I64X / 0x%I64X]", "Translation", "nl-BE", "ve-ZA", "ioctl() failed or returned no data", "tr-TR", " soubor WIM neobsahuje po", "WimBufferToHexString", "CloserElement = this->AllocateStreamObject()", "=!=;=H=a=o=", "mr-IN", "0)0@0M0", "6L6s6", "memcpy", "1,2x2", "<#:K:a:", "lusSanitizedFilePath.Length != 0", "ConvertDiskStyle: Successfully converted disk [%d] to %s.", "bs-Cyrl", "MicrodomImplementation::CMicrodom::Initialize", "0f0D0~0[0", "l kicsi.%0", "RecoverCrypto", ">f>3?", "0I0_0", "TempNodes.Allocate(UpperIndex - TheElement.Reserved)", "5@5G5", "T$$RPQQ", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode", ";=;d;", "CDlpActionLayoutUsb::PopulateWimPaths", "CElementModification::ChangeTextValue", "WimPathX64", "Cancelling BITS job due to error: 0x%X", "a chiffr", "3:3N3U3s3}3", "LayoutIso: Specified EFI boot file [%s] is missing!", "5\"575D5a5j5p5", "CDlpTransportBits::InternalResumeJob", "GetModuleHandleExW", "D$LSP", "SeTakeOwnershipPrivilege", "LayoutUsb: Source maximum file size -> [%I64d] bytes", "Converting to NT filename failed", "3*4c4", "te-IN", "232^2", "L$\\_^[3", " egyik f", "lanmad", "909:9q9", "?*?I?a?", "yo-NG", "Not-null check failed: Params", "ar-KW", "20201008074315.149Z0", "F8PSj", "<31><>J>d>", " est trop petite.%0", "UCS-2", "cch <= (((((SIZE_T)~((SIZE_T)0)) - (((SIZE_T)~((SIZE_T)0)) % sizeof(WCHAR))) / sizeof(WCHAR)) - 1)", "n aktar", "90:7:Z:a:", "AddResourceToHashTableCallback", "7)8M8", "BcdCopyObjectEx: Failed to enumerate source elements. Target: %ws Flags: 0x%x Status: %x", ":):0:?:J:|:", " > > >::GetTransportIndex", "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )", "me.%0", "909D9R9", "WimLayout: File deleted successfully.", "Skipping capture path [%s] because it is the WIM temp path", "SetEndOfFile", "ZwQueryInformationProcess", "sources\\boot.wim", "5)6A6L6m6x6", "WimCopyStream failed", "Pyydetty toiminto on valmis.%0", "8%868=8g8", " diskenheden er for lille.%0", "ExportChunkedPortion", "ProgressCurrent", "5 5B5[5x5", "o solicitada encontrou um erro.%0", "TransferFile: TransferFileWorker succeeded.", "CDlpActionImpl > > >::Suspend", "1`2n2u2", "CDlpManager::GetDwordPropertyCount", "j\\Zf;", "RegSetValueExW", "=L>r>}>", "232C2J2", "SVWj43", "lle.%0", "MicrodomImplementation::CStringpoolCache::AttachToStringPool", "Failed to delete boot entry 0x%x. Status: %x", "CMicrodomXmlWalker::XmlError", "o foi disponibilizada nenhuma chave para desencriptar o ficheiro WIM especificado.%0", "0f0D0~0Y0", "C`h`h", "1F1[1g1n1|1", "ProductType", "u|9\\$", ";4;c;n;|;", "9:9H9a9", "ar-SA", "ReleaseDataRange", "\"Microsoft Window", "IMAGE\\NAME", "Windows-downloadplatform", "Process Name = %s", "BfspCopyFile failed to delete temporary file (%s)! Last Error = %#x.", "BitsTransport: Entering TransferFile Method", "5:6o6", "RestoreFileData", ";-=@=V=e=", "ValidateBinaryFileAndSetEA failed", "\\??\\PhysicalDrive%lu", " transport sieciowy.%0", "El volumen solicitado es demasiado grande para el sistema de archivos FAT32.%0", "boot.wim", "y.VjJ", "bsearch", "UnknownType", "RtlDeleteResource", "RtlSetDaclSecurityDescriptor", "3S3i3p3", "EsdLayout: Exporting install image [%d] to ESD file...", "ADVAPI32.dll", "tg-Cyrl", "1(141<1D1L1T1\\1d1l1t1x1", "Error creating boot status data log(%s)! Last Error = %#x", "3 3=3N3`3r3", "Failed to open file %s for read! Error code = %#x", "lo k chyb", "pa-Arab-PK", "CDlpActionWimLayout::DeleteSourceFile", "WARNING", "CDlpActionImpl > > >::SerializeRoutine", "040504B0", "\\$4YY", "sr-Latn-CS", "Det forespurte volumet er for stort for FAT32-filsystemet.%0", "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)", "6\"6/6<6^6m6u6", "RtlDuplicateLBlob", ">,>3>K>R>X>_>t>~>", "m_StoredTable.Initialize()", "Den forespurte volumst", "838@8l8y8", "6A7r7", "ControlSet%03u", "606K6", ":7:`:j:z:", "080L0Y0", "Opening store. Flags: 0x%x", "CDlpTransportImpl > > >::SerializeRoutine", "|d-Vk", "QQSVW3", "t$Vh@3", "9r t1", "2B3W3", "t&f;E", ":\\:a:x:", "BcdCopyObjectEx: Failed to set target elements. Target: %ws Flags: 0x%x Element type: %lu Status: %x", "Sj PjZ", "Failed to retrieve physical partitions. Last Error = %#x", "ta-LK", "%wOtF", ":C:S:l:", "3>3T3n3", "0L0zv", "Microsoft\\Windows NT\\CurrentVersion", "0&0X0z0", "pToRemove != 0", "4)4W4o4", " nebyla zah", "041D04B0", "t1j\\P", " danneggiato.%0", "CDlpTransportImpl > > >::DeserializeRoutine", " initialis", "Der BITS-Auftrag befindet sich zurzeit in der Warteschlange.%0", "3<3C3", ">V>_>f>o>v>", "<9=L=w=", "SeBackupPrivilege", "danego woluminu jest za ma", "CDlpTransportHttp::ConnectToSourceUrl", "SetSecurityInfo", "=1>=>K>", "CDlpTask::Cancel", "TheNode != TheNode.InvalidValue()", "Created boot entry 0x%x using cached variable", "131w1", ":A;K;];z;", "InitializeCriticalSectionAndSpinCount", "eu-ES", "j<_WR", "Rozmiar ", "AX;BXu", "6`7|7", "Ingen nyckel har angetts f", "3.353D3K3[3b3{3", "= =T=n={=", "j\\Xf;A", ".idata$3", "3E3O3z3", ";';>;U;", "|SYSPART|\\|DEST|\\|RESOURCES|", ";F;w;", "=)>B>m>x>", "PrepareFile: Content-Length header not found. Trying GET...", "Value", "CMicrodomUpdateContext::CreateVirtualElement", "Het opgegeven actieobject is niet ge", "LayoutUsb: Failed to run BfsServiceBootFiles with source path [%s], Firmware type [%s]", "ImageWorkerThread", "FindFirstChunk", "Sistema Operativo Microsoft", "ifre ", "JobError: Job State: [%s]", "4#4*4Y4", "PVVj@Wh", "PPPjd", "j\\YtLJ", "CDlpManager::DeleteTask", "WINDLP", ";[9q9", "\\ArcName\\multi(0)disk(0)rdisk(0)", "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)", "CDlpActionImpl > > >::Initialize", "839q9", "ZwDeleteKey", "2@:e:", "CDlpTransportImpl > > >::GetTransportId", "CDlpActionWimLayout::WimLayoutApplyImage", "ttelep", "<-<:MdDtt", ", koska se sis", ":0;7;", "0+1E1^1", "<1=S=", "8'808[8d8u8", "5,6l6O7", "?!?.?]?h?", "The requested operation has already been cancelled.%0", "?w?~?", "=@=`=h=p=x=", "m_PositionList.Allocate(LocationHeader->ulItemCount)", "CreateRestoreInfo", "MicrodomImplementation::CDomLayoutCache::GetNodeChildren", "PWSWWWh", "Exporting alterations to firmware.", "1-1A1L1j1", "Le disque sp", "CompanyName", "#D$ P", "CDlpManager::DeleteQuadwordPropertyByIndex", "NtUnloadKey2", "RecoverCrypto: Verified WIM file size.", "=#>;>\\>o>", "Thales TSS ESN:86DF-4BBC-93351%0#", " disk je p", "Failed to get user token! Error code = %#x", "RtlIsLUtf8StringValid(ElementId)", "de-LU", "support", "0%0.030G0O0[0c0|0", "De aangevraagde bewerking is al geannuleerd.%0", "tt med den beg", "1 1'151", "@\\WjdPQ", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet", " atualmente em fila%0", "WinHttpSendRequest", "rts.%0", "NKNMR", "WIMAddImagePath", "?$?,?8?X?`?l?", "De opgegeven schijf is niet gereed.%0", "ExportInResourceOrder", "5c6j6t6", "IMAGE\\WIMBOOTENTRIES", "da.%0", " klucza w okre", "en-PH", "LogSharingViolationErrorInfo", "878a8|8", "fr-CI", "CDlpManager::GetTransport", "RtlAppendUcsCharacterToLUtf8String", "WIMExportImage", "Microsoft Corporation1-0+", "5%5/5^5", "8C8\\8", "No more than one flag set check failed: __e", "The specified action object has not been initialized.%0", "Le fichier de d", "ba-RU", "3$4+4", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "9%:=:", "RtlSetThreadErrorMode", "CreatePartition: Need to decide the type of the partition to create", "CDlpActionLayoutUsb::PopulateSwmPaths", "enos, mus", "9<9B9", "Der angeforderte Vorgang wurde abgeschlossen.%0", ";H;p;", "CDlpTransportBits::GetState", "9Q9^9m9v9}9", "PPPPPP", "CDlpActionImpl > > >::Execute", "verskridits. Filen ", "Failed to get aliased identifier. Status: %x", "RestoreMountStub: setting reparse point data failed", "WIM\\IMAGE[*]\\FILECOUNT", "QSVWQQ", "ZwOpenProcess", "O tamanho do volume pedido ", "CDlpManager::GetState", "BG_ERROR_CONTEXT_QUEUE_MANAGER_NOTIFICATION", "CDlpRegistrar::GetTransportFactory", "NtQueryBootEntryOrder", "MapViewOfFile(%s) failed! Error code = %#x", "OEM-partitie wordt niet verwijderd omdat deze de installatiekopie van Windows Herstel bevat.%0", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributes", "ggesztve.%0", "HPRh ", " dekryptere den angitte WIM-filen.%0", "BitsTransport: Entering Prepare Method", "WinHttpAddRequestHeaders", "WimLayout: Initializing DisableBootSupport: [%s]", ">H?T?x?", "Not-null check failed: Document", "ar-JO", "WIM\\ESD\\ENCRYPTED", "CDlpActionLayoutUsb::SendActionMessage", "9<9\\9", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "QueryPerformanceCounter", "020P0m0", "~j\\XPW", "$Microsoft Ireland Operations Limited1", "ug-CN", "CDlpFile::GetError", "StringProperty", "ServiceDebuggerFiles: Failed to allocate config buffer", "sd-Deva-IN", "WIMSendFileInfoMessage", "pt-BR", "CDlpTask::GetAction", " en curso.%0", "767L7Y7", """, "CryptReleaseContext", "Not-null check failed: Value", "rden p", "ne-IN", ";E;R;f;l;", ";.;<;", "CreateEventW", "BFSVC: %s", "de-DE", "CDlpManager::DeleteTaskByName", "Microsoft Enhanced RSA and AES Cryptographic Provider", "WIM %s, offset %.8x%.8x, length %x", "::RtlStringCchCopyNW(KeyNameBuffer, KeyNameBufferSize, lusKeyName.Buffer, cchKeyName)", " wstrzymana.%0", "7G7_7u7", "es-419", ">=>C>H>[>k>q>", "sa-IN", "4*595F5{5", "CXmlCursor::Next", "5!5Z5", "NtWaitForSingleObject", "RestoreFileInfo", "echna pr", "_snwscanf_s", "=+=>=", "LayoutUsb: Opening source WIM file: [%s]...", "2;2F2M2", "BitsTransport: Cancelled existing BITS Download Job to directory %s", "AuthUsesFlags", "3:4x4", " sijaitsevassa asemassa on tiedostoja.%0", "glen blev ikke dekrypteret i den angivne WIM-fil.%0", "BUCL::Rtl::Multiply(Offset, TraitsT::TCharSize, cbOffset)", "8$8D8L8X8x8", "RemoteSourcePath", "97u\"3", "CDlpTask::PushChronicleResponse", "nkung f", "Not-null check failed: pWriter", "CBasicNodeType::ForceNameSetting", "JobId", "WinHttpGetIEProxyConfigForCurrentUser", "DeleteFileW", "CDlpActionRecoverCrypto::ClearKeyFromXml", "Bytes", "GetSecurityDescriptorControl failed! Error code = %#x", "A parti", "RtlXmlInitializeTokenization(&TokenizerState, &TokenizerInit)", "2(2H2T2t2|2", "pStringPool->Signature == ('pSdM')", "9R9x9", "ConnectToSourceUrl: Trying auto-detect...", ":7:Q:f:", "RestoreDirTree", "2-3H3", "=3>?>J>e>", "_wcslwr", "354h4", "RecoverCrypto: SetProgressRange: [%u] [%u]", "LdrGetDllHandle", " actualmente en cola.%0", "<%={=", "Not-null check failed: PseudoKeyOut", "RecoverOem", "RecoverCrypto: Delete failure ignored. hr = [0x%X]", "3Z3{3", " operace byla dokon", "869Q9i9", "InitializeCriticalSection", "FveEnableAuthenticationW", "8C8`8", "Object alias resolves to %s", "Error restoring directory metadata", "MdSpt", "RtlIsLUtf8StringValid(Source)", "es-AR", "xJj&Y", "CDlpManager::Reset", "wcsncmp", "Cabinet.dll", "CDlpTask::GetChronologyIndexById", "[ybVh", "?Y?^?", "WimDetermineImages: Checking image [%d] for InstallationType: [%s]", "SSSjdQ", "Not-null check failed: Decoder", "Not-null check failed: fHasChildNodes", ";L;W;i;", "zh-Hans", "CDlpTransportBits::UpdateTaskProgress", "CDlpActionLayoutUsb::PopulateBootPath", "CDlpTransportBitsFactory::GetTransportCount", "ff-Latn-NG", ";0\"?/? [%s]", "7!777B7", "CurrentMinorVersionNumber", "041504B0", "=@=V=", "9J:W:j:s:~:", ";<;T;", " syst", "ExportDirTree", "CDlpTransportImpl > > >::PrepareRoutine", "D$pSV3", "7K7z7", "LayoutUsb: Retrying wipe of disk [%u]", "CDlpActionRecoverCrypto::GenerateCryptoArray", "=?=`=x=", "hr-BA", "CMicrodomBuilder::CElementNameToAttributeListTable::Find", "Specified flags prevent opening unloaded system store", "Um ficheiro na localiza", "o pedida j", "n solicitada.%0", "es-PR", "NtYieldExecution", "GetVolumePathNamesForVolumeNameW", "LayoutUsb: OCDUS blob [%s] does not exist", "505b5z5", "191023231918Z", ">E>L>g>", "\\ProgramData\\Microsoft\\Windows", "chr-Cher", "lectionner un transport r", "111019184142Z", "0o04x", "Af;H(s", "3@3]3d3l3", ".rdata", "D$pSVW", "BiCreateBootEntry: Could not retrieve BCD Object application device. Status: %x", "EsdLayout: Closing ESD file (with verify)...", "Params->fRequireUtf8", "Failed to set registry data for element %s. Status: %x", "P0d0o0", "CryptSetKeyParam", "CDlpActionWimLayout::WimLayoutExportImage", "ServiceSpaces: %s does not exist", "Failed to convert data for element %s. Status: %x", "D$$;D$Tw'r", "Closing store. Flags: 0x%x", "DeleteFileEx: hardlink given to us is: %s", "SPBUILD", "L$49L$,w}r", "RecoverCrypto: Initializing Crypto Key [%s]", "L$$9t$ t", "quz-EC", "0k1r1", "hlt werden, bevor eine Datei zur ", "WimLayout: Exporting MediaBoot WinPe image to [%s]...", ":$:<:C:", "ca-ES", "ZwQueryDirectoryObject", "9w:D;{;", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteEscapedString", "sz.%0", "WimLayout: Failed to load setup.exe module from x86 layout path. LastError=[0x%X]", "CreateSemaphoreW", "CDlpTask::EnqueueAction", "CDlpTask::GetIndex", "CDlpTask::GetActionFriendlyName", "t&9Z$t!", "jHh@b", "WimSetSecurityDescriptor", "RtlFreeHeap", "tiPQP", ";B > > >::CheckInitialized", "ExportHash", "9h9o9}9", "|DEST|\\bootspaces.dll", "qsort", "si adatokat.%0", "DestinationMaximumLength >= SourceLength", "0f0D0", "1!1e1", "CDlpTask::SendCallbackMessage", "Too many unexplained failures. File: %s Last status: %x", "o foi inicializado.%0", "t4f97t", "CDlpActionImpl > > >::ExecuteRoutine", "RtlWriteDataIntoSmartLBlobWritingContext", "748y8", "0L0B0", "=X=s=", "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength", "Failed load key %ws. Flags: 0x%x File: %s Status: %x", "en-NZ", "memcmp", "AddAccessAllowedAce", "chr-Cher-US", "Translated a DontSync object to ID 0x%x", "sl-SI", "9A9d9n9}9", ";P<\\-?", "4$4,444<4H4h4p4x4", "9/9B9I9P9W9", "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x", "rjats.%0", "DefaultAttribute.Allocate()", "VWj 3", "BitsExecute: Suspending BITS job at user request.", "7/8_8i8", "3*4C4z4", "The per-block repair retry limit has been exceeded. The file is corrupt.%0", "FH;A8", "GetFileStorageTierClass", "3#4e4", ">E?l?", "De aangevraagde bewerking is niet gestart.%0", "?&?z?", "ller avbildningen f", "install*.swm", "394f4", "LANGUAGE", "GetEnvironmentVariableW", "030S0a0", ";P;W;", "5F5S5.6C6I6", "Den anmodede diskenhed er for stor for FAT32-filsystemet.%0", "ReadEncryptedFileRaw", "TmpNodes.Resize(cNecessary)", "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x", "3,434", "GetVolumeInformationW", "Aucune cl", "WinHttpConnect", "Den angivna disken ", "CDlpTask::GetTransferProgress", "QQQPQQj", "D$(;t$\\r", "CDlpTask::Resume", "en-ID", "::BUCL::Rtl::Add( cElements, 10, NewCapacity)", "7#797", "WimDetermineImages: Install index: [%d], Install count: [%d]", "", " WIM-", " pronto.%0", "3_^[]", "tij:V", "lem ba", "LocalAlloc", "sma-SE", "OLEAUT32.dll", "$0,050K0Z0", "CryptGenKey", "9\\$0t]", "sources\\FP", "636@6J6", "8-9=9Q9]9h9", " obecnie w kolejce.%0", "3!3B3e3", "849N:", "\\ArcName\\multi(0)disk(0)rdisk(1)", ":?:T:i:p:", "CDlpTransportBits::GetTransportId", "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!", "DeviceIoControl", "Failed to get decoder context", "%ws.{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}", "6 6,686D6P6\\6h6t6", "DeleteTaskByName: Error serializing state! [0x%x]", " Microsoft Corporation. Todos os direitos reservados.", "GetMetadataPadding", ">2?m?", "8/8~8", "qps-Latn-x-sh", "7%7<7Q7u8", " BitLocker.%0", "RtlInitializeResource", "[%s:(%d) -> %s] %s", "5!5O5k5", " et volum p", "Failed to set directory extended attribute", "Not wiping disk because it contains BitLocker encryption.%0", "O trabalho BITS est", "WIM\\TOTALBYTES", "RestoreDirMetadata: RestoreFileStorageTierClass failed", "sv-FI", "%s: Leaving Execute Method", "RecordFileDataLocation", "WimParseHexString", "3R4Y4", "CDlpActionLayoutUsb::SerializeRoutine", "?#? >,class CDlpActionLayoutIsoFactory,class CDlpActionLayoutIso>::SetActionId", "CryptEncrypt", "en-JM", ":7:N:", ";B;v;l<", "en-BZ", "n solicitada ya est", "171B1k1u1", "CDlpManager::CreateAction", "Bir dosyan", "NMTOKEN", "MultiLayout: Initializing CleanTargetPath: [%s]", "RecoverOem: Creating partition on disk [%d] at offset [0x%I64X]", ";1<8pBasicNode != 0", "_amsg_exit", "R\\Oir", "m kald", ":v:|:", "?J?T?", "WIM_FileData_Queue_Length", ">!?'?k?y?", "4I4k4", "4Z5r5", "1!2P2w2", "Bits Error: Unable to obtain IBackgroundCopyFile2 interface, hr = [0x%X]", "7J8n8", "ngen wurde ", "2<2Y2c2", "]_cOW", "CDlpTransportBits::UpdateState", "WWPWWWW", "jHXPj", "Microsoft", ";7v>", "windlp.state-old.xml", "#rSPo", "PVj@Z", "FindNextFileW", "383p3", ">2>L>Y>w>", "zh-SG", "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x", "ResolvePartitionTypeToCreate: %s: disk %d is of an unknown type and is on an EFI computer; assuming %s setting wants to create GPT basic data partition", "en-IN", "='=.=>=E=Y=d=r=", "8e8r8", "646;6", "chiffrement requis.%0", "CDlpActionLayoutUsb::CopyBootFiles", "fy-NL", "CDlpTask::GetActionInterfaces", ">#>*>F>m>", "CBasicNodeType::ChangeNamespace", "D$,_^[3", "g pr. blok er overskredet. Filen er beskadiget.%0", "L$hQS", "202F2c2k2r2}2", "Create", "om-ET", "\\Windows\\System32\\", "BitsExecute: Resuming BITS job at user request.", "Failed to open file attributes. Status: %x", "CreatePartition: Got invalid offset of 0", "q@hLN", "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8", "CreateParallelDecodeInfo", ";(;H;P;X;`;h;p;x;", "RestoreDirTree: WimImageCreateFile failed", "QQSV3", "=B=V=]=l=", "taj=R", "?#?0?R?l?", "t!VVSW", "2,292U2", "=*=7=c=n=", "QSVW3", "\\??\\%c:", "NewComment = this->AllocateStreamObject()", "u6WPj(", "6#747V7", "ProcessSecurityData", "de-LI", "=7=R=", "6,6B6M6V6]6h6z6", "Il file WIM specificato non contiene i dati di decrittografia richiesti.%0", "lb-LU", "RtlIsLBlobValid(Source)", "kkel ble oppgitt for ", "708_9", "CDlpTransportBits::GetParameters", "USER32.dll", ">6>N>o>", "WimBoot capture failed because the format of wim file is not compatible!", "t*QVjd", "Windows-Downloadplattform", "2?3Y3_3g3", "3(4L4b4", "RestoreDirMetadata: RestoreFileInfo failed", "WIM_Enumerate_Directory_Reparse_Point", "rm-CH", "0\\0b0l0", "CDlpActionImpl > > >::GetActionId", "dana operacja nie zosta", "Ein Netzwerktransport muss ausgew", "CountChunkedByteCallback", "7I8P8d8j8v8", "RestoreMountStub", "EXFAT", "towupper", "CDlpTask::Pause", "6,6?6H6S6", "3#3<3_3m3", "n OEM porque contiene archivos del sistema.%0", "CDlpActionLayoutUsb::GetMaxFileListSize", "KERNEL32.dll", "GetDriveTypeW", "Insufficient resources for multithreaded chunked decoding; will skip!", "mn-Mong-MN", ";P;\\;g;", "t(9\\$", " zawieszona.%0", "lemiyor.%0", "smj-NO", "< X>", "Soubor ve zdrojov", "!~<9~@t", "WIMApplyImageInternal", "CDlpActionRecoverCrypto::GetEncryptedRangesFromWim", "Resuming BITS job due to caller request.", "CopyFileExW", "ZwSetSecurityObject", "SVWj8j", "m_PropertyCache.Allocate(m_LayoutCache.TotalObjectCount())", "", "738[8b8u8", "CDlpActionImpl > > >::PrepareRoutine", "?Z?c?", "677B7P7", " byla pozastavena.%0", "CDlpTransportBits::UpdateFileProgress", "|SOURCE|\\|RESOURCES|", "WIMWriteFileWithIntegrity", "o solicitada j", "Pj2jl", "UncompressFileBase", "7,8r8", "<61", "MicrodomWriterImplementation::CMicrodomWriter::CreateInterface", "sr-Latn-RS", "hr-HR", "DllMain", "RetryCount", "UTF-8", "T$@j[P", "NtQueryDirectoryObject", "=$=&>->;>", "< <@F>", "9D$4r", ">4?G?", "CDlpTransportBits::Suspend", "4 4'4;4F4T4q4", "CreateTask: Name = [%s], WorkingPath = [%s%s], TransportId = [%s], Flags = [0x%X]", "install.esd", "000U0u0", "-besturingssysteem", "rv.UcsCharacter < 0x110000", "1W2^2", "RestoreRefNode", "CDlpTransportImpl > > >::CheckUserInterrupt", "WimLayout: Initializing Layout Path: [%s]", "BITS-jobbet ", "stat. failed", "en-MY", "CMicrodomBuilder::WriteXmlDom", "GetFileVersionInfoExW", "ger ist zu klein.%0", "ar-OM", "=N>R>V>Z>^>b>f>j>n>r>v>z>~>", "RtlIsLUtf8StringValid(NamespaceURI) || (NamespaceURI == 0)", "lem zaten ask", "State", "Failed to get system store path. Status: %x", "S(_^[", ":7?>?", "nitialiseerd.%0", "CDlpActionLayoutIso::InitializeRoutine", "CMicrodomUpdateContext::CreateVirtualComment", "PRh F", "letim Sistemi", "9r:2;@;l;z;", "RtlCreateDefaultMicrodomXmlWriter", "Not-null check failed: pfnDecode", "Found loaded store at key %s", "t49C8u", "j?Yf97tQ", "WimCloseImageFile", "8VWh`'", ">M?X?j?{?", "QuadwordProperty", "1v2~2", "RemoveDirectoryW", "PSSSSSSSj", "ger befindet, Dateien vorhanden sind.%0", "En nettverkstransport m", "Waiting for transfer thread to exit.", "8-8:8i8", "=E=Y=}=", "CreatePartition: Requesting creation of partition with { offset = [0x%I64x], size [0x%I64x] }", "_TmpHive_", "030M0Z0x0", "id-ID", "9%9Y9", "2<2l2", "!fExisted", "GetFileInformationByHandle failed", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", ":/;O;Z;k;", ";Wa>w>", "CDlpActionLayoutUsb::PopulateOemPaths", "6[6b6i6p6w6", "sr-Latn-BA", "Schijf wordt niet gewist omdat een volume op deze schijf bestanden bevat.%0", "Nie podano klucza do odszyfrowania okre", "Balayage du disque impossible, car des fichiers se trouvent sur un volume r", "HashType", "zati ", "_except_handler4_common", "NtTranslateFilePath", "536:6J6r6|6", "4G4o4", "CDlpActionImpl > > >::Pause", "BUCL::Rtl::Multiply(WorkingBufferSize, MultiplicativeGrowthFactor, WorkingBufferSize)", "5G5_5j5", "P@SJX", "wo-SN", "la-001", "t#j\\Q", "NtOpenThreadTokenEx", "EFI\\Microsoft\\Boot\\Policies", "\\WINNT", "RestoreRefNodeCallback", "rrelse p", "xmlns", "2$2,242<2D2P2\\2d2l2x2", "WimDetermineImages: WinPE index: [%d]", "Den angivne handling er allerede blevet annulleret.%0", "GetSecurityDescriptorDacl", "CDlpActionLayoutUsb::SplitProgressWorker", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length", "\\system32\\winpeshl.exe", ":(;I;|;", "728T8^8", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocument", "<&<+ > > >::CheckUserInterruptEx", "l nagy a FAT32 f", "WPWPQ", "t1VPQ", "7+888)9Y9", "Fonts", "CDlpTransportHttpFactory::GetTransportCount", "EsdLayout: Closing ESD file (without verify)...", "~>", "whichElement != Windows::Microdom::Rtl::Element::InvalidValue()", "r en fil kan legges til for overf", "Der angeforderte Vorgang wurde bereits abgebrochen.%0", "1'141`1{1", "=&=s=", "h0W0f0", "MicrodomImplementation::CDomPositionCache::AttachToPositionList", "SendCallbackMessage: [0x%X] -> Cancel request returned 0x%X", "Failed to validate boot manager checksum (%s)! Error code = %#x", "SVWhP", "strncpy_s", "WaitForMultipleObjects", "8*8c8", "8I9P9^9v9", "tESWV", "7 8N8d8k8", "3*3I3P3e3", "ZwQueryValueKey", "596j6v6", " disken fordi den inneholder BitLocker-kryptering.%0", "CreatePartition: Failed to get property and partition count for disk %d, hr = 0x%x", ";6/>X>_>}>", "LayoutUsb: Copying file [%s] to [%s]...", "(Flags & ((0x00000002) | (0x00000004))) != ((0x00000002) | (0x00000004))", "RestoreFileMetadata: RestoreFileInfo failed", "<26?T?", "Wim Capture: Creating target WIM file: [%s] (without verification)...", "LayoutIso: Deleting ISO file due to error: 0x%X", "nb-NO", "5A5k5", "lo-LA", "Failed to lookup privelege! Error code = %#x", "es-BO", "Not-null check failed: Source", "malloc", "o pedida n", " kildeplaceringen er for stor for FAT32-filsystemet.%0", "6P7^7t7", "QQVW3", "Pyydetty asema on liian suuri FAT32-tiedostoj", "229879+4583620", "Substitue name string copy failed", "o pedida detetou um erro.%0", "rios.%0", "RtlReallocateLBlob", "9C9Y9d9", "Failed to enumerate boot entries. Status: %x", "5@5G5u5", "L$D_^[3", "WIM\\ESD\\ENCRYPTED\\RANGE[*]", "CDlpTransportBits::Pause", "LocalSize failed", "BfspPrintFileOwnerProcess: Failed to open file!Last Error = %#x", "1$1D1L1X1x1", "BcdCloseStore: Failed to acquire BCD sync mutant. Status: %x", "ration demand", "CMicrodomBuilder::ConsumeAttdef", "Failed to delete \"%ws\" variable. Status: %x", "7\"7s7", "wcsstr", "EsdLayout: Initializing ESD Path: [%s]", "bootx64.efi", "GetFileVersionInfoW", "ZwReleaseMutant", "OCDUS\\Policies", "Um transporte de rede deve ser selecionado para o arquivo ser adicionado para transfer", "CDlpManager::SetThreadPriority", ">2>8>O>V>", "CMicrodomBuilder::CFourStringIdTable::Initialize", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateElementNs", "L'oggetto azione specificato non ", "Error copying boot debugging files from %ws to %ws (%ws). Last Error = %#x", ">&>G>", "BitsTransport: Leaving Execute Method", "? ?f?m?", "CDlpTransportImpl > > >::Pause", "Operativsystemet Microsoft", "Sistema Operacional Microsoft", "Az OEM-part", "system32\\recovery\\$PBR_ResetConfig.xml", "D$8SVW", "Waiting for prepare thread to exit.", ":#:w:", "es-CL", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect\\Cache", "LayoutPath", ":$;+;F;M;w;", "yKVh_", "HeapFree", "Windows Dlp Manager", "swscanf_s", "ConnectToSourceUrl: Using existing WinHttp connection...", "WriteFileImage", "2E2z2", "D$ SVW", "CDlpTransportBits::Deserialize", "Failed to add system store from file. File: %ws Status: %x", "0x%08X", "kok-IN", "x@S-N", "CreateFileMapping(%s) failed! Error code = %#x", "fr-CA", "0\\1`1d1h1l1p1t1x1|1", "CDlpTransportImpl > > >::Deserialize", "DOCTYPE", "ChunkWriterFlush", ">0>C>W>", "ole32.dll", "0*0=0", "CDlpTask::GetError", "Failed to get system partition. Status: %x", ":D:h:", "wcstok_s", "CDlpTransportImpl > > >::Execute", "5\"505O5p5}5", "0I0N0Z0", ";bulSignature == ('tDdM')", "RtlXmlDefaultCompareStrings(&m_State.ParseState, Left, Right, pResult)", "jlban l", "1.181F1O1", "j.[SV", "CheckProcessFile", "DosDateTimeToFileTime", "%s\\Partition%lu", "No se puede quitar la partici", "6d7_8r8", "FormatPartition: Re-setting original OEM partition type (lost during format)...", "5 6C6e6", "ur-PK", "7N8x8", "CDlpManager::DeleteStringProperty", "L$<_^[3", "ar-EG", "m_StoredTable.FindOrInsertIfNotPresent(Pair, pAttDef)", "658P8y8", "CDlpManager::CreateDlpFile", "El tama", "CDlpActionImpl > > >::Serialize", "fr-SN", "en-ZW", ">7>Q>c>", "Microsoft Corporation1", "Belirtilen eylem nesnesi ba", "GetDisk: Finished querying VDS providers.", "n solicitada detect", "ReorderContextInsert", "Not-null check failed: Context", "CDlpWimCapture::CreateWimForSplitCapture", "96:J:T:", "NtQueryEaFile", "0P1Z1w1~1", "rjestelm", "Le dimensioni di un file nel percorso di origine sono troppo grandi per il file system FAT32.%0", "shelyen tal", "[2g2t2", "=X=q=", "4/454X4x4", "CDlpActionImpl > > >::GetActionName", "TotalBytes", "lem tamamland", "SYSROOT", "=#=6=", "858A8I8m8}8", ":5;U;b;", "7<8z8", "CDlpActionWimLayout::ActionLayoutToEsd", "D$ ;D$Ps", "7 7(747T7\\7d7p7", "iu-Latn", "tzm-Tfng-MA", "1-1c1q1", "Prima di aggiungere un file per il trasferimento, ", "IDREF", "BcdCopyObjectEx: Failed to set firmware object. Target: %ws Flags: 0x%x Status: %x", " suspendue.%0", "9X9\\9`9l9", "2!2x2", "2M3b3", "ka-GE", "Transfer thread has exited.", "ller systemfiler.%0", "Wim Capture: Skipping [%s] because access was denied", "Not-null check failed: BytesRequired", "9F9\\9", "O objeto da a", "SetSysVolInfoPath", "lonego pliku WIM.%0", "::CreateInstance", "WINDLP_BITS_PRIORITY_FOREGROUND", "EsdLayout: Initializing Layout Path: [%s]", "m haklar", "cs-CZ", "CDlpActionLayoutUsbFactory::CreateInstanceRoutine", "6\"7)7m7t7", ". Soubor je po", "2A2|2", "Failed to set file extended attribute", "BitsCancel: Cancelling interrupted BITS job due to caller request", "CDlpTransportImpl > > >::Cancel", "=R>a>h>z>", "WimAtExitInitialize", "rvarande placerat i k", "6,646<6D6L6T6\\6d6l6t6|6", "CDlpActionWimLayout::ActionMediaToLayout", "CDlpRegistrar::CreateAction", "WimMatchImageCriteria: Comparing image [%d] value [%s] against [%s]", "NewChild->Attribute.Allocate()", "CMicrodomBuilder::ConsumePCData", "1(1/1B1I1Y1v1}1", "Wait for work queue failed!", "4:5A5", "1(141@1L1X1d1p1|1", "3o4|4", "D$(Pj", " WIM-tiedostossa olevan avaimen salausta ei voi purkaa.%0", "0", "RtlXmlInitializeNextLogicalThing(this, &Init)", "WimAtExitReserve", "CDlpRegistrar::RegisterActionFactory", "DeleteSource", "Failed to get img event", "<$<3<< > > >::Prepare", "OEM-partitie wordt niet verwijderd omdat deze systeembestanden bevat.%0", "BCryptOpenAlgorithmProvider", "LayoutIso: Specified boot file [%s] is missing!", ":]:d:q:x:6;=;", "CDlpActionRecoverCryptoFactory::CreateInstanceRoutine", "FveGetAuthMethodInformation", ";&;+;6;N;q;~;", "9J9u9", "CDlpManager::GetPriority", "System store path: %s", "PL0g0M0f0D0~0[0", "CDlpActionFactoryImpl >,class CDlpActionRecoverCryptoFactory,class CDlpActionRecoverCrypto>::GetActionId", "Wim Capture: Lost underlying device handle. Retrying in [%u] ms", "i prov", "D$ T-", "Die angegebene WIM-Datei enth", "546?6M6x6", "9':;:F:k:", "5/6@6G6[6", "Not-null check failed: DocumentNode", "5:5[5x5", "Fail to flush file buffers", "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c", "D$6", "4D7]7j7", "Den forespurte operasjonen er allerede stoppet midlertidig.%0", "2#2>2E2T2l2", "WimSplit: PartPath: [%s], PartSize: [0x%I64X]", "?4?R?w?", "Impossibile decrittografare la chiave nel file WIM specificato.%0", "O>o>", "cannot read WIM header", "Failed to open description key for store. Store: %s StoreKey: %ws Status: %x", "4:4l4", "MicrodomImplementation::CDomLayoutCache::FindObject", "787s7", "BitsTransferFile: Cancelling BITS job due to error: 0x%X", ";)AllocateStreamObject()", "RestoreFileDataCallback", "bootmgr", " oper", "BfspPrintFileOwnerProcess: Failed to acquire debugprivilege", "WIM\\IMAGE", "0<1P1[1", "ret t", "7/8X8p8", ":C:^:", "ServiceDebuggerFiles: ConfigBuffer is too small", "CompressCaptureNode", "WimPathX86", "NtOpenDirectoryObject", "3-383p3", "444F4", "8A9Y9", ">(>F>S>]>+?H?[?b?n?", "RtlIsLUtf8StringValid(TagName) || (TagName == 0)", "CompressChunk", "CDlpActionLayoutUsb::PrepareUsbMedia", "WIMSplitFileWorker", "CurrentBuildNumber", "WindowsSysPartDevice", "%ws\\%ws", "ceQGO", "9F9`9k9", ">1>A>k>", "sources\\vista", "<2<95E5v5&6@6Y6", "", "CDlpTransportImpl > > >::CheckUserInterruptEx", "DlpTask: Skipping action progress reset due to task cancellation request.", "ZwSetBootOptions", "7H8g8n8u8|8", "0&0_0", "CXmlCursor::XmlAlloc", "CDlpManager::GetStringPropertyCount", "QVPWj", "onecore\\internal\\base\\inc\\rtlstringutil.h", " stata avviata.%0", "919R9h9u9", "CDlpManager::GetWorkingPath", "DwordProperty", "ms-MY", "GetFileVersionInfoSizeW", "WimInitXmlInfo", "CDlpTask::ExecuteTransfer", "TransferFile: TransferFileWorker failed, hr = [0x%X]", "BUCL::Rtl::Add( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)", "SetPartitionType: The request to set type id and partition specified are both MBR format.", "K{m [%s]", " BitLocker-salauksen.%0", "TaskCount", " sendo cancelada.%0", "3'4A4|5", "7$7,747<7D7L7T7\\7d7l7x7", " Microsoft Corporation. Alle rechten voorbehouden.", "?A?d?", "WriteEncryptedFileRaw", "777O7w7", ";d;~;", "StringId < m_Entries.Length", "899R9}9", "ZwTranslateFilePath", ">&>O>e>p>", "BcdGetElementDataWithFlags: Failed to open elements key.Object: %ws Status: %x", "GetSecurityDescriptorSacl", "jHh-N", "j\\[f;\\A", "R!s4Z", "9X`v^j", ">4>A>U>c>", ":9:O:V:i:", "Not-null check failed: Root", "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...", "bitlocker ", "BITS i", "6/6X6d6o6", "BitLocker ", "GetFileAttributes(%s) failed! Last Error = %#x.", "et-EE", "Setting element %08x", "575K5V5", "LayoutUsb: Path [%s] not found!", "C;X`s", "bo-CN", "4!414C4W4", "PPPPPPV", "RestoreSecurityDescriptor", "RegEnumKeyExW", "d\\O|v", "6$6+6", "FileSplitSize", "2%21282p2", "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x", "|EFIDEFAULT|\\|DEFAULTAPP|", " Microsoft Corporation. T", "OEM-partitionen tas inte bort eftersom den inneh", "2;2E2o2y2", "dvendige dekrypteringsdata.%0", "6(7J7m7w7", "RecoverOem: Extending the system partition failed! hr = [0x%X]", "9\\$$v", "CDlpManager::CreateTransport", "2O3^3", "CDlpRegistrar::GetState", "979D9Q9", "Failed to enumerate subkeys. Status: %x", "ConnectToSourceUrl: Using IE proxy settings...", "CMicrodomBuilder::Initialize", "ExportResourceCallback", "Transfer: %d%%, Totals: %0.2lfs, Bytes: %0.3lfMB, Rvg: %0.3lf Mbps, Tvg: %0.3lf Mbps", "CryptoKey", "EsdLayout: Opening boot wim: [%s]", "bootarm.efi", "FBf;E", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::BeginOpenElement", "ExportContextCopy", "0(181L1S1p1w1", "PPPPV", " mise en pause.%0", "7]7j7", "='>.>", "lony dysk nie jest gotowy.%0", "fr-RE", "GetOverlappedResult", "sources", ":8;?;N;d;", "l OEM nebyl odebr", "1&131:1b1i1w1", "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)", "CBasicNodeType::EncodeLUtf8String", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute", "CDlpActionWimLayout::ProcessImageFile", ";';4;;;F;^;e;u;|;", "MicrodomImplementation::CDomLayoutCache::DecodeElementCounts", "NtClose", "t$ WV", "LayoutUsb: Initializing OEM AutoApply Directory: [%s]", "<'=-=W=", "6A6k6", "TlsSetValue", ";8;T;`;w;", "2$2,242<2D2L2X2x2", "2L3V3w3", "CDlpTask::NotifyActionStateChanged", "UuidToStringW", "false", "0*050", "1)151j1~1", "=D=V=]=g=", "SVWj2", "_onexit", "G^{P&a", " annullata.%0", "\\\\?\\GlobalRoot", "3?4k4x4", "Objects", "%s", "jHXPd", "Limite de repeti", "SetPartitionType: ChangePartitionType failed, hr = 0x%x.", "stenen birimin boyutu ", "@kon|", ";o;w;", "!|$<9}", "8#949^9v9", "LayoutIso: Initializing BootFile Path: [%s]", ">\"?t?", "=d>z>", "lges en netv", "CheckBitLocker: Volume [%c:] -> FVE Flags: [0x%x]", "bs-Cyrl-BA", "L$,;L$ ", "WimLayoutExportImage: Exporting image index [%d]", "CDlpTask::UpdateState", "4 4$4(4,40484D4P4\\4h4t4", ";\";3;:;S;`;", "%s, DLPLOG: [0x%X] [%s] [%s]", "tzm-Latn-DZ", "File %s is too large!", "$`2X`F", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART", "4[5i5", "M0K0I", "LayoutUsb: A volume on disk [%d] contains data. Aborting operation.", "GetFileVersionInfoSizeExW", "BootNext", "263@3X3^3o3", "ZwUnloadKey", "ZwQueryKey", "8W8u8", "n solicitada se est", "@tZ9}", "CDlpActionImpl > > >::Prepare", "rden avbryts.%0", "|SYSPART|\\|EFIDEFAULT|\\|DEFAULTAPP|", "LookupPrivilegeValueW", "MediaLayout: Initializing PreserveExistingFiles: [%s]", "Servicing debugger files", "5F5`5m5", "u%jXh", ".edata", "5L6Y6`6", "multi(%d)disk(%d)rdisk(%d)", "WimLayout: ESD package info: Flags: 0x%X, CompressionType: %d, BootIndex: %d", "Verkkosiirto on valittava, ennen kuin tiedoston voi lis", "TempElements.Allocate(NewCapacity)", "GetFileInformationByHandleEx", "Plataforma de Download do Windows", ": :@:H:P:\\:|:", "9{:Z;", "0~0Y0", ";YV>d>", ".00cfg", ":9:j:t:", "?:?e?|?", "MultiLayout: Initializing Wim Path X64: [%s]", "Resetting rolling average list.", "he-IL", "151<1G1", "RSA1Q", "image de r", "WjpVP", " Microsoft Corporation. Tous droits r", "Den angitte WIM-filen inneholder ikke de n", "PSSSSSSh ", "F;w$r", "WinHttpOpenRequest", "0?F?k?", "ar-TN", "::RtlIsLBlobValid(Data)", "nl-NL", "ConnectToSourceUrl: IE specifies auto-config URL.", "dv-MV", ":>;L;b;", "2(2H2P2X2`2h2p2x2", "umSSSjdQ", " a ser cancelada.%0", "3+424A4H4p4w4", "=F=S=Z=", "WinHttpQueryHeaders", "CompressionFolderList", "4<4D4L4T4\\4d4l4t4|4", "CDlpTransportImpl > > >::SetParameters", "hsb-DE", "CDlpTransportHttp::PrepareRoutine", "CDlpRegistrar::GetActionFactory", "CDlpManager::TraceData", "tDj0j", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual", "sources\\recovery\\old", "_ultow_s", "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%", "?'?H?f?", "CQn04X@bk0B0", "96:A:b:w:", "|SYSROOT|", "363J3", "CDlpTask::ExecuteAction", "4/5D5[5b5v5~5", "CDlpTask::Serialize", "arn-CL", "5$505<5H5T5`5l5x5", "o do Windows.%0", "L$T_^[3", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::CloseElement", ":6:C:", "EnumImageDataEntries", "wH9\\$", "WimDetermineImages: Layout index: [%d]", "NtSetEaFile", "jHh*g", " en pausa.%0", "Description", "CDlpTransportBits::Cancel", "iu-Cans-CA", "\\EFI\\Microsoft\\Boot\\bootmgfw.efi", "tt.%0", ">#>*>V>]>n>u>", "324m4", "1P1y1", "Element", "WPVhx", ".CRT$XIZ", ":=:D:K:R:W:p:z:", "pToRemoveFrom->Element != 0", "E0r0Q1~1", "9t$Pt", "0F0b0v0", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteProcessingInstruction", "NtOpenSymbolicLinkObject", ";* >,class CDlpActionLayoutUsbFactory,class CDlpActionLayoutUsb>::CreateAction", "#9s0t", "WimBootCompress.ini", "SetFilePointerEx", "PreserveExistingFiles", "WimLayout: Checking ESD target path: [%s]", "4+4H4o4", "sk-SK", "?1?8?h?o?", "7+787U7h7", "vel desencriptar a chave no ficheiro WIM especificado.%0", "3$3+383?3F3", "AddFolderToImage", "RecoverCrypto: Initializing DeleteSource Value: [%s]", ":MdSpt", "es-CO", "CryptDestroyKey", "RestoreFileMetadata", "7&717L7", "The requested operation has not started.%0", "CopyDirectoryEx2: Specified directory [%s] doesn't exist", "CDlpActionWimLayout::CreateMultiArchBcdEntries", "4+464O4", "?M?T?", "No se puede borrar el disco porque contiene cifrado BitLocker.%0", "9Kdt_", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNS", "config", "2>3u3", "CDlpTransportBits::CleanupPath", "8+828?8F8K8Y8x8~8", "2O2n2x2", "0a3y3", "Not-null check failed: fHasAttributes", "El archivo WIM especificado no contiene los datos de cifrado requeridos.%0", "3)353H3U3r3", "t$T+t$", "? ?(?0?8?@?H?T?t?", "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem", "onecore\\base\\xml\\udom_xmlwalker.h", "LocationHeader->Signature == ('cLdM')", "GetFileAttributes(%s) failed: File not found.", "tTf97tO", "Loaded hive at BCD%08d", "ImpersonationCountInit", "_vsnwprintf", "3E3V3]3", "GetSysVolRefNodePath", "3 3<3@3H3L3T3X3t3x3", "O tamanho do volume solicitado ", "A;K$r", "4=4K4d4", "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT", "1A2H2", "WIMCAPTURE_SPARSE", "01282", "LdrAccessResource", "CDlpActionWimLayout::ActionEsdToLayout", "4'5.5<5", "LayoutIso: Initializing Layout Path: [%s]", "jl megs", " on ylittynyt. Tiedosto on vioittunut.%0", "RtlExpandEnvironmentStrings", "Failed to export unload alterations to firmware. Status: %x", "LayoutUsb: Successfully opened source file for simple splitting.", "RecoverOem: Automatic file system selection: [%s]", "u+jKh", "9]:g:", "9D:K:S:m:", "ProcDirEntry", "454M4^4i4", "LayoutUsb: Leaving volume label blank!", "000W0e0l0", "CreatePartition: Failure while waiting for partition creation; hr = 0x%x, hrWait = 0x%x", "727@7`7w7", "Not-null check failed: NodeList", "8\"8w8", "050a0", "Belirtilen WIM dosyas", "en-029", "CMicrodom", "\\Device\\%s\\Partition%lu", "iswalpha", "Wim Capture: Reopened WIM handles successfully", "QQSVWh", "rda volymstorleken ", "4*5`5", "Wim Capture: Successfully reopened WIM file.", "Harddisk", "D$d9C", "><>R>Y>3?:?", "0*1^1", "EncodingSizer != 0", "Not-null check failed: pUpdateCookie", "CDlpTransportImpl > > >::CleanupPath", "xHj1^", "ar-SY", "+q{-50", "93:;:K:N;^;e;z;", "CDlpTransportBits::Resume", "PrepareFile: Content-Length=[%I64u]", "<4<<5>u>", "Il disco specificato non ", "FindClose", "FltCommStubRename", "CDlpActionImpl > > >::Resume", "CMicrodomBuilder::CFourStringIdTable::Initialize", "0MRk0", "<+<\\<{<", "TreatAsSystem", "WINDLP_BITS_PRIORITY_HIGH", "282?2w2", "BCryptCreateHash", "CDlpActionRecoverCrypto::SetProgressRange", "onecore\\base\\xml\\isolib_parser.h", "VPQQQ", "Prepare thread has exited.", "Failed to enumerate subelements. Status: %x", "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)", " Microsoft Corporation. Alle rettigheder forbeholdes.", "CDlpTransportImpl > > >::Serialize", "The requested volume is too large for the FAT32 file system.%0", "W93uH3", "Nie mo", "\\O#]`", "9KdtL", "BitsTransferFile: Suspending execution at user request.", "7(7r7", "=H=i=", "3<3R3[3e3t3~3", " in coda.%0", "standalone", "w QSW", "Den angitte disken er for liten.%0", "jH^VR", ";/;F;S;", "0 181N1Y1", "NtSetCachedSigningLevel", "AddCompressedFileToImage", "Customizations", "CDlpTask::ExecuteActions", "NTFS ", "7I7T7", "0$0,040<0D0L0T0\\0d0l0x0", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface", "WriteDataCallback", "CoTaskMemFree", "474N4h4", "fFound", "FONTS", "NOTATION", " Windows", "RtlGetThreadErrorMode", "2%2J2", "BITS ", "Deleting element %08x blocked by secure boot policy.", "Der skal v", "j YWPS", "RtlImageNtHeader", "*41;D$TotalCount)", "G`h`b", "WinHttpOpen", "RestoreFileMetadata: RestoreHardlinks failed", "StringCount", "_^[+P", "1I1c1", "\\??\\PhysicalDrive%d", "Sleep", "1H2q2", "RegEnumValueW", "9X\\t93", "Windows Download Platform", "0Z0D1Y1", "Sources", "CDlpActionImpl > > >::DeserializeRoutine", "CDlpWimCapture::CreateNextSplitCaptureWim", "L$ ;L$$r", "(NewName == 0) || RtlIsLUtf8StringValid(NewName)", "=:>A>3?P?W?", ";D$g>{>", "%windir%\\system32", "ExportPartialChunkedPortion", "SumPSQR3", "jlrendszerhez.%0", "Windows Nedlastingsplattform", "br-FR", "CDlpTransportBits::GetBitsJobStateString", "7/8`8", "nsen f", "CDlpActionImpl > > >::InitializeRoutine", "ga-IE", "RecoverCrypto: Initializing Hash Type: [%u]", "j?Xf;", "bn-BD", "4&4`4z4", "Exporting store alterations to efi", "(SourceCount == 0) || (Sources != 0)", "SL0+T~0", "C\\;G\\u", "NtQueryInformationFile", "CDlpActionWimLayout::MultiInitialize", "Failed to allocate process ID buffer.", "Wim Capture: Seeding WIM with an empty image [%s]", "#,|6d", ".CRT$XIA", "NDATA", "Velikost po", "Grensen for oppf", " Windows ", "tIVS3", "::RtlIsLUtf8StringValid(String)", "zh-CN", "TlsAlloc", "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.", "G QQVP", "VirtualFree", "CDlpActionLayoutUsb::InitializeRoutine", "2+323", "4<5c5", "es-PY", " den h", "FindFirstFileW", "ConnectToSourceUrl: IE specifies auto-detect.", "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]", "CDlpActionImpl > > >::Cancel", " soubor p", "9Q:X:", "LayoutUsb: Source directory size -> [%I64d] bytes", ">)>9>B>S>Y>_>e>k>q>x>", "ResolvePartitionTypeToCreate: %s: disk %d is a RAW disk on an EFI computer; assuming %s setting wants to create GPT basic data partition", "=#=G=Q=f=m=u=", "344S4", ";';g;", " en volym p", ";D$4uV", ".text$di", "u6VVh", "strcpy_s", "'", "Den anmodede handling er allerede stoppet midlertidigt.%0", "CDlpFile::GetName", "CDlpActionWimLayout::InitializeRoutine", "0,1s1", "Failed to query processes. Status: %x", "C QRRRRR", "A rendszer t", "IMAGE\\DESCRIPTION", "Fjerner ikke OEM-partisjon fordi den inneholder Windows-gjenopprettingsavbildningen.%0", "2#262=2P2W2j2q2", "az-Latn", "1#2=2R2\\2", "3 3`3", "SetThreadPriority", "se-FI", "Not-null check failed: Out", "Copying font files from %s to %s...", "terst", "WinHttpSetOption", "tRVVj", "StorageTiering not supported", "pl-PL", "CreateDlpFile: Source = [%s], Target = [%s]", "moh-CA", "2=3{4", "BootDebuggerFiles.PCAT", "G$9G t", "DlpTask: Resetting transport progress start time.", "455J5`5", "? ?>?", "toj@j", "0\"0U0", "ZwEnumerateBootEntries", "ritetyss", "CDlpActionWimLayout::ActionMultiEsdToLayout", "MicrodomImplementation::CMicrodom::GetElementsByTagName", "H?j?", "Der angegebene Datentr", "efi\\microsoft\\boot\\efisys.bin", "GetDisk: Finished querying unallocated disks", "Error expanding string %s. Last Error = %#x", "lem zaten iptal edildi.%0", ";8;e;", ";P<}<", "ru-MD", "tn-ZA", " toimintoa ei ole aloitettu.%0", "lony plik WIM nie zawiera wymaganych danych odszyfrowywania.%0", "CDlpFile::SetSourceUrl", "6H6f6a7", "Den forespurte operasjonen er allerede avbrutt.%0", "6/666B6", "istiedoston.%0", " ninguna clave para descifrar el archivo WIM especificado.%0", "1&1Y1u1", "8-888b8m8", "RevertToSelf", "az-Latn-AZ", "RecoverCrypto: File is encrypted, but no key was provided.", "788b8t8", "LayoutUsb: Initializing OEM Extensibility Directory: [%s]", "273B3b3", "ZwOpenSymbolicLinkObject", "1 2:2G2m2", "Den angivne ISO-startfil blev ikke fundet.%0", "D$@SVW3", "5;5B5m5t5", "1%2<2e2", "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]", "8-848H8u8|8", "CMicrodomBuilder::ConsumeEntityDecl", "ProgressTotal", "The specified ISO boot file was not found.%0", ".idata$2", "e obsahuje bitovou kopii pro obnoven", "LayoutUsb: Install WIM is spanned - TotalParts: [%d]", "Opening object %s", "\\\\?\\GLOBALROOT\\", "jeblikket sat i k", "EditionID", "RecoverCrypto: Successfully processed the WIM file", "040Y0o0z0", "t jZS", "6$6N6", "ljas innan det g", "?R?u?", "Opening system store. Flags: 0x%x", "Creating Recovery directory.", "C(;C$", "Could not move source file", ">$>f>l>", "D$DPj", "ProductVersion", " arquivos em um volume que reside no disco.%0", "0g0W0_0", "CDlpTask::GetActionByName", "CDlpTransportImpl > > >::PreInit", "VirtualAlloc", "NtQueryVolumeInformationFile", "rakozik.%0", "\\Partition0", "zere eklenebilmesi i", "$SVW3", "ifresini ", "m os dados de desencripta", "?(?S?}?", "2*3:3T3[3m3", "", "5(6r6", "af-ZA", ":@:G:", "setup.exe", "DlpTask: Suspending task after transfer...", "Die OEM-Partition wird nicht entfernt, da sie das Windows-Wiederherstellungsimage enth", "7>8E8", "O0M0K", "WIMCloseWIM", "6>8I8W8", "Failed to query boot options. Status: %x", "ZwUnloadKey2", "CDlpTransportBits::Serialize", "Nenhuma chave foi fornecida para descriptografar o arquivo WIM especificado.%0", "mn-MN", "1(1/1", "na onar", "0=0D0[0d0{0", "4I4u4", "Multithreaded chunked decoding disabled via environment variable; will skip!", "9T$Hr", "Default", "CDlpActionRecoverCrypto::RepairBlock", "IMAGE", "ChunkWriterInit", "u*9BXu", "8!9'999@9M9S9g9n9", "Deleting boot entry 0x%x", "0R1n1y1", "WimCopyResource", "ActionWeight", "lt.%0", "TransportId", "?,?3?>?", "QQVWh", "PRODUCTTYPE", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "3<3`3g3", "Den anmodede st", "ResolvePartitionTypeToCreate: %s: disk %d is a GPT disk and has more than zero existing partitions; assuming %s setting wants to create GPT basic data partition", "041404B0", "Failed to log servicing event to bootstat %ws. Status: 0x%x", "6!6/6g6z6", "ConnectToSourceUrl: Refreshing WinHttp connection...", ">(>4>@>L>X>d>p>|>", ":3:R:", "|SOURCE|\\|FWTYPE|", "?G?Q?m?}?", "Not-null check failed: Blob", "LayoutUsb: Creating partition on disk [%u]", "j.Yf;", "GetSystemDirectoryW", "_strnicmp", ".rsrc$01", "='=.===D=", "yoWhI", "= =+=H=", "Der Schl", "Not removing OEM partition because it contains the Windows Recovery image.%0", "fr-CH", "o foi iniciada.%0", "9`9j9", "CDlpTask::GetActionCount", "434I4", "Store %s is the system store", ";94>M>a>l>", " spou", "GetExitCodeThread", "2\"2L2[2h2", "4m4v4", "%c:\\sources", "RecoverCrypto: Transferred repair block from to [%s]", "install.wim", "BootWimPath", ";(+>m>", "RESOURCES", "e obsahuje syst", "4U5u5", "jlokat ", "Source.Length >= 2", "829^9h9", "4G4}4", "CDlpTask::SetCallbackRoutine", "CXh@W", "9MdHdt", "CDlpTransportHttp::PrepareFile", "es-PA", "CDlpTask::CheckInitialized", "CDlpTask::GetState", "CDlpActionLayoutUsb::SplitWimList", "sidant sur ce disque.%0", "La operaci", ":!;g;", "858c8", "ZwModifyBootEntry", "LayoutUsb: OEM Folder: [%s], Volume Root: [%s]", "D$8h!@", "4)4A4x4", "Der Datentr", "DecodeChunk", "RtlIsLUtf8StringValid(NamespaceURI)", "ENTITY", "WIMExtractImagePathAndGetFileHandle", "T$(94", "=8>O>q>", "Disken slettes ikke, fordi den indeholder BitLocker-kryptering.%0", "CreateDlpRegistrar", "RtlStringFromGUID", "525a5", ";1;\\;", ";H;b;o;", "ulIndex < UpdateChildNodes.Size()", "031U1", "313c3", "ReadMetaDataBuffer", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet", ">7>Q>w>", "*** Source File: %s, line %ld", "<3,>S>m>", "BFSVC Warning: %s", "BitsTransport: SetParameters - Job Priority = [%s]", "ger ist nicht bereit.%0", "10.0.19041.572 (WinBuild.160101.0800)", "?6?L?W?", "::RtlIsLUtf8StringValid(&Sources[i])", ";4;Z;", "040604B0", "CryptGetUserKey", "\\Device\\HarddiskVolume", "-Tz4q", "smn-FI", ":';:;k;r;", ">O>u>", "f;D$Pu", "9T9]9", "y Vhe", "Action execution thread timeout period: [%d ms]", "261019185142Z0", "Failed to set Wof data for file", "MicrodomImplementation::DecodeXmlCharacterToUcsChar", "4#4<4F4g4p4", "onecore\\base\\lstring\\lblob.cpp", "6#7)7k7", "El disco especificado no est", "tLVVVW", "DlpTask: Suspending task during action...", "Failed to add boot entry. Status: %x", "131>1d1", "Not-null check failed: Writer", "tFPPWj", "F(QPj", "_wcstoi64", "ncia%0", "BitsExecute: Transfer already completed - returning already completed", "ritetty WIM-tiedosto ei sis", "CDlpFile::Deserialize", "CDlpTransportBits::GetBitsJobErrorContextString", "Den angivne disk er ikke klar.%0", "040u0", "8A8K8", "BITS-jobben er for ", "Pyydetty", "jlokat tartalmaz.%0", "CDlpActionRecoverCrypto::ExecuteRoutine", "u anda s", "pToInsertInto != 0", "2;3D3", "9@9N9", "e ne s", "(inherited) ", ";|$Xt", "ErrorCode", "9/9:9e9", "t0WVh,", "De aangevraagde bewerking wordt geannuleerd.%0", "\\Device\\Harddisk%lu\\Partition%lu", "MININT", " stata sospesa.%0", "SetEvent", " > > >::UpdateState", "Directory", ".rdata$zETW2", "ProgressHandlerAction FinalUpdate: 0x%X, 0x%I64X / 0x%I64X, 0x%I64X", ";-;<;B;", "CDlpActionRecoverCrypto::SaveCryptedBuffer", " jest szyfrowany funkcj", "BFSVC Error: %s", "4a5J7", "RtlAllocateAndInitializeSid", "8*979v9", "NodeMap != Windows::Microdom::Rtl::NamedNodeMap::InvalidValue()", "0F0~0", ";( > > >::Restart", "=0T0k0", "%s: Entering Prepare Method", "fwprintf", "BCryptFinishHash", "5,545@5`5h5t5", "\\Boot\\BCD", ":,;`;};", "st tartalmaz.%0", "1%1F1_1", " SVWj", ";/<9 >,class CDlpActionWimLayoutFactory,class CDlpActionWimLayout>::CreateAction", "D$PPQ", "Windows::StringUtil::Rtl::SubStringByCharCount", "9!:+:2:r:", "Pausing BITS job due to caller request.", "ps-AF", " opravy podle blok", "CDlpActionRecoverCrypto::DoFullEncryption", "DlpTask: Suspending task during transfer...", "5<6b6m6", "j < ValidProperties.Length", "WimMatchImageCriteria: Image [%d] value not found", "m ficheiros de sistema.%0", "dW0f0D0~0Y0", "PoolHeader != 0", "NtSetInformationFile", "Windows::Rtl::CRtlObjectTypeDescription::CreateTearoff", " >,class CDlpActionLayoutIsoFactory,class CDlpActionLayoutIso>::CreateAction", "\\\\?\\GLOBALROOT", "Det g", "AddFileNodeToImage", "9%:k:", "ResAddFromFileAndHandle", "Den forespurte operasjonen har ikke startet.%0", "='=1=@=G=R=", "=&>E>h>", "7N8[8", "wcscpy_s", "FirmwareVariable", "Locals.Allocate()", "GetSystemTimeAsFileTime", "memset", "5-5X5h5", "BfspCopyFile(%s, %s) failed! (Attempt %d of %d) Last Error = %#x", "<>[>", "CDlpActionRecoverCrypto::InitializeRoutine", "J\\98u", "CDlpActionLayoutUsb::GetDataSize", "MediaLayout: Initializing Source Layout Path: [%s]", "NodeIndex < m_pTargetObject->m_LayoutCache.TotalObjectCount()", "333n3", "__iob_func", "RepairAttemptsCount", "VerifyFileByHandle", "3 3%3O3", "7%8;8k8", "ConnectToSourceUrl: No IE proxy settings.", ">#>X>r>", "737>7s7", "digt.%0", "CopySid", "? > > >::CheckInitialized", "2/2=2", "Error uncompressing boor manager (%s)! Last Error = %#x", "GetSysVolInfoPathFromMountPath", "SetFileTime", "GetSecurityDescriptorGroup", "LayoutUsb: Setting volume label to: [%s]", " Operativsystem", "LayoutUsb: Populating Boot Path: [%s, %s] -> [%s]", "C0K0U0[0f0m0r0x0~0", ";](s?", "boot\\etfsboot.com", "D$8G;}", "InstallWimPath", "=4=;=V=\\=l=s=", "7N8U8", "9$9H9h9", " Microsoft Corporation. All rights reserved.", "Failed to service spaces bootmgr. Last Error = %#x", "9b9i9", "il.%0", "o de origem ", "LayoutUsb: Setting temp path to [%s]", "u7WVh0", "zh-MO", "0?0\\0w0", "5%51585n5{5", "Partycja OEM nie jest usuwana, poniewa", "2(3/3<3C3b3", "CDlpActionFactoryImpl >,class CDlpActionLayoutIsoFactory,class CDlpActionLayoutIso>::GetActionId", "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x", "CopyDirectoryDirCallback: The copy was canceled by the user.", "MediaLayout: Initializing Target Layout Path: [%s]", "DeleteFileEx: Trying to set back attributes on: %s", "; ;8;F;g;", "CDlpFile::CheckInitialized", "WimGetFileIdByHandle", "ConvertSidToStringSidW", "annulation.%0", "|SYSPART|\\|DEST|\\BOOTNXT", "mni-IN", ":m;q;u;y;};", "\\*g/T", "yMWh}", "5F5p5", "r megkezd", "WinDlp.dll", "WriteFile", ";8;J;W;", "LayoutIso: Initializing Media Type: [0x%X]", "L$$PSV", "SetPartitionType: This is a recovery partition; setting specific attributes.", "jrapr", ":Q:]:d:p:w:", "Servicing spaces files", "FileVersion", "TRANSPORT", "Failed to get system partition! Last Error = %#x", "RtlDuplicateLUtf8String", "Could not set compression. Invalid cluster size.", "ynniss", "; ;5;A;", "0*0>0E0]0v0", "(Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)", ">!?C?e?", "C`hPd", "CDlpManager::GetQuadwordProperty", "RtlFreeUnicodeString", "9&9E9T9a9w9", "BitsTransport: Entering Execute Method", "CDlpTransportHttp::Initialize", "WorkingPath", "The specified WIM file does not contain the required decryption data.%0", "bootmgfw.efi", "nde sistem dosyalar", "d\\O*g", ":B;\\;g;};", "(ulElementType == (0x2)) || (ulElementType == (0x3)) || (ulElementType == (0x5)) || (ulElementType == (0x1)) || (ulElementType == (0x6)) || (ulElementType == (0x7)) || (ulElementType == (0x4))", "Failed to get file size for %s! Error code = %#x", "CDlpTransportBits::TransferFile", "Finner ikke den angitte ISO-omstartsfilen.%0", "NtEnumerateBootEntries", "bootia32.efi", "1/1:1d1o1", "LayoutUsb", "\\\\.\\?:", "j\\Yuj", "SetNamedSecurityInfoW", "5(545@5L5X5d5p5|5", "Nelze de", "FAT32 ", "RestoreHardlink", "EnableShortnamesOnApplyTarget", "%wNtE", "2+222y2", "*g Rd", "ritetty", "pHeader->ulTotalSize == m_MicrodomDataBlob.Length", "3H3z3", "#document", "1B2V2a2", "<)===H=t=", "8P8o8", "5%5v5}5", " WIM ", "CMicrodomBuilder::InsertDefaultAttributes", "QQQQj", "tFWj;P", "=%=1=?=G=M=", "9-:4:Y:", "NtQueryInformationProcess", " contiene i file di sistema.%0", "RegCreateKeyExW", "30B1I1u1K2}2", "9:9r9y9", "L>d>o>", "o solicitada n", "|SYSPART|\\|DEST|\\bootspaces.dll", "9F$tr", "@(93u", ":#:c:", "NW0f0D0~0Y0", "QWPhh", "BCD: %ws", ":1:=:D:X:b:~:", "NtOpenFile", "CDlpActionWimLayout::WimDetermineImages", ": :,:8:D:P:\\:h:t:", "fr-029", "?#?E?_?x?", "%I64X", "757`7", "LayoutUsb: Initializing File Split Size: [0x%I64X]", "LayoutUsb: Error setting volume label! hr = [0x%X]", "Die angegebene ISO-Startdatei wurde nicht gefunden.%0", "file corrupted in block at offset %p", "dana operacja jest w toku.%0", "ResNodesSort", "Failed to find a key to load store %s. Last attempted key: %ws", "RestoreAllData", "hi-IN", "9'9:9", "-Ng0Y0", "es-MX", "version.dll", "velet megszak", "4<5y5", "ReadWimHeader", "ENTITIES", "Error deleting boot manager(%s)! Last Error = %#x", "cy-GB", "j\\Yf;", "am-ET", "WinDlp.pdb", "SyspartGetPhysicalPartitions failed with error code: %x", "ado.%0", "D$4_^[", "|SOURCE|\\|FONTS|", "=$=,=8=X=d=", "223<3W3i3r3", "hy-AM", "BUCL::Rtl::Add(cbReturnSize, cbThisSize, cbReturnSize)", "3\"4R4a4", "C(hLG", "8r SW", "CDlpActionWimLayout::DeserializeRoutine", ":\":<:I:\\:j:", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "GetPartitionInfo: Partition Number [%u] found at offet [0x%I64X]", "NewEntityDecl = this->AllocateStreamObject()", "?)?d?", "Er moet een netwerktransport zijn geselecteerd voordat een bestand kan worden toegevoegd voor overdracht.%0", "zu-ZA", ",SVW3", ".xdata$x", "5X5_5", "Een bestand op de bronlocatie is te groot voor het FAT32-bestandssysteem.%0", "O:%sG:%sD:P(A;;FA;;;%s)(A;;GRGX;;;BA)(A;;GRGX;;;SY)(A;;GRGX;;;BU)S:(AU;FASA;0x000D0116;;;WD)", "CDlpTransportBits::JobError", "El trabajo de BITS est", "tj98rZ", "o pedida est", ";J;a;h;", "?!?X?", "CDlpActionImpl > > >::CheckUserInterrupt", "DVD\\EFI\\boot.sdi", "te9w0t", "ja-JP", "WriteChunkedRegion", "uI;D$", "SetPartitionType: Either the partition style for the request [%s] is either unknown, or does not match the style of the specified partition [%s].", "JobModification: Error [0x%X] retrieving BITS job queued message.", "RtlLengthSid", "CryptDecrypt", "CDlpFile::Initialize", "vel descriptografar a chave no arquivo WIM especificado.%0", "<0<= >0>8>@>P>X>`>p>x>", "nn-NO", "Le volume demand", "RestoreStreams", "LayoutUsb: Skipping OEM Path: [%s]", "888?8F8M8T8[8a8w8|8", "loha BITS je aktu", "=E=o=", "failed to extract file from reference extension", "VarFileInfo", "lonego pliku rozruchowego ISO.%0", " siirrett", "CXmlNamespaceManager::Initialize", ">9?@?N?", "pProcessResFileBackedByWim", "DeleteCriticalSection", "989A9", "ca-ES-valencia", "CompressionType", "AdjustTokenPrivileges", "=0>g>", "CDlpTask::Initialize", "BcdOpenStore: Failed to add store from file %ws. StoreFlags: 0x%x Status: %x", "CMicrodomUpdateContext::CreateVirtualAttribute", "pa-Arab", "2Y3z3", "quz-PE", "UNKNOWN", "EnumHashTable", "De opgegeven schijf is te klein.%0", "ObjectHeader->uElementType == ucObjectType", "De aangevraagde bewerking is voltooid.%0", "818E8R8l8~8", "ZwQueryBootEntryOrder", "o del volumen solicitado es demasiado peque", "vs.%0", "l.sys", "RecoverCrypto: File size DOES NOT match.", "ProductSuite", "RtlXmlDetermineStreamEncoding(&TokenizerState, &EncodingLength)", "VirtualQuery", "1J1P1n1", "<,=w=", "BfspPrintFileOwnerProcess: NtQueryInformationProcessfailed! Status = %#x", "CDlpTask::SetWorkingPath", "Failed to clear system store flag. Status: %x", "Die OEM-Partition wird nicht entfernt, da sie Systemdateien enth", "<-=k={=", "m encripta", ">.?n?", "^[w!QRW", "Den forespurte operasjonen blir avbrutt.%0", "gsw-FR", "2!2,2Q2", "0XSMOn06RP", "WofAdk", "en-HK", "CDlpActionRecoverCrypto::DoFastEncryption", "LayoutUsb: Populating Layout Path: [%s]", "?,?b?m?", "5-5K5", "7?8Z8", "CDlpTransportImpl > > >::Suspend", "ReadChunk", "onecore\\base\\xml\\udom_modify.cpp", "Failed to query \"%ws\" variable. Status: %x", "ChunkWriterEnqueue", "sd-Arab", "5=7F7b708", "051Y1", "O ficheiro de arranque ISO especificado n", "Reset: Error serializing state! [0x%x]", "DuplicateTokenEx", "8R;b;", "O volume pedido ", "CDlpManager::SetStringProperty", "km-KH", "FX;GXu", "Parallel chunk decode queue empty; switching to synchronous decode", "UuidFromStringW", "ulWhich < TheMap->Length", ">G>]>", ".CRT$XCA", "EsdLayout: Exporting boot image(s) to ESD file...", ". Dosya bozuk.%0", "CDlpFile::UpdateState", "CDlpTransportImpl > > >::ExecuteRoutine", "jl visszafejt", "The requested operation has completed.%0", "CXmlLogicalState::Initialize", "QQPh@", ">6>Q>i>", "Failed to open system store. Status: %x", "SetFilePointer", "354r4", "CDlpActionRecoverCrypto::SetProgressData", "<6Comment.Allocate()", " Microsoft Corporation. Todos los derechos reservados.", "D$8PS", "90M0[0", "0k0o0'YM0Y0N0~0Y0", " soubor ISO nebyl nalezen.%0", "5*585F5T5b5p5~5", "RtlMatchLUtf8StringAgainstPointerList", "RtlCompareMemory", "MicrodomImplementation::CMicrodom::FindObject", "SetImpersonationCount", ":::I:Z:a:w:~:", "DEFAULTAPP", "ExportForCrossFileTarget", "250701214655Z0|1", "FindFreeExtent: Trying to find extent matching these criteria (byte offset of 0 implies no offset preference): [WithinContainer = %s] [Size >= 0x%I64x bytes] [Byte offset = 0x%I64x]", "Failed to open key for element %s. Status: %x", "%04d-%02d-%02d %02d:%02d:%02d", "\\ArcName\\", "bs-Latn", "RecoverOem: Extending the system partition succeeded!", "ConvertDiskStyle: Failed to convert disk [%d] to %s; hr = 0x%x", "Not-null check failed: Params->Source.pIStream", "::BUCL::Rtl::Add( *pcElements, 10, NewCapacity)", "fr-HT", "UpgLayout: Initializing FP data...", "040404B0", "jd^-x", "LayoutUsb: Recover usb. Using BfsServiceBootFiles to copy boot files", "51575d5", "7*757[7o7", " necessario selezionare una rete del trasporto.%0", "<41P1W1e1o1", "9#:y:", "FveDeleteAuthMethod", "aYd(z_C", "#comment", "<9%>P>", "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem", "tzm-Arab-MA", "CDlpActionLayoutUsb::RestartRoutine", "Washington1", "0(0G0c0", "Unable to decrypt the key in the specified WIM file.%0", "LayoutUsb: Failed to run BfsInitializeSystemVolume with path [%s], Firmware type [%s]", " operace u", "Failed to load hive into key %ws from %s. Status: %x", "RegLoadKeyW", "TransientCount", "BUCL::Rtl::Add(DataLength, OldLength, TempSize)", "CDlpTask::GetNextActionIndex", "Not-null check failed: String", "BitsTransferFile: Suspending BITS job at user request.", "$Recycle.Bin", "wcstoul", "626M6S6l6s6", "fr-MC", "CDlpTransportBitsFactory::GetTransportId", "RtlpSmartLBlobWritingContextResizePolicy", "Den angivne handling er allerede afbrudt midlertidigt.%0", "3@3X3", "171D1b1|1", "GetHandleInformation", "ritetty levy ei ole valmiina.%0", "1R1l1y1", "PoolHeader->Signature == ('pSdM')", "Het opgegeven ISO-opstartbestand is niet gevonden.%0", "seau avant de pouvoir ajouter un fichier au transfert.%0", ":%:.:::h:", "ReconstructionRoot", "030M0_0", "ZutA;", ">O?V?", "QPWSQQhP", "Impossible de supprimer la partition OEM, car elle contient les fichiers syst", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "Transfer execution thread timeout period: [%d ms]", "GlobalFree", " on parhaillaan jonossa.%0", ".idata$6", "< <$<(<,<0<4<8<<<@?>F>", "WIM_MetaData_Queue_Length", "k att reparera block har ", "CryptImportKey", "D$0PS", "526Q6X6", "1'2.233:3H3O3", "2_3y3", "> >@>H>P>\\>|>", "System operacyjny Microsoft", "Nie odnaleziono okre", "ZwOpenDirectoryObject", "818G8T8", "Transferred", "RtlRaiseStatus", "Le fichier sp", "Opera", "UuidCreate", " Searching for Image ranges...", "N*Y'Y", "F\\;G\\u", "<7=o=", "dz-BT", "ndaki anahtar", "n\\\\?\\UNC", "?w$tQ", "; ;8;q;", "velet folyamatban van.%0", "9p\\t:", "D$$;L$`u-;D$du'", "L$DPj", "BG_ERROR_CONTEXT_REMOTE_APPLICATION", "WinHttpCrackUrl", "MicrodomImplementation::CMicrodom::CreateInterface", "System", "JobModification: Retrying [%d/%d]", "Plataforma de Transfer", "Resources", ">M?T?p?w?", "m_pTargetObject->IsNamedNodeMapValid(NodeMap)", "3-4o4", "dvendige dekrypteringsdataene.%0", " na tym dysku, zawiera pliki.%0", "fD\\I?", " kulcsot.%0", "WIMCommitImageChanges", "A megadott rendszerind", "3/3e3E4", "m Microsoft", ":H:^:i:", "Dosyalar bu diskte bulunan bir birimde oldu", "Un archivo de la ubicaci", "0'0U0k0", ";2;N;f;", ":!:1:Y:q:", "MINOR", "7@8P8_8", "EtwEventEnabled", "Plik w lokalizacji ", "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()", "4?4k4", "2?2i2s2", "L$,QP", "DlpTask: Deserialize(): ActionId = [%s]", "\\lL\\q", "4&5F5", "RtlInitLUnicodeStringFromNullTerminatedString", "UD;UD", "5X6d6k6&7A7\\7w7", "Source.Length >= 3", "9B\\t\"9C8t", "1b2|2", "UpgLayout: Initializing Layout Path: [%s]", "O:%sG:%sD:P(A;CI;GA;;;%s)(A;;0x1201bf;;;SY)(A;IOCIOI;GA;;;SY)(A;;0x1201bf;;;BA)(A;IOCIOI;GA;;;BA)(A;CIOI;GRGX;;;BU)(A;OICIIO;GA;;;CO)", "ExclusionList", "3W3f3s3", "MediaLayout: Checking target layout path: [%s]", "Den angivne WIM-fil indeholder ikke de n", "5(5I5n5|5", "`V@Pj", "0)060T0n0{0", "3F4M4[4b4u4", "my-MM", "GetTempPathW", "WideCharToMultiByte", "ReconstructionPathCount", "CDlpActionLayoutUsb::CopyFileLists", "IsSecureBootBound", "858Y8", "O volume solicitado ", "9r4uC", "BfspPrintFileOwnerProcess: Malloc failed!Size = %#x", "raya al", "9 9+9V9", ";( >A>a>{>", "%s:(%d)", "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@", "rio selecionar um transporte de rede antes de ser poss", "858\\8q8", " stato inizializzato.%0", " pro de", "ReportData failed: Error = [0x%X]", "3,fTidTq ,>gEB;", ":::j:", "475O5", " a Windows helyre", "041904B0", "t=hH0", "@*93u", "3 3(30383@3H3T3t3|3", "CDlpTask::Suspend", "0@0b0", "system32\\recovery\\$PBR_Diskpart.txt", "6%6F6y6", "7A8]8p8z8", "RtlAllocateHeap", " levyll", "r die Ausf", "CDlpTask::PopChronicleResponse", "CDlpWimCapture::RefreshWimHandles", "es de d", "WimBoot capture failed because wimbootcompress.ini is not available!", "m arquivos do sistema.%0", "F0C;X", "Failed to get object identifier. Status: %x", "ISPCAT", "9G:b:", "Ignoring delete source directive. Only recovery has been requested", "Fjerner ikke OEM-partitionen, da den indeholder Windows-genoprettelsesafbildning.%0", "=%>H>", "576h6", "CDlpTransportBits::JobModification", "t1PSh(P", "=6>l>", "Store path: \"%s\"", ";.( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)", "InstallLanguage", "JobError: Retrying [%d/%d]", "RestoreMountStub: error creating destination file", "C`hli", "f9:tD", " stata gi", "5J6Q6?7_7v7", "20201008095051Z", ";U;f;", "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))", "L$|_^[3", "<*<;AllocateStreamObject()", "RecoverCrypto: Initializing Hash Value: [%s]", "r skadad.%0", "415m5", "1%1?1|1", "rden har slutf", " nem t", "ZwDeleteValueKey", "o vai ser limpo porque cont", "CDlpActionLayoutIsoFactory::CreateInstanceRoutine", "LayoutUsb: Initializing Reconstruction Volume: [%s]", "9%9R9]9x9", "NewTempBytesRequired > TempBytesRequired", "ek0-N", "\\KernelObjects\\BcdSyncMutant", "RegGetValueW", "<$<0<< > > >::GetState", "ar-LY", "\\system32\\kernel32.dll", "BCD%08d", "WimStrDupe", "WimLayout: Opening ESD package file: [%s]", "0(0_0{0", "yNVjE", "rden har redan pausats.%0", "LayoutUsb: Copying folder [%s] to [%s]...", "=;>n>{>", "AddCaptureNodeToImage", "7d8~8", "NtQueryValueKey", ";&1>?>G>", "__CxxFrameHandler3", "_wcsnicmp", "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x", "uz-Latn-UZ", " disk nen", ">)?0?", "onecore\\base\\lstring\\lunicode_string.cpp", "FveCloseVolume", "3$3,3", "j\\XPS", ">7>P>", "1(0&0", "CDlpActionRecoverCrypto::SetupWimIoCallbacks", "NtSetInformationProcess", "WINDOWS", "?$?0? ?t?", "BcdGetElementDataWithFlags: Failed to acquire BCD sync mutant. Status: %x", "O disco especificado n", "WIM\\IMAGE[*]\\WIMBOOT", "hrt.%0", "%w't%", "Not-null check failed: FullOfflineHiveFilePath", "<&=3=:=P=W=h=o=", "494U4m4", "D$0PQR", "DequeueNextChunk", " el archivo de arranque ISO especificado.%0", "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())", ";?;v;", "WIM_Chunked_Number_Of_Threads", "RecoverOem: System partition was not extended beyond OEM partition!", "Pyydetty toiminto on jo keskeytetty.%0", "u;9~0t6", "=&=U=d=k=", "ifrelemesi i", "A4;FAllocateStreamObject()", "o especificada n", "MediaLayout: Calculating size of media path: [%s]...", "3\"3o3", "8 9I9", " necess", "Copying object. Flags: 0x%x", "stenen birim FAT32 dosya sistemi i", "r inte att dekryptera nyckeln i den angivna WIM-filen.%0", "WriteFile() failed or short write", "1!1'1/171C1I1O1U1^1g1o1z1", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "IMPLIED", "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize", "tn8^\\t", "RtlReAllocateHeap", "tIWPd", "5<7F7n7", "Failed to convert guid to string. Status: %x", "_9^m_LayoutCache.DocumentId()", "SourceUrl", "8(8x9", "2&3P3h3", "Suspended", ", koska t", "+D$ ;|$ ", ";H;R;h;", "BitsTransport: Trying to cancel existing BITS Download Job to directory %s", "sr-Latn-ME", "LayoutUsb: Successfully created destination file part.", "e est termin", ";4;j;", "3SjdSjdQ", "rslen.%0", "th-TH", "Ett fel har uppst", "5/565@5m5w5", "213Z3r3", "0R1a1", ".CRT$XCZ", "CDlpManager::Deserialize", "_FC;]", "Failed to open element %ws key for delete. Status: %x", "020?0k0", "8 9%9:9J9O9a9f9y9", "be-BY", "RecoverCrypto: Initializing Remote Source Path: [%s]", "t\"jdY", "2;4J4Q4_4", "CurrentMajorVersionNumber", "1$2&3F3", "A\\;B\\u", "ti-ET", "<2<9.", ":,:4:<:D:L:T:\\:h:", "ssel bereitgestellt.%0", "626Z6", "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x", "BitsTransferFile: Completing BITS job.", "7%7,737:7", "3#4;4F4a4", "j\\Zf;Ty", "CMicrodomBuilder::AddString", "Bits Error: SourceUrl Modified: [%s] => [%s]", "444L4", "CDlpActionLayoutUsb::PopulateOemPath", "LayoutUsb: Restoring previous error mode: [0x%X]...", "=$=S=", "CDlpTransportBits::HandleJobError", "DlpMgrInit: WorkingPath = [%s], Disposition = [%s], Flags = [0x%X], Diagnostics = [%s], StockRegistrar = [%s], UserRegistrar = [%s]", "Plattform f", "7/8q8", "berschritten. Die Datei ist besch", "DVD\\PCAT\\BCD", "ApplyReparseFixup", "ReleaseSemaphore", "1K2e2", " %s ", "8/898s8", "chargement de Windows", "G\\h(P", "6I7P7", "?$?*?", "ii-CN", "v j\\Xf;", ";2;S;f;", "->C>n>", "FIXED", "+RjjQ3", "CDlpTransportBits::CheckInitialized", "7A8Y8", "p!c5Mf", ">Q?e?s?", "CDlpTransportImpl > > >::UpdateState", "Failed to get the size needed for the registry data. Status: %x", "ZwSetBootEntryOrder", "es-US", "No se puede borrar el disco porque hay archivos en un volumen que reside en este disco%0", ";C;Z;", "ACTION", "4M4a4h4", "A 3F ", "0[0#1@1G1[1", "BCD Warning: %ws", "RtlAcquireResourceExclusive", "tiedostoja.%0", "rw-RW", "RecoverCrypto:GetImageRangesFromWim -> ImageCount = [%d]", "Failed to service spaces DLL. Last Error = %#x", ";;;B;", "NtQueryDirectoryFile", "WIM\\IMAGE[*]\\WINDOWS\\INSTALLATIONTYPE", "6%616Q6", "x8!D$", "3V3s3", "na odszyfrowa", "7#7-747:7@7F7L7|7", "G`hx\\", "Canceling reconstruct.wim capture due to failure in progress callback: 0x%08x", "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x", " SFVP", "4K5e5r5", "zh-HK", "Queued", "4;4B4b4i4~4", "7V8]8t8", "969J9U9x9", "Den angivna WIM-filen inneh", "t$Th8f", "6*6W6", "BootFilePath", "BitsExecute: Suspending execution at user request.", "4n6u6", "CDlpActionRecoverCrypto::SaveEncryptedRangesToWim", "se-NO", "PRODUCTNAME", " Microsoft Corporation. Wszelkie prawa zastrze", "L$ h?", "=$>v>", "ks-Deva-IN", "Not-null check failed: Target", "MicrodomImplementation::CMicrodom::GetElementById", " toiminnossa on tapahtunut virhe.%0", "ksi.%0", "<33o3v3", "ZwOpenMutant", "hrung von Reparaturvorg", "6!717G7", "Ph(Y-", "bin-NG", "|SOURCE|\\Misc\\|FWTYPE|\\bootspaces.dll", "NewChild->Element.Allocate()", ":#;h<", "8\\8|8", "Isolationp::Parse::CTemplatizedStringIterator::Attach", "ServiceSpaces: Skipping non-Windows %s", "MediaLayout: Checking source layout path: [%s]", "lemde bir hatayla kar", "1=1R1Y1c1{1", "9$909<9H9T9`9l9x9", " Windows.%0", "bn-IN", "RtlReallocateLUtf8String", "?(?C?]?j?", "0B1u1", "%s: Leaving Prepare Method", "9b:u:", "SOFTWARE", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "prs-AF", "%s\\ControlSet%03u", "D$@;D$P", "3;4g4", "MaxVolumeSize", "tmj\\W", "Select", "ifrovat kl", " anulowana.%0", "MultiByteToWideChar", "@.rsrc", "LayoutUsb: Initializing Reconstruction Path: [%s]", "8%8\\8", "Microsoft Time-Stamp PCA 20100", "RQRRR", "u'QQQ", "Qj2QQ", "NtShutdownSystem", "w2t,-L", "WinHttpQueryDataAvailable", "Control\\Windows", "R:S-N", "?!?U?\\?k?r?", "1+1u1", "RtlInitAnsiString", "Failed to initialize description key for store. Store: %s StoreKey: %ws Status: %x", "PrepareFile: WinHttpQueryHeaders failed -> [0x%X]", "CDlpActionLayoutUsb::SplitFileList", "WIMLoadImageInternal", "6C7J7", "InitLZMSCompression", "1.1S1h1r1", "<8 > > >::GetParameters", "Le dimensioni del volume richiesto sono insufficienti.%0", "wcsnlen", ">H>c>{>", "7E7x7", "Het gevraagde volume is te groot voor het FAT32-bestandssysteem.%0", "kn-IN", "RtlDowncaseUnicodeChar", ";@;w;", "?;?F?r?}?", "LdrGetProcedureAddress", "LayoutUsb: Skipped disk prep for drive %c", "ZuyA;", "%wPtG", "Error creating boot status data log(%s)! Bytes written = %#x, desired = %#x", "7#8=8", "Root != Root.InvalidValue()", "2=2W2d2", ">p?w?", "sources\\install.swm", "PPPPPPP", "VS_VERSION_INFO", "Impossible de supprimer la partition OEM, car elle contient l", "4(40494C4U4]4f4p4", " [%s]", "BfspPrintFileOwnerProcess: NtQueryInformationFilefailed! Status = %#x", "LayoutUsb: Initializing Flags: [0x%x]", "7-7<7l7", "=4=R=Z=i=", "Wim Capture: Timeout elapsed, refreshing device handles ...", "MultiLayout: Initializing DeleteSource: [%s]", "LANGUAGES", "4M5h5f7", "CDlpActionImpl > > >::Deserialize", "D$lSP", "CreateDestinationFileEx", "Copying boot debugging files from %ws to %ws (%ws)", "The BITS job is currently queued.", "Nie zainicjowano okre", "UpgLayout", "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence", "CDlpTransportHttpFactory::GetTransportId", "7j7}7", "CDlpTask::UpdateProgressAction", "ger wird nicht gel", "\\IA64", "SYSTEM", "ProcessDirectory", "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)", "?-?C?", "ZwDeleteBootEntry", "ReadMetaDataFile", "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)", "ProgressHandlerAction: Sending final progress message for action [%d].", "YY_[^", "O:SYG:SYD:P(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)", "ha-Latn", "1G1k1", " je p", "CreatePartition: Asked to create partition of unknown DC type 0x%x", "Det angivna ", "Reset setting hardlink failure because of folder redirection", "WimLayout: Attempting to load setup.exe module from x64 layout path.", "\\Windows\\WinSxS\\", "1,242", "ytynyt.%0", "SetPartitionType: The request to set type id and partition specified are both GPT format.", "RtlCopyLBlob", "_unlock", "5/6E6m6", "3O4Y4o4", "zh-TW", "<9=r=", " em curso.%0", "0I0h0", "GetLastError", "V:NMO", ":':C:R:Y:h:", "LayoutUsb: OCDUS blob [%s] exists, back up into USB", "j0_f;", "5-545y5", "WimLayout: ESD package info: %d images, %d install images", "nda gereken ", " in corso.%0", "0L0X[(WY0", "Not-null check failed: String1", "ntdll.dll", "WorkerStateDuplicate", "5=6a6", "WriteDirImage", "=I=[=", "%s:%s", ";\";);4;G;i;", "=M=T=,>B>g>\"?Q?", "tt a f", "m_CurrentStreamObject != 0", "es-GT", "DlpTask: Skipping action progress reset due to action cancellation request.", "me de fichiers FAT32.%0", "CDlpActionLayoutUsb::CopyFileList", "kozen.%0", ">*?>?I?q?", "NtReadFile", "2C2a2u2", "rden.%0", "%s", "No processes are using this file.", "user32.dll", "CDlpManager::SetQuadwordProperty", "ar-BH", "AllocateAndInitializeSid", "Cancellazione del disco non eseguita, perch", "LayoutUsb: Initializing Customizations Directory: [%s]", "FilterAttach", "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x", "j?Zf9TH", "?V?q?{?", "LayoutUsb: Retrying partition acquisition on disk [%u]", "Den angivne handling annulleres.%0", "4i4s4", "iu-Latn-CA", "WaitForSingleObject", "ExportFileNode", "Den angivne handling udf", "9Q:\\:", "=5>X>g>t>", "CDlpActionWimLayout::SerializeRoutine", "WimLayout: Initializing CleanTargetPath: [%s]", ";*;?H?v?", " oldu", "RecoverOem: Assigning drive letter to partition at offset [0x%I64X]", "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X", ":#:V:a:w:", ";&;,;I;O;", "RtlString::FixedString::Reallocate", "Kan de opgegeven code in het WIM-bestand niet versleutelen.%0", "Offset", "=(=A=R=", "CDlpTransportBitsFactory::GetTransport", "Wim Capture: Attempting to refresh handle to [%s]", "WimLayout", ":K:^:", "Timeout", "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement", "LayoutUsb: Install WIM is not spanned.", "DVD\\EFI\\BCD", "m_StoredTable.Find(Pair, ppusAttrListNumber)", "PSj@j", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "_wcsicmp", "6 6@6`6", "it-CH", "fr-LU", ">'?]?", "8.8|8", "\\??\\GLOBALROOT", "9,:c:", "Eine Datei im Quellpfad ist zu gro", "Den forespurte operasjonen p", ">_?x?", "\\system32\\csrss.exe", "adovan", "1$1,141<1D1L1X1x1", "hez nincs kulcs megadva.%0", "CDlpActionLayoutUsb::PopulateWimPath", "=1>E>N>U>", "De aangevraagde bewerking wordt uitgevoerd.%0", "> >'>.>B>P>a>{>", "es-ES", "8M9o9", "ZwQuerySystemEnvironmentValueEx", "?2?Y?`?", "6!6;6", "GetVolumeInformationByHandleW", "4'5K5\\5", ">7>c>j>", "EsdLayout: Creating esd file: [%s]", "UUUUf", "CXmlLogicalState::{dtor}::::operator ()", "CDlpActionImpl > > >::GetResultsRoutine", "WimFileSize", "FveSetFipsAllowDisabled", "f9FHu", "RtlGUIDFromString", ":>;F;", "CDlpManager::AsyncSerializeDisable", "4M5T5", "nsen for reparationsfors", "C,Wh8", " dans le fichier WIM sp", "CDlpActionImpl > > >::GetResults", "6_7i7", "LoadStringW", "CDlpActionFactoryImpl >,class CDlpActionLayoutUsbFactory,class CDlpActionLayoutUsb>::GetActionId", "uV9{4t", " > > >::GetTransportName", "Fehler beim angeforderten Vorgang.%0", "tKf9>tF", "9x\\tCW", "8(848@8L8X8d8p8|8", "LayoutIso: Initializing Volume Label: [%s]", "CDlpActionImpl > > >::GetProgress", "WimLayout: Exporting HdBoot WinPe image to [%s]...", "CMicrodomBuilder::StartElement", "uM9xXu", "BitsTransport: SetParameters - RetryLimit = [%d]", "QQSVW", "969U9\\9o9v9", "\\x86\\sources\\boot.wim", "ff-Latn", "2R3Y3Z4", "Not-null check failed: NodeSet", "LayoutUsb: Wiping disk [%u]", "CMicrodomBuilder::ConsumeCData", ".text$mn", "uD9pXu", " une erreur.%0", "0S0i0", "r fel van f", "est pas pr", "j\\Xf9DN", "ConnectToSourceUrl: Requesting -> [%s]", " operace ji", "< <= Content-Length=[%I64u]", ";$;H;h;p;x;", ":3:[:u:", "\\Device\\Harddisk%u\\Partition%u", "RecoverOem: Extending the system partition on disk [%d] at offset [0x%I64X]", "Created new boot entry 0x%x", "9!9t9", "PQQhH", "MSCFu", "owej jest za du", "6!7'7Y7d7", "CDlpTransportHttpFactory::GetTransport", "FveCommitChanges", ">Y>c>j>", "1?2W2", "CDlpActionImpl > > >::GetError", "Cancelled", "_^[Y]", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EndOpenElement", "ywVh(", "<1<6 > > >::SetParameters", "MicrodomImplementation::CMicrodom::DecodeXmlString", "0~0[0", "CDlpActionImpl > > >::SendCallbackMessage", "D$XAF", "UseSimplifiedWimSplit", "whichDoc.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()", "CryptAcquireContextW", "Failed to determine source OS version.", "yJVh(", "ilmelidir.%0", "m_StoredTable.Find(Pair, ppAttDef)", "MatchingDeviceId", "The requested operation is in progress.%0", "CDlpTransportImpl > > >::GetError", "ry znajduje si", "D$4PQ", "WimLayout: Checking ESD package file X86: [%s]", "CDlpTransportBits::GetBitsCopyManager", "uGj\\[", "jes til overf", "SetLastError", "3$314", "CDlpManager::Initialize", "_lock", ">+?J?", "415E5", "CDlpActionWimLayout::WimMatchImageCriteria", "rda ISO-startfilen.%0", "De limiet voor nieuwe herstelpogingen per blok is overschreden. Het bestand is beschadigd.%0", "DEFAULT", "gle til at dekryptere den angivne WIM-fil.%0", "it-IT", "?#?V?p?{?", "LayoutUsb: Disk [%d] size -> [%I64d] bytes", "multi(%d)disk(%d)rdisk(%d)partition(%d)", "D$0;D$(", "1a1h1 2'2", "::RtlIsLUtf8StringValid(StringIn)", "yeblikket i k", "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize", ">%>0>A>P>[>", ">#>*>U>", "041F04B0", "DlpTask: Entering Execute Method", ":F:}:", "Action: %d%%, Delta: %0.2lfs, %0.0lf ticks, Avg: %0.3lf ticks/s", "8>9W9m9", "|SYSPART|\\EFI\\Microsoft\\Recovery", "_vsnwprintf_s", "WimLayout: Exporting install images to [%s]...", "Bits Error: Reset retry count to zero.", "\\\\?\\GLOBALROOT%s", "System Volume Information", "CDlpFile::GetSourceUrl", "SetFileSize failed", "2#2h3", "NtSetInformationThread", "t=Wj,j", "t$Xhp", "ConnectToSourceUrl: Unable to retrieve IE proxy settings -> [0x%x].", "0C0A04B0", "CDlpManager::ShutdownSystem", " danificado.%0", "fr-CM", "fltlib.dll", "Waiting for actions thread to exit.", "ServiceSpaces: Skipping %s", "696S6", "TlP0X", "EsdLayout: Setting ESD temp path to [%s]", ";:;D;j;t;", " cancelando.%0", "Generating object GUID.", "D$, @", "WinDLP System Reboot", "kl-GL", "j\\Yf9", " na tomto disku.%0", "Not-null check failed: pStream", ">=?[?s?", "CDlpActionWimLayout::WimLayoutCaptureImage", "RestoreReparsePoint", ">!?;?F?n?", "6;7E7", "ne-NP", "YYW9]", "B(PVVR", "CreatePartition: Failed to convert disk [%d] to %s; hr = 0x%x", "5Fz<|", "Wim Capture: Splitting into a new WIM file: [%s]", "A valid store must have a description key.", "TheElement != TheElement.InvalidValue()", "=1=;=i=", "Decoder != 0", "ParseChunkRegionInternal", "ProductName", "?0?;?s?", "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)", "Failed open key %ws. Status: %x", "dany wolumin jest za du", "7s8<9", "Xf9ABt", "8(9>9L9W9", "%s\\%s", "=&=u={=", "TransportName", "O disco especificado ", "3%3X3_32494@4U4_4f4", "ProgressHandlerAction: Sending initial progress message for action [%d].", "WIM\\IMAGE[*]\\WIMBOOTENTRIES", "8/8C8U8", "MAJOR", "5(565j5b6r6y6", "::RtlIsLUtf8StringValid(Source)", "GetAclInformation", "fa-IR", "BcdForciblyUnloadStore: Failed to acquire BCD sync mutant. Status: %x", "|$Pjd", "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode", "_wtoi", "j?_f9|B", "\\Windows", "CDlpTransportHttpFactory::CreateTransport", "O disco n", "-eQkU", "RtlSetControlSecurityDescriptor", "CDlpActionLayoutUsb::PopulateBootPaths", "526H6e6", "4*4N4", "RSA1t", "RtlIsMicrodomUpdateContextValid(HostUpdate)", "?w(>H>P>X>`>h>p>x>", "9A0vq", "CDlpManager::GetStringPropertyByIndex", "Process PID %d is accessing file wim %s", "I0G1-0+", "4!595]5u5", "CDlpActionFactoryImpl >,class CDlpActionWimLayoutFactory,class CDlpActionWimLayout>::GetActionId", "lt visszafejteni a megadott WIM-f", "4V4n4", "CDlpRegistrar::RegisterTransportFactory", "3$4+4X4_4", "WimMoveFile", "Task->Deserialize(): TransportId = [%s]", "rFailed to set boot entry order. Status: %x", "QuadwordCount", "!This program cannot be run in DOS mode.", "o por bloco foi excedido. O ficheiro est", "SBCDOBJECT=", "ku-Arab-IQ", "NewChild->Text.Allocate()", ";5;?;p;", "stroje BitLocker.%0", "C<+C(", "6#7;7B70868e8", " foi pausada.%0", "NewPcData = this->AllocateStreamObject()", " byla zru", ":$:2:N:g:t:", "NewAttlistClose = this->AllocateStreamObject()", "0+0e0}0", "f@f#E", ";P;X>{>", "142T2b2q2", "Windows::Rtl::IsValid(ptr)", "9r$tL;", ">+>L>", "CMicrodomBuilder::ConsumeProcessingInstruction", "OpenProcessToken", "QQQQQQQW", "Windows::StringUtil::Rtl::SubStringByByteCount", "CloseHandle", "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]", "LayoutUsb: Initializing Max Volume: [0x%I64X]", "0X1b1", "8)9?9J9", "T$(9GL|X", "][YZ_^_^[", "2&2h2y2", "xSVW3", "0 0,080D0P0\\0h0t0", "Connecting", "n de Windows.%0", "ReadFileEx", "m_AttdefListTable.FindOrInsertIfNotPresent( ulElementName, NewAttdefList, &pAttdefList)", "sseln der angegebenen WIM-Datei wurde kein Schl", "LoadIntegrityInfo", "NtQuerySymbolicLinkObject", " est trop petit.%0", "tBSh8", "ncia.%0", "7N7f7", "192Z2l2r2", "oc-FR", "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild", "<8=f=", "6 6D6d6l6t6|6", ">(>p>", ":\";>;L;f;", "uNj03", "CompareStringW", "7(70787@7H7P7X7`7h7p7x7", "E0_0r0", "ndirme Platformu", "AddReparsePointToImage", "es-DO", " Microsoft Corporation. Alle Rechte vorbehalten.", "QQQPQQWQQS", "9B\\t ", ":[;~;", "CDlpTransportImpl > > >::Resume", "Failed to acquire permissions to load hive. Status: %x", ">%>?>L>", "00090E0b0", "Microsoft Time-Stamp Service", "Het opgegeven WIM-bestand bevat niet de vereiste ontsleutelingsgegevens.%0", "1(1?1N1h1", "Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}", "Failed to open object's key. Status: %x", "949n9y9", "strncmp", "@LvT2", "6q6x6", "\\system32\\ssshim.dll", "Lohkokohtainen korjausyritysten enimm", "WIMSetFileShortName", "f92u9A", "CMicrodom_Blob", "Failed open newly loaded key %ws. Flags: 0x%x Status: %x", "0)1x1", "tvitelt.%0", "9)9e9", "97u$VV", "?ffffff", "UCS-4", "RecoverCrypto: File is not encrypted.", "7&7.7D7i7", "5<5N5", "C;_$r", "PUBLIC", "UnmapViewOfFile", "=q=x=", "141T1", "Cf9Y*", "de-CH", " Microsoft Corporation. V", "ringen for reparasjon per blokk har blitt overskredet. Filen er skadet.%0", "sr-Latn", "efi\\microsoft\\boot\\BCD", "CDlpRegistrar::CreateTransport", "IsDebuggerPresent", "Der angeforderte Vorgang wurde bereits angehalten.%0", "CDlpTask::ReportData", "FveAddAuthMethodInformation", ",`ZwFilterBootOption", "WIM_Chunked_Parallel_Decode", "GetImageErrorCode", "Failed to update object GUID string. Status: %x", "en-CA", "9<9C9J9Y9a9", "OpenProcess", "CDlpTask::GetFileCount", "[ybVhl", "WimLayoutExportImages: Exporting [%d] images", " !\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@", "TerminateProcess", "SetThreadToken", "203:3R3s3", "s$97t", "RestoreSecurityDescriptor failed", "EsdLayout: Setting boot.wim temp path to [%s]", "0:0~0", "u\"Pj ", "5E5_5j5", "2@3G3[3", "CDlpManager::GetStringProperty", "3[3h3o3", "tn-BW", "n, proto", "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x", "9X:j:", "Wim Capture: Setting temp path to [%s]", "WimLayout: Applying Media Layout image to [%s]...", "_purecall", "WIMCreateFile", "e a d", "bootfix.bin", "WimPath", "sw-KE", "Attempting to determine owner of file %ws.", "MicrodomImplementation::CMicrodom::IRtlMicrodom_Cast", "=0I0~0", "200304183039Z", "Exporting forcible unload to firmware", "0+1D1Z1e1", "TlsGetValue", "040C04B0", "\\Windows\\Syswow64\\", "DequeueWimData", "Failed to open key for all objects. Status: %x", ";2;p;y;", "t$X9u t", "Det angivne handlingsobjekt er ikke initialiseret.%0", "LSVW3", "=,=4=@=`=h=p=|=", "gn-PY", "Multithreaded decoding for chunked WIM is enabled!", "SetFileStorageTierClass", "(Properties.Elements != 0) && (Results.Elements != 0)", "y,Who", "93:@:i:t:", "BcdCopyObjectEx: Failed to get object identifier. Flags: 0x%x Status: %x", "RecoverCrypto: Repaired block at offset [0x%I64X] of size [0x%I64X]", "=5=N=Y=", "MicrodomImplementation::CreateBinaryMicrodomFromXml", " vaadittuja salauksenpurkutietoja.%0", "res.%0", " Microsoft Corporation. ", "3!4/484?4N4d4t4{4", "LayoutIso", "CreateSemaphoreExW", "0k0eQc0f0D0~0Y0", "5+6D6|6", "?=?X?", "bertragung hinzugef", "RtlCompareEncodedLBlobs", "$SVWh", "1\\1c1", "The specified disk is not ready.%0", "WIMCopyFileEx failed", "m_AttdefListTable.Initialize()", "The BITS job is currently queued.%0", "1K2^2", "C,Wh`", "RestoreHardlinks", "=B=O=|=", "<_=t=", "xM9sdtF", "_vscwprintf", "Incorrect filesize. Could be corrupted", "Sistema operativo Microsoft", "SYSPART", "NtAdjustPrivilegesToken", "Not-null check failed: Matches", "r~akow", "5?5_5e5", "::$DATA", "BUCL::Rtl::Increment(m_NextStringId)", "CMicrodomUpdateContext::GetNodeUpdatePtr", "PWWWV", "CDlpActionLayoutIso::ExecuteRoutine", "EnumHashListCallback", "RtlSetOwnerSecurityDescriptor", "9~Pt.Q", "RecoverCrypto: File size matches.", " disken.%0", "D$ `4", "ZwQueryBootOptions", "tOf97tJh", "212?2v2", "BG_ERROR_CONTEXT_NONE", "Disken slettes ikke, fordi der findes filer p", "EnumeratePathEx: Failed search path is >= MAX_PATH!", "GetLoadedHiveKeyNameInternal", "ho souboru WIM.%0", "CDlpActionLayoutUsb::PopulateLayoutPath", "5N6U6", "SSSjd", "~(9~0t", "t'j\\W", "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Find", "ritetyn WIM-tiedoston salauksen purkamista varten ei annettu avainta.%0", "Wim Capture: Creating a new WIM file: [%s]", "4.484P4", "=:>S>", "ZwAllocateUuids", "onecore\\base\\lstring\\lutf8_string.cpp", "sxh|J", "Printing processes using %s file.", "CBasicNodeType::ChangeName", "BUCL::Rtl::Add(pCachedInfo->m_ulChildCount, pCachedInfo->m_ulAttributeCount, cNecessary)", "CDlpActionRecoverCrypto::DoCrypto", "9F sN", "1-1W1d1", "8/8H8s8", "484h4o4", "es-HN", "fmalloc failed", ">O>Z>", "No physical partitions found", ":C:d:", "L$,!t$0!t$4", "3\"303?5L5Z5", "CDlpTransportBits::GetTransportName", ":<:b:|:", "4%4b4p4", "687w7", "PathRemoveBackslashW", "pToInsertInto->Element != 0", "?7?D?\\?m?", "Det oppstod en feil i den forespurte operasjonen.%0", "CDlpFile::GetProgress", "tRSV3", "RecoverCrypto: Attempting to delete file [%s]", "sources\\$PBR_Diskpart.txt", "=4>i>v>}>", "CDlpActionLayoutIso::DeserializeRoutine", "3k4_5", "0!0E0c0", "si korl", "0!1C1", "4.5p7", "#wXsA", " FAT32 ", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteText", "emplacement source est trop grand pour le syst", ">=>W>d>", "CDlpTransportBitsFactory::CreateTransport", "8H9O9a9", "FveCheckSuspendBitLockerOnUpgrade", "4\"4&4*4.42464x4|8", "j Yf;", "?$?7?Z?", "EWjTV", "_ftol2_sse", "=&=I=S=^=e=", "tverkstransport m", "(SVW3", "%wLtC", "\\x64\\sources\\boot.wim", "112O2n2", "msvcrt.dll", "L'operazione richiesta non ", "2G2x2", "FALSE", "o ISO especificado n", "sma-NO", "Wait for work queue abandoned!", "Wim Capture: Capturing [%s] to [%s]", "ifrov", "CXh4u", "585X5x5", "\\Registry\\Machine", "I_RpcMapWin32Status", "Failed to bind with firmware. Flags: 0x%x Status: %x", "WIM_Skip_WIMBoot_Check", "Failed to open object %ws. Status: %x", "nOa-Q", "FltCommStubCreateChild", "CDlpActionLayoutUsb::DeserializeRoutine", "NewElement = this->AllocateStreamObject()", "L$(@;E", "t8Whx", "CDlpTask::InternalSetError", "1/1O1", "0C0c0", "6\"676I6e7", "t=jPj", "FindFreeExtent: Found suitable extent: [WithinContainer = %s], [Byte size of found extent = 0x%I64x], [Byte offset of found extent = 0x%I64x], [Return size of found extent = 0x%I64x], [Return offset of found extent = 0x%I64x].", "D$$0?", "GetFileSizeEx", "*** JobTransferred ***. Job State: [%s]", "Error creating boot status data log(%s)! Unable to allocate memory", "fr-MA", "ActionId", "or-IN", "SVWjP", "ExportChunkedRegionWrite", "sselung enth", "6\"6Y6", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "pDomLayout->ulSignature == ('lDdM')", "<*I?|?", "s rendszer", "EFI\\Microsoft\\Boot", "CoUninitialize", "HPWhD", "tt-RU", "PRODUCTSUITE", "7\"7D7U7_7~7", "3@3]3}3", "CDlpFile::UpdateProgress", "6e7|7", "2.2A2K2|2", "LayoutUsb: Failed to run SyspartGetSystemPartition with Error [0x%08x]", "VerifyIntegrityChunk", "PSSSSSS", "Pyydetty toiminto on k", ": ;4;B;h;", "CDlpActionWimLayout::ApplyMediaLayoutImage", "8#8d8", "081604B0", "QueryDosDeviceW", "fr-FR", "Den angivne disk er for lille.%0", "ZwSetSystemEnvironmentValueEx", "CreateCurrentDirectory", "ZwQueryAttributesFile", "CDlpTask::Execute", "505>5W5m5x5", "t$$RP", "The requested operation has already been suspended.%0", "Windows ", "1e1l1u1|1", "Um arquivo no local de origem ", "2S3t3", "CDlpActionWimLayoutFactory::CreateInstanceRoutine", "gl-ES", "t+C;]", "CDlpActionRecoverCrypto::CallbackVerify", "Error setting security attributes on %s. Last Error = %#x", "CDlpManager::GetQuadwordPropertyCount", "<]=d=r=", "o solicitada conclu", "Deleting element %08x", "CDlpActionFactoryImpl >,class CDlpActionRecoverCryptoFactory,class CDlpActionRecoverCrypto>::SetActionId", ">2>9>`>", "7L8c8.9Q9", "CDlpActionWimLayout::MediaInitialize", "7+8d8}8", "=D>}>", "LayoutUsb: Assigning drive letter to partition at offset [0x%I64X]", "windlp.state.xml", "T$@Ph@", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData", "6%6C6c6", "Fjerner ikke OEM-partitionen, da den indeholder systemfiler.%0", "(Value == 0) || RtlIsLUtf8StringValid(Value)", "False", ";G,u.", "5/6n6u6", "yJWhe", "=R?Y?", "e je ", "y+VhQ", "Task error [0x%X] is being set while task is not in Error state.", "LayoutUsb: Automatic file system selection: [%s]", "WIM\\IMAGE[*]\\HARDLINKBYTES", "ZwLoadKey2", "=+=1=d=z=", "WWWVt", "CDlpTransportHttp::ExecuteRoutine", "?_?l?", "=<=V=c=z=", "; hash = ", "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)", "6!7+7C7P7V7m7", "zupkfb^ZVSOLIEB@=:7520-+)&$\" ", "o necess", "3,484>4C4M4Z4`4g4n4s4x4~4", "GetSystemWindowsDirectoryW", "EFIDEFAULT", "<$<=:J:W:`:~:", "GetFileInformationByHandle", "dana operacja zosta", "SVWjz", "9M,tN", "2H3T3", "@&0_DM", "2O2V2", "<6H>", "is-IS", "S+T@b", "\\ProgramData", "EA^Wp", "FirmwareBootDevice", " sendo apagado, pois cont", ":$WIMMOUNTDATA:$DATA", "e est en cours d", "Failed to create handle for %s. GLE = 0x%x", "sselt werden.%0", " annul", "dsb-DE", "9^9e9", "RestoreFileMetadata: RecordFileDataLocation failed", "GWVVP", "1d1l1t1", "El disco especificado es demasiado peque", "MicrodomImplementation::CDomLayoutCache::AdvanceCachedPointer", "0!0Y0s0", "949B9^9n9u9", "|SOURCE|\\|FWTYPE|\\|BOOTMGR|", "n solicitada ya se ha cancelado.%0", "_ftol2", "t vybr", "3!4+4W4a4", "C(h`F", "080?0F0Q0X0`0p0", "A(VVVVPVVQ", "xh-ZA", "GetSecurityDescriptorControl", "Plateforme de t", "EtwEventRegister", "La partizione OEM non viene rimossa perch", "pt-PT", " est trop grand pour le syst", "585R5_5", "|SOURCE|\\BootDebuggerFiles.ini", "jaYjz^j:Z", "5&5?5b5o5", "4K5R5`5g5", "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)", "BootDebuggerFiles.UEFI", "hSVW3", "mt-MT", "8&9-9P9", "SeDebugPrivilege", "ConnectToSourceUrl: Port: [%d], Secure -> [%s]", "C(h`H", "O limite de tentativas de repara", "=7>x>", "9WHvQ", "GetDisk: Querying unallocated disks...", "8%888i8", "DlpTask: Executing Actions...", " n'a ", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNode", "LayoutUsb: Skipping duplicate file path: [%s]", "PQQQW", "GetSecurityDescriptorLength", "ResolvePartitionTypeToCreate: %s: Couldn't figure out the number of partitions on disk %d, assume there're at least one partition.", "\\system32\\config\\", "WaitForMultipleObjectsEx", "es-ES_tradnl", "Kaynak konumundaki bir dosya FAT32 dosya sistemi i", " foi cancelada.%0", "3:3A3", ":\";K;R;c;", "333333", "CDlpTask::GetWorkingPath", "RecoverCrypto: File hash matches.", "5 5+5V5", "Inconsistent full and destination paths; may lead to bad image meta-data.", "EnterCriticalSection", ">->4>N>U>o>v>", "3S3Z3", "181c1", "0/0=0b0", "RecoverOem: Deleting the partition on disk [%d] at offset [0x%I64X]", "Debe seleccionarse un transporte de red antes de poder agregar un archivo para la transferencia%0", "RtlReleaseResource", " un error.%0", "1R2p2", ":$:<:Z:", "9H:r:z:", "Failed to create path for default EFI application. Last error = %#x", "CMicrodomBuilder::StartAttlist", "SYSTEMROOT", "8'9>9", "BiUpdateEfiEntry failed %x", "9S0vmR", "Wim Capture: Failed to refresh device handles (0x%08x)", ", meg kell adnia egy h", "7B8f8", ">2>I>", "6B6u6", ">*>1>K>e>t>", "1!2~2", "Integer overflow after WriteData", "jdt\"jZ", "7 7_7i7", "7a8M9T9d9k9z9", "O ficheiro WIM especificado n", "The requested operation has encountered an error.%0", "Logging boot file servicing to bootstat log %ws.", "5-5<5C5\\5g5n5", "828Z8", "tb9t$", "$010]0|0", "D$lj PQ", "No key was provided to decrypt the specified WIM file.%0", "5%5,5b5r5", " data pro de", "NMTOKENS", "t&jPj", "GetVolumeRootFromPath", "9):[:", ":QVEE", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttribute", "RtlGetVersion", "DlpTask: Preparing Files...", "RtlCalculateUtf16StringLengthFromLUtf8String", " foi colocada em pausa.%0", "WWWWV", "CBasicNodeType::ForceValue", "9+9N9V9g9", "t;f97t6", "<\"<,5E5", "SystemTimeToTzSpecificLocalTime", "Den angitte disken er ikke klar.%0", "ZwLoadKey", "o OEM n", "LegalCopyright", " est introuvable.%0", "b naprawy na blok. Plik jest uszkodzony.%0", "4,4g4}5", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "Y__^[", "WimLayout: File does not exist.", "Fjerner ikke alt innhold p", ">Q?X?", "ServiceSpaces: Failed to copy %s to %s. Last Error = %#x", " operace je", "9 :;:G:R:p:", "RecoverOem: Setting volume label to: [%s]", "CDlpActionImpl > > >::SetProgress", "=5=K=X=n=", "CDlpActionLayoutUsb::SendOemMessage", "CDlpTask::CheckUserInterrupt", "BUCL::Rtl::Add(Offset, Count, TotalSize)", "CreatePartition: Disk %d doesn't support creation of partitions of the specified type", "SetFileInformationByHandle", "ReadWriteDataInternal", "qps-plocm", "De BITS-taak bevindt zich momenteel in de wachtrij.%0", "WimDetermineImages: Media WinPE index: [%d]", "|hK,_", " 0o0z0", "CryptoSavedBuffer.tmp", "uz-Latn", "CMicrodomBuilder::EndElement", " sendo removida, pois cont", "<2 [%s]", "RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )", "CDlpActionRecoverCrypto::VerifyFileHash", "\\$4Sj", "CDlpFile::GetState", "CDlpActionImpl > > >::CheckUninitialized", "373M3X3", "C`hlT", "1/2=2s2", "9&90989B9S9]9t9", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem", "sources\\xp", "yHVh]", "paration par blocs a ", "CXmlCursor::CompareStrings", " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "_W0f0", "VVVWh", "NtQueryInformationThread", "Binding EFI namespace objects", "x@S'Y", "CDlpTask::SetParameters", "D$hPW", "Found %d processes using this file.", "CDlpTask::PerformAsyncOperation", "RecoverCrypto: Updating remote source path: [%s] => [%s]", "LayoutUsb: Initializing Customization WIM Path: [%s]", "!01080", "t5vn=", "?&?w?", ">3>^>", "7 7,787D7P7\\7h7t7", "ActionCount", "3 3O3", ";O;o;", "", "e. Le fichier est endommag", "onecore\\internal\\base\\inc\\rtl_object_library.h", "C(h$F", "wcsrchr", ".text", "7X7k7", "<'=P=c=z=", "2 3A3m374", "t*j\\Xf;", "2U2s2", "N+@:81J", "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild", "3&4N4", "|$HSQ", "WimSplit: File Size failed for [%s]! hr = [0x%X]", "Not-null check failed: pOutputStream", "10.0.19041.572", "Bits Error: File [%s] => [%s]", ";-;C;", "lem iptal ediliyor.%0", ">_?z?", "3M4k4", "SetErrorMode", "L$$_^[3", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS", "91:3;I;P;", "Done servicing debugger files.", "A megadott lemez nincs k", "A forr", "6&6-646;6", "SetFileAttributesW", "co-FR", "9\"999~9", ";:;N;Y;w;", "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0", "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)", "90:7:S:Z:", "Bits Error: Fatal = [%s], State = [%s], Error_Context = [%s], hr = [0x%X], Description = [%s] ", ";!;M;c;", "CharUpperW", "Error deleting boottgt(%s)! Last Error = %#x", "9':b:", "Microsoft Corporation1200", "CreateFile() failed", "FormatPartition: Partition type ID (0x%X) needs to be carefully preserved across format.", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentElement", "HeapAlloc", "Error restoring directory metadata - ignoring failure", "WinHttpReceiveResponse", "nds p", ":#:0:d:~:", "Disk nebyl vymaz", "n pomoc", "PQj@Z", "=#=S=u=", "QWWWP", "WimLayout: Attempting to delete file [%s]", "t{93tw", "Not-null check failed: Data", "LayoutUsb: Formatting the partition at offset [0x%I64X] with filesystem [%s]", "3SVVV", "1F2M2\\2c2", "sms-FI", "0o0JRd", "j\\Xf9", "Przekroczono limit liczby ponownych pr", "WIM\\IMAGE[*]\\DIRCOUNT", " el, mert azon tal", " objekt akce nebyl inicializov", "NtOpenProcessTokenEx", "SyspartIsSpace failed for %s", ";j<8=L=V=", "Das angegebene Aktionsobjekt wurde nicht initialisiert.%0", "D$$;D$ v", "\\Program Files\\WindowsApps\\", "D$|PQ", "ErrorState", "O objeto de a", "o BitLocker.%0", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "EsdLayout: Install image count: [%d]", "Le dimensioni del volume richiesto sono troppo grandi per il file system FAT32.%0", "GetLengthSid", ">[_^]", "*** Assertion failed: %s", "222@2\\2", "%I64d", "Task->Deserialize(): SourceUrl = [%s], DestPath = [%s]", "Error copying %s to %s. Last Error = %#x", "Vj.^f;1u", "6O6i6v6", "wPf92tK", "ERROR", "GetSecurityDescriptorOwner", "GetTimeZoneInformation", "2!2,282>2E2", "4)404:4L4Z4a4u4|4", "031;1J1P1c1", "MultiLayout", "ar-YE", "3:3A3{3", "Den beg", "PVVVVh", "767f7", "PPWPPV", "Un fichier situ", "Count", "RtlXmlDestroyNextLogicalThing(this)", "4)4@4G4", "f;D$ u", "TempTempElements.Allocate(NewCapacity)", "RegCloseKey", "QPSWQQV", "f7~P`A", "El objeto de acci", "@_^[]", "122k2}2", "TargetFullPath", "FileSystemType", ">Z>l>w>", "GetThreadPriority", "CompressFileBackedByWim", "WINDLP_BITS_PRIORITY_NORMAL", "979D9x9", "?(?=?D?e?l?s?", "4%5;5R5k5", "Cancelling running action...", "<*<1<}<", "BitsTransferFile: Resuming BITS job at user request.", "microsoft\\boot\\bcd", "<3=k=z>", "%s: Entering Execute Method", "RSA2u", "1F1^1i1", "7-777E7k7v7", "veletobjektum nincs inicializ", "Not-null check failed: DataBlock", "UpgLayout: Initializing PreserveExistingFiles: [%s]", "GetFileSize", "878G8[8m8}8", "CDlpTransportBits::JobTransferred", "Integer overflow after ReadData", "CMicrodomBuilder::ConsumeComment", "Belirtilen disk haz", "in bir anahtar sa", "5+585c5}5", "bootaa64.efi", "CoSetProxyBlanket", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName", "zh-Hant", "RtlIsMicrodomUpdateContextValid(TheContext)", "FAT32", "RtlGetCharacterSetDecoder", "454^4t4", "CheckSumMappedFile", "No se encontr", "gd-GB", "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)", "5\"555", "6Q6~6", "<3<=B>c>", "6M7T7|7", "Nem siker", " operace.%0", ";@;T;_;", "NtSetCachedSigningLevel2", ",f~|z[WP", "WimMount", "<9>?]?", "haw-US", "4'5t5", "8*8d8~8", "az-Cyrl", "header type/size mismatch", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "?3?>?S?t?", "RC{%s}", "o foi encontrado.%0", "4*4_4", "TheEndElement = this->AllocateStreamObject()", "CreateFileMappingW", "CloseEncryptedFileRaw", "G`hhg", "sr-Cyrl-CS", "Windows::Rtl::CRtlObjectTypeDescription::CreateTearoff", "GetCurrentProcessId", "Failed to allocate root node.", "IsoPath", "ResNodesLoad", "BitsCancel: Cancelling BITS job due to caller request", "0L0+T~0", "BCryptGetProperty", "0 0(0,0004080", "A lemez nem t", "W0~0[0", "ks-Arab", "2!3:3q3", "?)?F?", "8B8L8", "CDlpActionRecoverCrypto::EncryptRanges", ".idata$4", "=F>Q>t>", "WimLayout: Setting scratch path for [%s] to [%s]", "en-GB", "[u*A;", "1 1,1L1T1`1", "CDlpWimCapture::Gather", "<84", "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert", "smj-SE", "5&5:5G5^5x5", "1-2U2a2", "=A=K=^=f=l=w=", "<;=[='>-?", "ar-LB", "ur-IN", "9(:3:::L:", "LayoutUsb: Successfully opened source WIM file.", "Dysk nie jest czyszczony, poniewa", "__rv.NewCursorValue != 0", "S,_^[", "1?2[2", ";E;K;", "si-LK", "lonego obiektu akcji.%0", "U0S0Q", "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent", "1'2.2", "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x", "{bf1a281b-ad7b-4476-ac95-f47682990ce7}", "1-1h1", "FveAddTrustedWimData", ">1>S>m>y>", ";';t;", "RtlDosPathNameToNtPathName_U_WithStatus", "e est en cours.%0", ">T?^?", "5 5v5", "fr-ML", "4;5]6", "o especificado n", "Byl p", " ei tyhjennet", "9+9m9", "InitializeAcl", "lva.%0", "6*686Y6s6", ">@.6Y", "SendCallbackMessage: [0x%X] -> user callback returned 0x%X", "ajdjZ", "Der angeforderte Vorgang wird ausgef", "040h0", "|SYSPART|\\", "JobModification: Job State: [%s]", "CRtlGrowingList::Initialize", "3/3Q3s3", "ValidateFileAndSetEACallback", "jena.%0", "*** JobTransferred ***. Error: [0x%X]", "Not-null check failed: String2", "%s\\Select", "='=2=9=K=Q=W=]=c=i=p=w=~=", "5#6;6W6", "RtlAppendUnicodeToString", "::RtlIsLUtf8StringValid(Destination)", "808=8\\8", "6N6b6~6", "t8SWSSh", "ck(WgbL", "ObjectLength", "RtlIsLUtf8StringValid(LocalName)", "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)", "3I3[3b3", "t`jdjZ", "131P1w1", "SeRestorePrivilege", "CDlpActionImpl > > >::ResetActionProgress", "LeaveCriticalSection", "en-ZA", "v5j:Xf;A", "9-9R9z9", "1(1I1j1", "CDlpActionRecoverCrypto::SerializeRoutine", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementById", "Windows::uDom::Rtl::RtlMicrodomUpdateCreateAttributeNs", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute", ")`yJb", "5(6R6", "jl nem tartalmazza a sz", "=?=F=", "{7ebc3661-e661-4943-95a5-412378cb16d1}", "Platforma pobierania systemu Windows", "=/=<=C=k=w=", "teG;}", "858_8", " denne disk.%0", "5B5`5", "NewProcessingInstruction = this->AllocateStreamObject()", "9 9H9b9", "0+0u0", ";%I>", "Error copying boot files from %s to %s! Last Error = %#x", "VWhlC", "ms-BN", "040E04B0", ">:>U>", "ar-IQ", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes", "OutputDebugStringW", "DeleteFileEx: Unable to open [%s]; GLE = 0x%x", "RecoverCrypto: Searching for info ranges...", "=%>0>]>j>", "llplatsen ", "7-7>7", "?W?g?o?", "5'6G6u6", "SystemStartOptions", "VERSION.dll", "=L=S=", "Failed to open key for object's elements. Status: %x", "8S9_9j9", "EsdLayout: Opening esd file: [%s] (with verify)", "<#<@<", "BiCreateBootEntry: Could not retrieve BCD Object application path. Status: %x", "ConvertStringSecurityDescriptorToSecurityDescriptor failed! Error code = %#x", "LayoutUsb: Failed to set new partition at offset [0x%I64X] active - partition not found", "IsOsPreRS1", "FindNextFileNameW", "o solicitada est", "@9F$u", "041304B0", "Flags", "nskede handling er afsluttet.%0", "NBf\\PbkW0f0D0~0Y0", "CDlpTask::UpdateProgressTransfer", " Microsoft", "EsdLayout: Creating scratch path: [%s]", "ifresi ", "t#h X", "sre kijel", "Not-null check failed: Result", "RPRRj", "ulLocation < m_PositionList.Length", "RestoreDirMetadata", "9(9r9", "so-SO", "6&6l6", "7!8W8", "CurrentRangeSaved", "mn-Mong", "jaYjz_j:Z", " foi suspensa.%0", "trPWQ", "<<=d=x=", "y\"VSh", "SHLWAPI.dll", "RecoverCrypto: File does not exist.", "@u)j@j", "ImageIndex", ":?:]:", "WimDetermineImages: Checking [%d] images for matching criteria...", "BQPQP", "1T1\\1o1", ":\":^:", "=,=Q=k=x=", "DEBUG", "TransientError", "Valid flags check failed: Flags", "RtlDuplicateLUtf8StringToLUnicodeString", "(Value != 0) || RtlIsLUtf8StringValid(Value)", "ller inte de dekrypteringsdata som kr", "!t$$Pj", "8T9n9", "WINDLP_BITS_PRIORITY_LOW", "d\\Oo02", "NtSetSecurityObject", ";B;X;c;", "x69T$", "RecoverCrypto: Initializing Wim Target Path: [%s]", "m yeniden deneme s", "LayoutUsb: Initializing Reconstruction Path Count: [%u]", "Failed to query boot entry order. Status: %x", "e soubor existuje na svazku, kter", "676N6^6", "r att dekryptera den angivna WIM-filen.%0", "GetLongPathNameW", "LdrFindResource_U", "GuidCache", "CDlpActionImpl > > >::GetSerializeOnProgress", ";P5>", "NewAttlist = this->AllocateStreamObject()", "041004B0", "8W8c8m8s8", "CustomizationWimPath", "da-DK", "6$606<6H6T6`6l6x6", "EstimateProgressForChunkedExport", "De aangevraagde bewerking is al onderbroken.%0", "CDlpTransportBits::Prepare", "Process Name [%d]: %ws", "r liten.%0", "Windowsin latausymp", "j.Xf;", ":9:o:", "606;6j6", "7<8R8", "CDATA", "CryptExportKey", "lmak ", "<1=p=", "2%2;2F2r2", "LayoutUsb: Setting as active the new partition at offset [0x%I64X]", " demasiado pequeno.%0", "QSVVV", "en-TT", "CDlpActionRecoverCrypto::GetKeyFromWim", "6O6d6", ":<:m:", "132g2", "2*252h2r2", "L$@QP", "EDITIONID", "CDlpActionImpl > > >::GetWorkingPath", "]_^[]", "6&717f7q7", "|SYSPART|\\BOOTTGT", "kr-Latn-NG", "pHeader->ulSignature == ('dHdM')", "CDlpActionLayoutIso::SerializeRoutine", "CDlpActionRecoverCrypto::CryptWimFile", "2N3U3r5|5", "CDlpActionFactoryImpl >,class CDlpActionRecoverCryptoFactory,class CDlpActionRecoverCrypto>::CreateAction", "Encryption/decryption resumed. Saved range: [%d], last written range: [%d].", "WimImageSetInformationFile", "A megadott WIM-f", "=K=i=", "050W0e0~0", "EnumResourcesForExport", "m.Reserved < m_NamedNodeMaps.Size()", "DisableThreadLibraryCalls", "=9>d>", "Failed to copy Boot Manager to default EFI application. Last error = %#x", "202F2S2w2", "failed", "\\system32\\ntoskrnl.exe", "CMicrodomUpdateContext::Construct", "CMicrodomUpdateContext::CreateVirtualTextual", "020A0H0Q0W0_0q0", "L$4_^[3", ")Microsoft Root Certificate Authority 20100", "=2===a=|=", "u6t6", "CDlpManager::CreateResponse", "fo-FO", "Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData", "=%>/>E>j>", "WPhp=", "BfspPrintFileOwnerProcess: NtOpenProcess failed!Status = %#x", "Rich)", "7L8`8", "LayoutIso: Successfully created IFileSystemImage object!", "system32\\recovery\\reagent.xml", "Not removing OEM partition because it contains system files.%0", ";G,u^", "ZwEnumerateKey", "6!7(7", "InitVDSServiceNoStatic:Creating VDS loader...", "WimApplyPrivileges", ".idata", "GetFileAttributesW", "CheckDataAvailableForHash", "2'3X3", "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)", "7*8}8", "Belirtilen ISO ", "4$5+5", "3$4>4K4", "CDlpActionImpl > > >::PreInit", "e a rencontr", "CDlpManager::GetQuadwordPropertyByIndex", "3P3w3", "si platform", "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom", "Error deleting bootnxt from the BOOT folder (%s)! Last Error = %#x", "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize", "Not-null check failed: Params->Source.pBlob", "Impossibile trovare il file di avvio dell'ISO specificato.%0", "WIMCaptureImageInternal", "OEM-osiota ei poisteta, koska se sis", "DlpTask: Suspending task after prepare...", "es-NI", ":4;;;", "6-686l6", "LayoutUsb: Initializing USB Drive: [%c:]", "onecore\\base\\lstring\\ucsdecoders.cpp", "ReadFile", "3$3N3d3", "2F3V3", "r Windows-", "3W3v3", "WimLayout: Initializing Wim Path: [%s]", "WimFindClose", "\\\\?\\PhysicalDrive%d", "oeY<9", "lstrcmpW", "n especificado no se ha inicializado.%0", "ActionName", "Error creating %s path! Last Error = %#x", "ar-AE", "LayoutUsb: Initializing Use Simplified Wim Split: [%s]", "686u6", " ISO-k", ";.<[3I3o3", "=0=7=\\=v=", "fil-PH", "onecore\\base\\xml\\udom_xmlcursor.cpp", "SetThreadIdealProcessor", "RpcStringFreeW", "|SOURCE|\\|RESOURCES|\\BOOTRES.DLL", "2!3[3g3r3", "1L1_1", "5'6Z6c6i6", "CDlpTransportBits::Initialize", "=+>d>", "chiffrer le fichier WIM sp", "Elements", "PWWWWh(", "es-UY", "BRANCH", "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART", "SourceMicrodom != 0", "WimLayoutApplyImage: Applying image index [%d] to [%s]", " Windowsin palautuksen n", "0#020A0N0[0h0", "RPCRT4.dll", "304S4i4", "2#2K2", "GetCurrentProcess", "7P7|7", "PPPPSW", ">C>y>", "Error deleting stale spaces dll (%s)! Last Error = %#x", "1,0*0", "9t$$t", "NewAttdef = this->AllocateStreamObject()", "ry9|$", "Se complet", "Microsoft Windows0", ">(>H>T>t>", "=$===H=", ":C;|;", "FindFirstFileNameW", "4e4u4|4", "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))", "TlsFree", "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext", "Sjhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "MultiLayout: Initializing Layout Path: [%s]", "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment", "qps-ploca", "BiExportEfiBootManager failed: %x", "LayoutIso: Initializing ISO Path: [%s]", "\\FVEAPI.DLL", "8 8(80888@8H8P8X8`8h8t8", "y dla systemu plik", "7*7M7k7", "CDlpWimCapture::GatherSplitCaptureFiles", " &n~Lj", "sah-RU", "(0N0n0", "WimCreateDirectory", "2)2f2", "0D1Y1d1", "y wybra", "262`2", "8D8c8", "CDlpManager::GetTaskByName", ">$>2>0?", "323y3", "< <7&?>?q?x?", "5)6e6s6", "829E9L9Y9t9{9", "CP9C!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!", "\\Windows\\System32\\WimBootCompress.ini", "bootmgr.efi", "rden har inte p", ";C;W;b;", " den.%0", "RecoverCrypto: File hash DOES NOT match.", "2/2T2t2", "797]7", "Not-null check failed: StringIn", "0~0W0_0", "vi-VN", "WimLayout: Layout Index: %d, WinPe Index: %d, MediaBoot Index: %d, Install Index: %d", "CDlpActionImpl > > >::ReportData", "5|6 7c7j7z7", "CDlpTask::ResetTransferProgress", "CXmlCursor::DecodeExtent", ".rdata$sxdata", "0%1p1", ">C>i>", "Pyydetyss", "this->ChildList[u]->Text != 0", "_f9 > > >::CheckUninitialized", "GetTickCount", "Failed to expand default EFI application location.", "mn-Cyrl", "-FVE-FS-", " !\"\"\"#$ &&&%%%%%%%", "%050A0", "CDlpActionRecoverCrypto::DeserializeRoutine", "LocalFree", "CreatePartition: Requested partition looks invalid (offset = [%I64u], size = [%I64u])", "System partition is not in a space", "NtDeviceIoControlFile", "5#5L5", "BitsTransport: Directory %s do not exist.", "7:7T7a7v7", "9$9,949<9D9L9T9`9", "UpdateHardlinks", "RestoreDirData", "tPSVP", "MicrodomImplementation::CMicrodom::GetDocumentNodeSet", "0%0@0p0w0", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "onecore\\base\\xml\\udom_builder.cpp", "Not-null check failed: Destination", "8`9|9", "Failed to export alterations to firmware. Status: %x", "%Microsoft Windows Production PCA 20110", "CDlpActionLayoutUsb::GetDataListSize", "DlpTask: Resetting action [%d] progress start time.", "656I6Z6a6", "(New == 0) || RtlIsLUtf8StringValid(New)", "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributeNs", "kk-KZ", "e est d", ";.K>", "Das angeforderte Volume ist zu gro", "707W7", "WIM\\IMAGE[*]", "ring.%0", "Failed to initialize objects key for store. Store: %s StoreKey: %ws Status: %x", " Microsoft Corporation. Minden jog fenntartva.", "Windows::Rtl::CRtlObjectTypeDescription::CreateInstance", "Nessuna chiave specificata per decrittografare il file WIM specificato. %0", "Failed to get registry value. Status: %x", "2Y2f2", "ATTLIST", ".rdata$zzzdbg", "GetFileStorageTierClass failed", "=4=>=T=y=", "che BITS actuellement en file d", "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon", "<8::OnBack", "i o alt", "CInstallUI::OpenSiteLink", " verzi Windows", "zTXTUPUP1", " Windows.:", "Esto puede tardar un poco.^Configurando la actualizaci", "ISO failas!Pasirinkite USB ", "n administra la configuraci", "t stikket i din pc for at sikre, at du ikke l", "az-Cyrl-AZ", "Nepavyko ", " un problemaOPer installare Windows 10, fai clic su Setup.exe nel supporto di installazione.", "Ayuda", "(%1!c!:) - %2!s! livres", "Windowsia ei ole aktivoitu t", "Ci sono ancora alcune operazioni da eseguire prima di procedere con l'aggiornamento. Verrai avvisato al termine, con indicazioni su come procedere. Questa finestra si chiuder", " stato possibile eseguire questo strumento nel tuo PC. Se il problema persiste, fai riferimento al codice di errore quando contatti il supporto tecnico.", "ti ei sobi Windowsi selle v", "; ;$;(;,;4;L;\\;`;d;|;", ".*Windows ", "ConX::Setup::Common::COSInfoHelper::GetHostOSVersion", "$Microsoft-Software-Lizenzbedingungen", "l vypadat n", "essayez.3Ex", " desc", "09B9+j", "Si Windows 10 ya se instal", "On-Screen &Keyboard", "dzenia magazynuj", ". Windows aktivoidaan, kun muodostat Internet-yhteyden.", "dis, lai p", "ta u postavkama da biste uklonili druge velike stavke.(Izaberite spoljni ure", "&Noraid", "Nepovedlo se naj", "r kan ta en stund.\\Konfigurerar uppdatering f", ">eeQ ", "Valitse k", "anas programma ir j", " disku. Potom to zkuste znovu.1P", "ranka internetu gaus naujinimus, tvarkykles ir pasirinktines funkcijas. ", " tam, kde sme skon", "3$303P3\\3|3", "YY0S0h0L0g0M0~0Y0", "cie %2!s!", "Preuzimanje ispravki", "marrer dans quelques instants.", "t, ko patur", "Aktuelle Version herunterladen", "cessaires. Assurez-vous que vous ", "e restartovat po", "s volvi", "s instalando Windows 10 en este equipo por primera vez, deber", " tilap", "cuter Windows 10. Fermez le programme d", "emo ondje gdje smo stali.2Ovo ra", "pertoire non pris en charge ou vous essayez d'installer une ancienne version de Windows.", "NotifyWinEvent", ",Aceast", "installation ", "0?4$A0", "%1!d!%% valmisSTuoteavain olikin v", "CSetupResponsePageBitLockerKeyValidate: OnSetActive", "rskendusPSalvestusruumi kasutuse avamine nurjus. Avage oma salvestusruum s", " za identifikatora: %Windows zahteva prostor za a", "anje, morate urediti spodnje stvari.ZKlju", "n de Windows Server 2019", "Udgave", "ams vair", "[[VV[VVMMOEc`", "iul de stocare, ", "HomePremiumN", "n y vuelve a intentarlo.+Error de instalaci", "er et ex", " > > >::GetState", "unalnik lahko izvaja sistem Windows Server 2019. Zaprite namestitveni program in poskusite znova.0Namestitev sistema Windows Server 2019 ni uspela&Name", "ff-Latn-SN", "n modul S.]Unitatea flash USB trebuie s", " '%c'", "!Windows ", "hem t", "&Fechar)Seu PC ser", "0W0f0K0", "d Product Key by m", "fi-FI", "iniz i", " Windows Server 2019.A", "CDlpResponseImpl > > >::Deserialize", "$Er du sikker p", "rskendus operatsioonis", " elibera", "i %1!s! pe PC (Unitatea %2!c!:)ZSelecta", "Ilmainen Windows 10 -p", "g G~3", " ligado ", "bory, ktor", "Me ei leidnud Windowsi installimise j", " tego narz", "in bir USB anahtar", " chyb", "ar-DZ", " lengviau diegti ", "Choose what to keep", "at.!Jakie s", "Izmenljivi pogoni", "zzel. A Windows telep", "i Windows 10, nu trebuie s", "ibb-NG", "Error launching site link (GLE = 0x%x)", "&IDATX", "m Windows koupili. Windows v", "jratelep", "i gata.", "Please wait3There was a problem running preinstall.cmd scripts.2There was a problem running precommit.cmd scripts.", "dz tiks pabeigta ", " bisogno o usa Pulizia disco per liberare spazio e riprova.>Si ", "lectionner un dispositif de stockage externe", "n tamam", " ve uygulamalar", "cie ho m", "e od 4GB (ovisi) i mogu", "Es kann nun ein paar Minuten dauern.", "jabb szolg", "tiski.", "em.;Klju", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "n Windows 10:n version, tietokone m", "ger efter opdateringer: %1!d!%%", "Die Windows-Installationsdateien wurden nicht gefunden. Legen Sie das Windows-Installationsmedium ein, und f", " kapat", "Namestitveni program za Windows 10", "r att skapa media", "@@AFTTU|]]^", "rias para continuar a instala", "PrepararFJ", "Dette m", "senia..Windows Server 2019 sa nepodarilo nain", "mu roz", "041B04B0", "n de BitLocker se suspender", "`.data", " BitLocker zostanie wstrzymana na czas tej aktualizacji i zostanie wznowiona, gdy zalogujesz si", "%1!s! %2!s!&Izveidojot datu nes", "n %1!s! ja tallenna ISO-tiedosto DVD-levylle manuaalisesti.", "ciju, kas nepiecie", "uW0~0W0_0U", "vMR@b", "Estamos preparando algunas cosas", "616O6m6", " v %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml a spus", "Daha fazla bilgi", "ve[]0", ",Windows 10 installiprogrammi taask", "Emme ole varmoja siit", "Windows 10 y", "iile nu se potrivesc", "Le programme d'installation de Windows va se connecter pour obtenir des mises ", "=X>r>~>", "vel determinar se o PC est", " Windows Server 2019,", "10 a d", "pnie wybierz pozycj", " ancora pronto per questo PC", "&Atmesti>Jei nesutiksite su licencijos s", "Betriebssystem Microsoft", "JDenne produktn", "e da zavisi od ure", "el nepovedlo odstranit automaticky. Aktualizujte seznam a zkuste to znovu.", "ine doar 25 de caractere.", " paleisti ", "ndan Yenile'yi se", "ments.", ">l;s4", ". Spus", "210303183039Z0p1", "CSetupDialogSplash", "n de Windows 10 necesita reiniciar para que funcionen. Tras el reinicio, continuaremos donde lo dejamos.)Este equipo no puede ejecutar Windows 10.", "Anahtar ", "Dvd-brander openen", "diegta ir suaktyvinta ", "chargements.q", "System operacyjny:", "pen. Z", "ranie m", " system Windows Server 2019. Zamknij Instalatora i spr", "-Tento n", "1$1,141L1P1\\1|1", "Nismo sigurni ", " po zako", "IMM32.dll", "chten, mit Windows 10 kompatibel sind.nDieser Product Key eignet sich nur zum Hinzuf", "Alterar o modo como a Instala", "Downloads ", " magazynu zewn", "lja, hogy a megtartani k", "t1uo0", " oraz dodatkowe pliki, kt", "%1!ld! %% effectu", "Pokud se chyst", "dition de Windows 10 va configurer votre PC pour qu'il s'ex", "ao nam je, imamo problema da utvrdimo da li je Windows 10 ve", "cie sa pou", "Error reporting telemetry for bOnLearnMoreLinkClicked: [0x%X]", " Microsoft Corporation. Tutti i diritti riservati.", " poursuivre l'installation de Windows Server", "Download the latest versiondA newer version of this tool is available. You must download and run the latest version to continue.(Download the updated Media Creation Tool", "lddd6", "?$?)?2?9?>?G?N?S?]?a?g?", "CInstallUI::ShowPage: Posted MSG_INSTALLUI_SWITCH_TO_RESPONSE_PAGE", "Aktualizacje zastosowane", " dar neparengtas ", "233?3K3Y4q4", "ncias!Abrir Defini", "jra.\"Hiba t", "Windows 10 UpdateQFailed to open your storage usage. Please manually open your Storage in Settings.GFailed to open your Recycle Bin. Please manually open your Recycle Bin.RFailed to open your storage usage. Please manually run %1!s! to open Disk Cleanup.", "dzu, apmekl", ".iNepoda", "kkel.", "niej b", " sa skripty nasadenia preinstall.cmd+Sp", "O Windows n", " dosyas", "me est survenu.NPour installer Windows 10, cliquez sur Setup.exe dans le m", "4(4b4", "mu programu se nepovedlo na", "l, kontaktujte z", "Neu beginnen", "Promijenite ono ", ".?AV?$CZeroInit@VCSetupResponsePageSelectImage@@$00@@", "uriranja, a nastavit ", "igused kaitstud.", "s atv", "Kontrollerar om installationen kan p", "ete podle n", "nnen und Ihre", "e se izbrisati, uklju", "-Scarica la versione pi", "ProductKey", "lj endast den h", "keztet", "n de preinstall.cmd5Ejecutando scripts de implementaci", "s instrukcijas.&Atbr", ", %2!c!: ", "a izv", "0S0h0L0g0M0", "sime jums atlaisvinti %1!s! %2!c!: loginiame diske.*", "Ouvrir la Corbeille", "r: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXJDu m", "ao nam je, morate ponovo da unesete informacije kasnije.6Instalacija nije uspela da primeni podatke o migraciji7Instalacija nije uspela da obri", " diegimo pasirinkim", "m, co je pot", "rliecinieties, vai ir izveidots savienojums ar internetu, un m", "CDlpResponseImpl > > >::SerializeRoutine", "o ter", "te-IN", "i prv", "informations, voir l", "d Product Key funguje! Jestli jste p", "1 carattere rimasto", "Acquista", " pa ponovno pokrenite instalaciju.", "yo-NG", "ar-KW", "Available UI Languages", "te odstr", "97HGGGG98%'", "ver veta innan du b", "XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX.:La cl", "n no puede detectar qu", "skat aktualizace, ovlada", "aW0j0D04X", " face", "te ze seznamu.`Tento probl", ", utw", "Primenljive napomene i uslovi licenciranja", " zachovat", " Windows Update.o", "K`PWVj", "d\\O-Nk0", " oppdatere", " yeniden deneyin.'Bu arac", "%s GBx", "ger at installere en ", "lo k probl", "1Jeg installerer Windows 10 p", "s: %d%%", "lpen f", "bb %1!s! szabad hely van", "Tikrinamas ", "RegQueryValueExW", " ce que vous ouvriez une nouvelle session.3En r", "ky-KG", "i instala", "ifrovania BitLocker. Vyberte in", "rca cele mai noi fi", "g0M0~0[0", " na pocz", "hEr kan niet worden bepaald of Windows 10 al gereed is voor uw pc. Sluit Setup af en probeer het opnieuw.*Windows 10 is nog niet gereed voor deze pc'Controleren of de installatie gereed is", "%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz", "2019.Cette op", "GetProcessHeap", "charger la batterie pendant l", "s administrar la configuraci", "Empfohlene Optionen f", "7(8`8x8", "nu uti", "9=9N9q9", "dia na jeho in", " danych do pobrania to oko", "u pour s", "Windows 10 Kurulumu", "sNem siker", "sVi har problemer med at fastsl", "ho programu.EInstala", ";Ftu;", "seDA Windows most ", "D=x[e", "t licen", "gt, um die Installation von Windows 10 fortzusetzen. Starten Sie Setup erneut.KStellen Sie sicher, dass auf Ihrem PC gen", " a odeberte dal", "s intentando instalar una versi", "hjustest:", "&Zatvori$Nismo uspjeli instalirati Windows 10YVratili smo PC u stanje u kojem je bio tik prije po", "tit ja proovige siis uuesti v", "jlt) k", "i caracteristici op", "es para resolu", "tfen y", "tteid.", "Eski y", " bruke, har ikke nok tilgjengelig diskplass. Velg en annen stasjon, og pr", " program Windows Server 2019. A", "PrzygotujOTa sprawa jest ju", "CSetupResponsePageCompat", "saugoti, suderinama su ", "o sa stalo, ale nepodarilo sa n", "Mettre ce PC ", "m>Ak s licen", "tre avant de commencer", "||ldl", "!Nem tal", "A arquitetura n", "y dzia", "ordinateur. Fermez tous les programmes ouverts, puis red", "mto v", "bsearch", "bb mint 4 GB is lehet (a m", "Disque m", "CSetupResponseTemplate::OnNext", "Hvis du skal oppgradere fra Windows 7 eller Windows 8.1 eller installere Windows 10 p", " brenne ISO-filen til en DVD senere.", " Internet, nous activerons Windows pour vous. ", " problem i uruchom ponownie Instalatora.", ">)>?>U>k>", "n8'$8", " %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ", "&Zavrie", "Lees deze overeenkomst goed door.", "0o0!kn0", "r nyckeln fungerar inte. Prova med en annan nyckel.", "s, DVD arba ISO failo) k", "ttede installationsmuligheder7Installationsprogrammet kan ikke validere produktn", "0c0f0puj0", "Wenn Sie diese Edition von Windows 10 installieren, wird Ihr PC f", "`cmap", "rt kr", "Actualizare Windows 10kNu s-a reu", "roljon ", "rjarmNedladdningen ", "digo de error: 0x%1!lX! - 0x%2!lX!", "anu, ir j", "171>1D1I1T1_1s1", "Senza etichetta", "ka bir ", "@@@@@@@@@@@@@@@@@@@@@@@@", "lja selline: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXMEnne j", "Descargar", "0L0zv", "noton komentosarjoja3Suoritetaan failure.cmd-k", "etky potrebn", "041D04B0", "Continuar desde donde lo dej", "t Sh,", "ret installeret og aktiveret p", "Nicht jetzt", "Sugerencias de soluci", "etka spremite i zatvorite datoteke..Pri", " kilka minut.yPodczas instalacji systemu Windows nie b", " 350 MB ", "bHr,g ", "Dil, mimari ve s", " Vytv", "ndert oder entfernt; Windows 10 wird im Supportzeitraum automatisch aktualisiert; der Support kann je nach Ger", "nje skladi", "~~{w{ok", "ppp@@@@@@@@@PPP", "et: .Windows skal bruge plads for at kunne opdatere", "pia Windowsu 7 alebo Windowsu 8.1. Aktivujte aktu", "mesine bas", " denne PC-en,Jeg m", ")Upotrijebi starije instalacijske datoteke", " Microsoft Corporation. Visas ties", "anja sistema Windows Server 2019. Poskusite znova zagnati namestitveni program.", " organizacija tvarko j", "Windows bu bilgisayarda etkinle", "NW0~0W0_0", ">0?H?Y?r?", "tietoja saat asennusohjelman ohjeesta tai suorittamalla komennon setup.exe /? komentokehotteessa asennustietov", "0?O$A0", "Reikia daugiau vietos,%1!d!GB laisvos vietos diske, reikia (%2!s!)lPa", "0$0(0,0004080<0@0H0`0d0x0|0", "n anterior de Windows.kLa unidad que intentas usar no tiene suficiente espacio disponible. Elige otra unidad e int", "dajov vo Windowse", "Jatka siit", "e da potraje.ZKonfigurisanje ispravke za Windows 10", "=?=P=", "nstalleerd of omdat u probeert een oudere versie van Windows te installeren.", "Pridobi", "GetSystemMetrics", ",Det g", "9**6, r", ".?AVCSetupResponsePageRecoveryReq@@", "li, s ", "Iets verhindert de voortgang van de installatie. Lees de informatie in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml om het probleem op te lossen en voer Setup opnieuw uit.fGa voor meer informatie over het upgraden van Windows Server naar: https://aka.ms/windowsserverupgradeqEr kan niet worden bepaald of Windows Server 2019 al gereed is voor uw pc. Sluit Setup af en probeer het opnieuw.&Windows is niet geactiveerd op deze pc", "EventRegister", " leidimo j", " nekoliko stvari. Obavesti", "ticamente en %1!d! minutos.0Algunas cosas que hay que saber antes de empezar", "fiTXtXML:com.adobe.xmp", "ISO fails", "tu Windows 10, instal", "unalnik konfiguriral za delovanje v na", "re having trouble determining if your PC can run Windows Server 2019. Please close Setup and try again.+Windows Server 2019 installation has failed", "kkulcs csak 25 karakterb", ":{bcc", " aktu", "ll Windows-inst", "elite da zadr", "aduje aspo", ".Windows 10:n asennusta k", "emo automatski aktivirati", " bitlocker fonctionne. Continuez quand vous ", "n admitidas?El programa de instalaci", "e boste nadgradili sistem Windows 7 ali Windows 8.1. oziroma boste znova namestili Windows 10, vam klju", "s uzst", "Geen updates beschikbaar", "Napredak: %1!d!%%7Da biste nastavili, izaberite neku od dostupnih opcija._", "[Fejlkode: 0x%x]1Windows-installationen st", "ntalo de nuevo o prueba una distinta.=", "HQP}_g", "e funkcionisati sa ovim izdanjem operativnog sistema Windows. Isprobajte neku drugu ", "e preoblikovati vanjski ure", "k0)R(uY0", "0n07_", "La langue ou l", "es dispon", "weug0M0~0Y0", "ilita isiklikud failid ja rakendused+S", " nytt.yBeklager, men vi har problemer med ", "emo vam pomo", "n antiguos", "cuter en mode S.ZLa cl", " flash USB", "rebilir.", "Instaliranje sustava Windows 10@PC ", "no pou", "c %1!d! min", "6_7f7\"8", "ttelep", "emo instalirati najnovije zna", " du produit par le programme d", "rgige alltoodud juhiseid.)Arvutis %1!s! vabastamine (%2!c!: kettal)HValige v", "CSetupResponseTemplate::ExecuteRoutine", "vs,%1!d! GB ledigt diskutrymme kr", "4!4-494M4", "glicherweise nicht richtig, und Sie m", "nt fel uppstod och det gick inte att k", "tta installera Windows Server 2019. Prova att starta om installationsprogrammet.", "Fvk__", "./Windows Server 2019 jo", ": 0x%x]:", "10 pour activer Windows", ", musisz pobra", "s nyelvet.(Usa i file di installazione meno recenti", "lem biraz zaman alabilir.", "9C u&", "n care Instalare Windows desc", "anju instalacije sustava Windows", "Een pad selecteren", "|}}?i", " se pou", "o precommit.cmd-Executando scripts de implanta", "InitializeCriticalSectionEx", " din pc, har et sprog eller en udgave, som dette v", "ib varieeruda) ja rakendada v", "2019 dans Windows Update.", "anas skriptu precommit.cmd izpilde(Izvieto", "g hely a g", "9D9i9{9", " volte. L'operazione richiede alcuni minuti.", "rsel V", "itamisel ilmnes probleem.3Precommit.cmd skriptide k", "0$PL0!q", "%c:DDevo riavviare il PC pi", " asennusohjelma uudelleen. > > >::Deserialize", "o e tente novamente.2Ocorreu um problema ao transferir alguns ficheiros", "rat manu", "GetVersionExW", " Windows Server 2019. Lai pal", "tres Windows.QVos applications et param", "se: %d%%", ",I trattini verranno aggiunti automaticamenteOIl programma di installazione non ", ".LWindows ", "g van a friss", "vanie funkci", " de confidentialit", "$Microsoft Ireland Operations Limited1", "nik instalacyjny systemu Windows, a nast", " para descargar las actualizaciones, los controladores y las caracter", ";5preinstall.cmd komut dosyalar", "ta Windows instal", ".:Sinun on tallennettava ISO-tiedosto DVD-levylle my", "i koristiti PC. Prije po", " installer.", "Este processo pode levar alguns minutos.", "Nepovedlo se ulo", "/Jag installerar om Windows 10 p", "'%%MOO", "gbaren Optionen aus, um den Vorgang fortzusetzen.", "astis.", "yorum?", "lgende grunner:", " program syst", " tiver sido instalado e ativado neste PC e estiver a reinstal", "ajki u sustav Windows. Nije ga mogu", "sterebilir.", "Please read this so that you know what you", "V:N`O", "iile vor fi ", "EnableMenuItem", "ho na fungovanie v re", "PripremiDTo ste ve", "lni.%Nem szeretn", "Lo sentimos, estamos teniendo problemas para determinar si Windows 10 ya est", "tteid hallata.ATeie s", "vne a mo", " BitLocker ", ", ka jums b", ".?AVCSetupUIManager@@", "o consegue executar o Windows 10$O Windows 10 j", "ajke sustava Windows 10 potreban je napredan hardver, neke su postoje", "se\"Ez hosszabb id", " essere usato solo per aggiungere funzionalit", "t run Windows 10\"You are already running Windows 10", "9#:=:^:", "cution de cet outil", "Puudub#Saate oma Windowsi s", "InstallDiskSpaceReq", "Flyttar dina inst", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "jumi un lietojumprogrammas tiks dz", "$Kod b", "? ?:?F?d?x?", "rgmistele asjadele.JInstallimise j", "cpn0Wg", "enja podr", "ovat.$Zvolte jin", "Instalator systemu Windows przejdzie do trybu online, aby pobra", "Leelawadee UI", " 4 GB+ (", ";.;8;M;W;", " usar o PC durante a instala", "MVVVVMM@%%%\"\" 9", "tta aega.", "nger. Det h", "l'architecture est incompatible.", "Installazione di Windows passer", "o inicializou o diret", " la riformattazione del dispositivo di archiviazione esterno, che potr", "ft.KDieser Schl", "7C7Q7", "n'Farkl", "chec de la d", "glltld", "Behold bare personlige filer", "r krypterad med BitLocker. V", "shez a Windows 10 telep", "emo u usluzi Windows Update.\\Konfigurisanje ispravke za Windows 10", "Actualizar este equipo ahora", "iek tiek vietos ir bandykite dar kart", "mes$Defises tiks pievienotas autom", "Vent litt", "owa; wprowad", "n anterior de Windows.mLa unidad que intentas usar no tiene suficiente espacio disponible. Elige otra unidad e int", " ezen a sz", "ivitada. P", "s csak akkor ", "enite ra", "e teh posodobitev ne boste namestili zdaj, va", " quer manter", "tirmeler y", "&Accepter", " nytt", " nem tudta megkezdeni a Windows telep", "ifra proizvoda.", "CDlpResponseImpl > > >::GetError", " di circa 3 GB. Se usi una connessione a consumo, controlla se il download causer", "pet friss", "041504B0", "0!0)010=0", "\\\\?\\UNC", "Moving your settings %d%%", "353U3u3", "yor-failure.cmd da", "See below if you", "iu pentru a rula instalarea. Elibera", "Seg&uinte", "es porque optou por instalar o %1!s! com um idioma diferente do que est", " la poursuite de l", "k igen.2Installationen av Windows Server 2019 misslyckades", "iau, kad jie veikt", "ivitage installiprogramm uuesti.]Windows Serveri t", "n tietokoneeseen)Minun on ostettava Windows 10 -tuoteavain", "0@+$A0", "ky. Vybra", "es-PR", "scEzen a m", "asno prekinjena in bo znova vzpostavljena, ko se boste vpisali v Windows 10. ", "es de instala", "pnie ponownie uruchom instalacj", "Apri cestino", "! Poursuivez quand vous le souhaitez.", "0Budete m", "tes.lLai nodro", "z, uygulamalar", "nerilen)", "'FC=P", "eHr,gMb", "Tiek veikta sagatavo", " atsisiuntim", "rtya vagy k", "%hs: Not updating report control because report path is empty.", "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageCompatSysReqImpl.h", "kai atnaujinama; palaikymas gali skirtis, atsi", "une cl", "9N9^9", "ca-ES", "0'1o1", "tartuje. M", "A Windows 10 telep", " saugojimo ", "nek ellen", "ktan sonra cihaz", "m kroku v", "mogat", ": %1!d!%%A", "ko min", "t work. Please check it and try again, or try a different key.5Your bitlocker key works! Continue when you", "nstalleerd. Activeer uw huidige versie van Windows met een productcode en selecteer Vernieuwen.", "installation de Windows Server", "nda BitLocker korumas", "0f0D0", "6'6-626;6H6m6", "turma Arac", "ljaande installimisel) l", "Windows is niet op deze pc geactiveerd. Dit betekent dat u de productcode van Windows 10 hieronder moet invoeren, of Setup afsluiten, Windows activeren en Setup opnieuw uitvoeren.", "si friss", " laikmen", "emo vam Windows. ", "en-NZ", "memcmp", "Zachowaj tylko pliki osobiste", "jjk%jjk`", "li chcesz zainstalowa", " pentru a extinde temporar unitatea de hard disk ", " manuel olarak a", "Der opstod en uventet fejl under installationen af Windows. Kontroll", "n.[DVD yaz", " za namestitveni program ali pa v korenskem imeniku namestitvenega medija za", "ve chosen to:", "O(uW0f0 ", " de produit.'Votre disque m", " precommit.cmd ", "talujete Windows do PC navrhnut", " at du vil avslutte?", "cution des scripts precommit.cmd.", "Pode continuar a usar o PC.", "anja. Preglejte informacije v datoteki %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml in odpravite te", "ani namestitvi odstranite.-Zahteve so izpolnjene. Pritisnite ", "Geen label", "[Code d", "rile Windows, fi", "CSetupResponsePageSysReq::PreTranslateMessage", "hlen Sie ein anderes Laufwerk aus.", "gido enquanto as atualiza", "Tarkistetaan avainta'Avain ei toimi. Kokeile toista avainta.", "CDlpResponseImpl > > >::Suspend", "t atjaunin", " systemu Windows, u", "s reciente de esta herramienta. Para continuar, tienes que descargar y ejecutar la versi", "%2!s!9Din organisation hanterar dina uppdateringsinst", "Tipps zur Problembehandlung", "sek let", "latmay", "N: Algunas caracter", "n ald", "o de que precisamos para continuar a instala", "iile ", "un support pour Windows 10*Vous pouvez continuer ", "iame kompiuteryje nesuaktyvinta", "Tam olarak haz", "rt pc", "kkulcshoz ill", " fie de cel pu", "n, voiko Windows Server 2019:", "marrez le programme d", "i un alt dispozitiv de stocare extern", " qx<)PlY`", "6/646L6Z6m6", ": Windows 10'un baz", "s listo para instalar", "CloseThreadpoolTimer", "s de la actualizaci", "ntalo de nuevo.&Problema al descargar algunos archivos", "OLEAUT32.dll", "ujte ra", "ojiet atkritni, lai no sist", "tes connect", "o.nPara obter mais informa", "fego limitado, verifique se a transfer", "'v?qW", "0 0$0<0L0P0h0x0|0", " pentru a v", ", tylko je", "6 6,686D6P6\\6h6t6", "0K0i0F0K0", "o de Caixa de Di", "%1!s!%2!s!%3!s!", "~Odeberte pros", "Dil e", "Il faut au moins %1!d! Go", "unalniku nismo mogli zagnati. ", "This might take a while.ZConfiguring update for Windows 10", "i cheia de produs", "mpliga meddelanden och licensvillkor", "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp", "BothVThis bitlocker key didn", "pna tylko w sytuacji, gdy na Twoim komputerze zosta", "Status: %1!d!%%3V", "~~~~~yyyyxxxxxx", "8.1 est install", "k un p", "A instala", ", at du vil afslutte?", " attivato in questo PC. Ci", "r du startede installationen af Windows Server 2019.EVi forts", "&Schermtoetsenbord", "\"Creaci", "Der er nogle f", "F5XG]", " deneyin.", "mu %s3Windows restart", "3%@>88888>", "Usa un dispositivo externo, como una llave USB, una tarjeta SD o un disco duro externo, para ampliar temporalmente el disco duro mientras se instalan las actualizaciones. Windows no volver", "uriranja pomo", ", tento n", "me jist", "l vienos i", "CDlpResponseImpl > > >::GetResponseName", "unar spreman da nastavi instalaciju izdanja Windows 10. Probajte ponovo da pokrenete instalaciju.oNije mogu", "%1!d!%% completeSThis product key didn", "sr-SP-Cyrl", "Arvuti taask", "s nepiecie", ".rsrc$02", "Windows 10 indiriliyor", "nliche Dateien behalten", " za BitLocker je videti tako: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX/Klju", " %2!c!:)TSeleziona o connetti un dispositivo di archiviazione esterno con almeno %1!s! liberi", "(ug0M0~0[0", " tai Windows 8.1:st", "Kasuta vanemaid installifaile", "`03*:", "e da sadr", "unalnik. Zaprite Windows Setup in poskusite znova.-Windows 10 ", "l.5A Windows 10 m", "dzu, atlasiet instal", "e nadaljujete brez aktivacije trenutne razli", "identificateur", "marre l", "lectionnez l'image ", "CSetupResponseTemplate::OnCancel", "Det h", "Valmistelemme paria asiaa", " izdelka ni deloval. Preverite ga in poskusite znova ali uporabite drugega.6Klju", "n timpul opera", "$U8De", "ttes, n", "CDlpResponseImpl > > >::Restart", "Aktualizovat seznam jednotek!Velikost mus", "-Ponovo instaliram", "Windows v tomto PC nie je aktivovan", "Fremdrift: %1!d!%%;Velg ett av de tilgjengelige alternativene for ", "```_\\ZRR", "pre jelenleg telep", "o.#Configura", "nliche Dateien beibehalten", " aflarea motivului.", "ffneten Programme, und starten Sie den Computer dann neu. Die Windows-Installation wird automatisch fortgesetzt.", "lreiz.9Uzst", " jednotku a kliknut", " %2!c!:pWindows 10", "INFORMATIE OVER DE INSTALLATIE: Sommige onderdelen van Windows 10 vereisen geavanceerde hardware; sommige bestaande onderdelen zijn gewijzigd of verwijderd; Windows 10 wordt automatisch bijgewerkt gedurende de ondersteuningsperiode; ondersteuning kan per apparaat verschillen.", "040204B0", "lteni az ", "Tahoma", "0.0T0", " pomoc", "ifrovana je tehnologijom BitLocker. Odaberite drugu disk jedinicu i poku", " na tomto po", "[o0D}T~k0", "sokat4A telep", "e yaramad", "i vannak.$V", "klemeden sonra bilgisayar", "040704B0", "du.gNepavyko atidaryti saugyklos naudojimo. Paleiskite %1!s! rankiniu b", " We can", "ano: %1!d!%%STa klju", "qMums nepavyko atsisi", "shell:RecycleBinFolder", "CSetupResponsePageBitLockerKeyValidate::GetResultsFromPage", "9V:`:", "ajazIzdanje sustava Windows koje odgovara unesenom klju", " estiver instalando o Windows 10 neste computador pela primeira vez, insira uma chave do produto (Product Key) v", " laste ned alle de n", "zh-SG", "r installasjonsprogrammet lukkes", " sakla,Windows ayarlar", " ulkoinen tallennuslaite, jossa on vapaata tilaa v", "2Kurulum program", "lj en annan enhet och f", "m Windows.", "1 teken resterend", "Er is in Windows een onverwachte installatiefout opgetreden. Verifieer of de installatiebronnen toegankelijk zijn en start de installatie opnieuw op.", "Select language, architecture and edition", "&Edellinen", "ppp@@@@@@@@@```", "tement lors de l", "n de Windows y tus archivos personales y aplicaciones.TLos puntos siguientes requieren tu atenci", "Archivo ISO", "Provjeravamo jeste li spremni za instalaciju", "stroje BitLocker vypad", "lDet kan tage nogle f", "hrend dieses Updates unterbrochen und erst fortgesetzt, wenn Sie sich bei Windows 10 anmelden. Zum Schutz Ihrer Daten sollten Sie den PC bis zur erneuten Anmeldung nicht unbeaufsichtigt lassen.7Zur Erinnerung sehen Sie hier noch einmal Ihre Auswahl:", "teni egy m", "mu Windows pou", "kalu ei tue tietokoneessasi asennettuna olevan Windowsin kielt", "dni fog. Ha meg szeretn", "n toimimaan S mode -tilassa. Valitse t", ".?AVIActivationActionResponse@@", "CSetupResponsePageBitLockerKeyValidate: InitializeResponsePageRoutine", "o e tente novamente.5Windows Server 2019 nu este ", "pertoire racine de votre m", "ierele se vor p", "L$(+L$ +D$", "cZ[D3-++", "QQSV3", "=(=4=@=L=X=d=p=|=", "1B1s1", "a organiz", "_2QX[zz", "4Windows Server 2019 ", "brig'Der Product Key umfasst nur 48 Zeichen.VDer Schl", "8(8H8T8t8|8", "0!070F0\\0k0", "o conseguimos encontrar o Contrato de Licen", "sra tervezett PC-n telep", "erreur", "2 2$2(2,2024282<2@2T2X2h2l2p2t2x2|2", "$?[?", "tte.\\En BitLocker-n", "Aguarde?Houve um problema durante a execu", "stiet atjaunin", "%s: Entering Response Execute Method", "unaru imate instaliranu aktiviranu kopiju operativnog sistema Windows 7 ili Windows 8.1. Aktivirajte trenutnu verziju operativnog sistema Windows pomo", "in birka", "iame kompiuteryje naudokite rekomenduojamas parinktis", "}Q0f0O0`0U0D0", "s az alkalmaz", "s pal", "4/4K4d4", "ajki. Ta ", "movou in", "ta neatbalst", "Tippek hibaelh", "9Hvis du avsl", "tuves lietojumu iestat", "kkelen kan bare brukes til ", "Sign in as an administratorRTo use this tool, you must be signed in to Windows using an administrator account.0You", "<#=^=", "&Uporabi starej", "r noget plads nedenfor, og v", " Windows via un compte d", "en-MY", "Osvje", "rgmise v", " fortsette installasjonen av Windows.", "unuzda devam edin.", "1 carattere rimasto1Il codice Product Key contiene solo 48 caratteri.MIl valore della chiave del gruppo %d non ", "De bestanden op het USB-station worden verwijderd. Als u deze bestanden wilt behouden, maakt u er nu een back-up van op een andere opslaglocatie.", " effectuer avant que vous puissiez proc", "%hs: Dialog initializing - SysReq Unknown", "6@>>@DDDDDDJDDDI?I", "gus labojumus, atjaunin", "ndan devam edemiyor. A", "tdldldlVw|v|~", "n y es posible que debas volver a instalar algunos idiomas y caracter", "8'8v8", "e en ligne.!%s n", "%d caratteri mancanti,I trattini verranno aggiunti automaticamente1Il codice Product Key contiene solo 25 caratteri.", "1#232V2o2~2", "ck(WW", "\"Windows Server 2019 ", "jlban tal", "c tam j", "Brez oznake", "logget Internett, og pr", "sticas opcionales", " %1!d! GB ", "vJos haluat asentaa Windows 10:n toiseen osioon, sinun on luotava tietov", "sa.>h>", "accepte pas les arguments de ligne de commande. Pour plus d", "Allalaaditava faili maht on umbes 3 GB. Kui kasutate mahup", "Vous ex", " s kontom spr", "?/?M?a?g?", "lt let", "0^1}1", "id-ID", "Ako nadogra", "Kontrollerer PC-en", "ga, l", "DISABLE_FEATURE", "in di", "kovi pre In", "hrung im S Modus konfiguriert. W", "sikkal.EEz a term", "9-969Y9;:B:", "sticas existentes se modificaron o quitaron; Windows 10 se actualiza autom", "i clic pe Re", " dalej. To okno zostanie automatycznie zamkni", "acheter une cl", "wo-SN", " stato ripristinato lo stato del PC precedente all'installazione di Windows Server 2019.JVerr", "ne verzije sustava Windows, morate kupiti klju", " riuscita", "Oblas", "PPP@@@@@@@@@ppp", "ndern der zu behaltenden Elemente", "n de Windows, los archivos personales y las aplicaciones.LLas siguientes acciones requieren tu atenci", "%hs: Dialog Initializing - Gated", "Ajutor", "in set", "o do Windows que voc", "Odabir pogona=Instalacijski program malo posprema za sobom prije zatvaranja&To bi moglo potrajati nekoliko minuta.XPriklju", "@@@PPP", "@wiQT", "ete mo", " dane, nie oddalaj si", "urirane upravlja", "cm]]]", "Viss ir iestat", "Oppdateringene er installert, men installasjonsprogrammet for Windows Server 2019 m", "PPP@@@@@@@@@@@@@@@```", "Windows 10'u y", "GetUpdateReserveManager", "CSetupResponsePageBitLockerKeyValidate::LaunchOnScreenKeyboard", "ene, vendar se mora namestitveni program za Windows Server 2019 za njihovo delovanje znova zagnati. Po ponovnem zagonu bomo nadaljevali, kjer smo ostali.:Ta ra", "ti, kad b", "Hvis du installerer Windows 10 p", "1'1B1Y1l1", ": %d%%\"", "Velg en USB-flash-enhetxFilene p", "h0W0f0", "Ne moremo ugotoviti, ali je v ra", "pen (%2!c!: meghajt", "r Windows Server 2019", "ega ra", " funkce Windows 10 vy", "e pre nego ", "WaitForMultipleObjects", "hren bereits Windows 10 aus. Dies kann einige Minuten dauern.", "dzu, atveriet mapi Lejupiel", "e nastavitve in aplikacije bodo izbrisane, va", "ajte ponovo ili probajte sa drugom ", "Vi klarte ikke ", "Izbrisa", "a aplic", "nyoznak a Windows telep", "Ambos^Esta clave de Bitlocker no funcion", "C==\"\" \" \"!", "s reinstalando Windows 10, no necesitas escribir una clave de producto.", "o SD ou uma unidade de disco r", "ava jezik ili izdanje verzije operativnog sistema Windows trenutno instalirano na ra", "uriranja i nastavi", " @@@000", "Ogiltiga kommandoradsparametrar", "sr-Cyrl-RS", "Den gratis opdatering til Windows 10 er kun tilg", "e biti izbrisane, dok ", "xIrrota seuraava ulkoinen asema ja viimeistele Windowsin asennus k", "rkekood: 0x%1!lX! - 0x%2!lX!", "Uporabite zunanjo napravo, kot je klju", "s iel", "nemi s", " alebo nepou", "kkulcs megfelel", "Dine filer, apps og indstillinger kan ikke bevares, fordi du har valgt at installere %1!s! ved hj", "ati datoteke, aplikacije i postavke jer je va", "Ingenting7Du kommer att kunna hantera dina Windows-inst", ". Entrez de nouveau la cl", "1 tegn tilbage", "es-BO", "malloc", "5+6@6", "DMappen Overf", "ljaanne ", "lper med at udf", "2JLNNNpp0", " techniczn", "P}Y|~", "BSee tootev", "Ustvariti namestitveni medij (pogon USB, DVD ali datoteka ISO) za drug ra", "9]\\WIFS", "ifra proizvoda ne", "Ab&lehnen>>>>>>;>;?;8?#q", "Something is preventing the installation from continuing. Review the information in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml to resolve the problem and run Setup again.\\For more information on upgrading Windows Server, visit: https://aka.ms/windowsserverupgrade~Sorry, but we're having trouble determining if Windows Server 2019 is ready for your PC yet. Please close Setup and try again.\"Windows isn", "Sistema Operacional Microsoft", "tenka vietos toliau diegti ", "ndose de que la instalaci", "charge les mises ", "es sobre como atualizar o Windows Server, visite: https://aka.ms/windowsserverupgrade", "Insira a chave do produto (Product Key)", "Bevar kun mine personlige filer", "Friss", "mu Windows. Sk", "HeapFree", "Valige t", "=R=q=}=", "hren.", " ste pokrenuli Windows 10!Ovo ", "Instalarea cur", "ej znajduj", " wszystko b", " un carattere valido", ",Licensvillkor f", "(%1!c!:) - %2!s! ledig", "ole32.dll", "tk0pe", "s, nous avons de la difficult", " a mo", "Getting a few things ready", "r installationsmediet.", ";';J;X;a;", "m Windows pot", " reddederseniz, kurma i", ". Lukk installasjonsprogrammet og pr", "2QX[&N", "tett eszk", "tajam.", "re. Dette vinduet lukkes automatisk om %1!d! minutter.", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9x9", "kilo problemaj", "jsist", " 1 znak", "sti diegim", "lne v po", "A&ceitar", ".?AV?$CZeroInit@VCSetupResponsePageMediaCreationSuccess@@$00@@", "ur-PK", "GetClientRect", "i cele mai recente fi", "Microsoft Corporation1", "At&svaidzin", ".6Windows Server 2019 ", "Pasirinkite, k", "tirdikten sonra kurulumu yeniden ba", " jour#Recherche de mises ", "r du starterwNedlastingen er ca. 3 GB. Hvis du bruker en forbruksm", "enekleri kullan", "Keep nothing", "rer de l", "mu Windows.", "%2!s!%\"\"\"=", "|Emme pysty selvitt", "CSpinningProgress", "/@$$?/", "Windows 10 na ovom ra", "8R8z8", "ioneze. Dup", "6366666/636636#2", "s recientes de Windows 10 en el equipo debido a que el espacio en disco es insuficiente. Sigue las instrucciones a continuaci", "Provjera preuzimanja&Odaberite medije koje ", " Twojej uwagi przed kontynuowaniem instalacji.fKlucz funkcji BitLocker ma nast", "t nem fogjuk tudni onnan folytatni, ahol abbahagytuk, ", " Windows 10>", "re connected to the Internet and try running the tool again.%There was a problem running this tool", "be Windows Update.", "%4!s!", ", negal", " gata pentru acest PC%Se verific", "tus ier", " hardware avansat; unele caracteristici existente au fost modificate sau eliminate; Windows 10 este actualizat ", "nite miesto a potom to sk", ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@", "iului-disc redus. Urma", " nav aktiviz", "%2!s!+Organisaatiosi hallinnoi p", "laitteistoa, ja joitakin aiempia ominaisuuksia on muokattu tai poistettu. Windows 10 p", "ne muu v", " pe suportul de instalare.", "uNPPV", "CheckHotPluggableDriveEx: Drive %c SetupDiGetClassDevs Error: 0x%X", "bnes. ", "te spu", "IDATu", "Die Informationen, die zum Fortsetzen der Windows-Installation erforderlich sind, wurden nicht gefunden. Starten Sie Setup neu, um es noch mal zu versuchen.lSetup konnte die Installation von Windows nicht starten. Starten Sie Setup neu, um es noch mal zu versuchen.", "Isso pode levar algum tempo.bConfigurando a atualiza", "Pen USB", " bir Windows 7 veya Windows 8.1 kopyas", ">W@H;", "ra om datorn kan k", "i din nou instrumentul.1A ap", "no snimite ISO datoteku na DVD koriste", ", morate vnesti veljaven klju", ":+:?:Q:a:q:y:", "traukti ", "anje in obdr", "nek tov", "unlar", "n set", "OH0O0`0U0D0", "kolik minut trvat.^B", "kernel32.dll", "psake installikandjal faili Setup.exe.yMe ei saa kindlaks teha, kas teie arvuti on Windows 10 installimiseks valmis. Proovige installiprogramm uuesti k", "o do Windows e execute o comando ", "Liko 1 simbolis4Produkto kod", "re Windows 10. Lukk installasjonsprogrammet, og pr", "dzu, atveriet atkritni manu", " grunn av for lite diskplass. F", "te de la ", "ra preinstall.cmd-skript.2Det var problem med att k", "SetTextColor", "Pokra", "iunii %2!s!", "|\"$5'o", "tfen Geri D", "nner.", "zdeki b", "CSetupResponseTemplate::GetResultsRoutine", "ou se ", "o inform", "tetreiber und zus", "ete na internet, aktivira", "strez fi", " spos", "Uyumlulu", "Unable to get Volume Information for Drive %c", "vel em seu idioma e sua arquitetura atuais.", "Ako nastavite i pored toga ", " PC-ul poate rula Windows Server 2019. ", "emo da utvrdimo da li je ra", "ReleaseMutex", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX", "By|||", ".#Windows ", "$Ohrani osebne datoteke in aplikacije", "-e ezen a sz", "Setup wird vorbereitet ", "o mais recente para continuar.2Baixar a Ferramenta de Cria", "titi podataka, PC trebate dr", ".tls$ZZZ", "=/=h=z=", "metros de linha de comando inv", "5(5-5X5r5", "n porque Windows no puede reiniciar el equipo. Cierra cualquier programa que se est", "chten, m", " cifrada con BitLocker. Elige otra unidad e int", "unalo i dovr", "k 3 GB boyutundad", ".?AVCHtmlEventSink@CSetupResponsePageCompat@@", " soubory a aplikace, budete se muset pod", " plusieurs reprises. Cette op", "unalnik smo povrnili v stanje, kot je bilo pred name", "m Kutusu'nu A", "lreiz ievadiet produkta atsl", "elda, kas teie arvuti on Windows Server 2019 installi j", "anas pabeig", " zasob", " verze Windows je mo", "rende versjonen av Windows, m", "i asisten", "4Z4`4g4m4", "ppna mappen H", "hendab, et peate sisestama allolevale v", "IDR_SETUP_FONT", "lupulka, SD-kaarti v", "r att h", " dosyalar indirilirken sorun olu", "CSetupLangIniLoader::Initialize: Cannot set current directory to '%s'. (hr = 0x%x)", "iS[WWWO]", " sa nena", " se vor genera costuri suplimentare.+Care sunt celelalte op", ".?AVCSetupDialogSplash@@", "CSetupResponsePageBase", " da biste nastavili instalaciju.", "Poder", " hardv", "Pobieranie aktualizacji Za chwil", "vZGWg", " je pripraven", "CInstallUI::SwitchToResponsePage", " se conectar ", "Az USB-meghajt", "%hs: Failed to generate compat report. HRESULT = 0x%08x", "Windows Server 2019 Setup$Restarting Windows Server 2019 Setup", "H0f0J0O0", " aus, um die Installation fortzusetzen.", "4(444@4L4X4d4p4|4", "ivitykset on asennettu, mutta Windows 10:n asennus on k", "&Sule*Teie arvuti taask", "=Klargj", "z bu s", "Din pc genstartes flere gange. Det kan tage lidt tid.", " tiettyj", "&Teclado Virtual", "o), precisar", ", USB-", "0h0M0k0S0n0", "ku, rad", " indiremedik. ", "ici olarak geni", "hakemistossa.", "A obter atualiza", "P@O@O@=83", ".7Windows Server 2019 ", "ovat, proto", "i kaudu.", "Lee esto para que sepas lo que est", "tina atsisi", "Suggerimenti per la risoluzione dei problemi", "3/3J3", "rias vezes. Isso pode demorar um pouco.)Aguarde enquanto a instala", "Naozaj chcete skon", "re going to upgrade from Windows 7 or Windows 8.1 or you", "ice sistema Windows 10", "o do Windows. Reinicie a Configura", "e instalirati Windows 10aNa ra", "ed upgradem mus", "vel. Voc", "Why am I seeing this?", "<,<0<4<8<<<@Download der neuesten Version von Windows", "rze neu gestartet.", "ra van sz", " criar e, depois, executar a m", "strojem BitLocker. Zvolte jinou jednotku a zkuste to znova.", "BitLocker ", "r Windows laddar ned uppdateringar", "CDlpResponseImpl > > >::InitializeRoutine", "Oppgrader denne PCen n", "ldre installationsfilerna", "kkulcsot megadni.", "gle, eller k", "ams(i) %1!d!", "1W2e2n2w2", "cia sa ukon", "llningar.>Dina inst", "yyyooo@@@", " system Windows 10 po aktualizacji.", "tirilmemi", "terek", "ita s funkcijo BitLocker bo med tem posodabljanjem za", "%hs!%p: ", "Se verific", "50545L5P5h5x5|5", "}?&ml", "Quasi pronto", "g 1 karakter maradt&A term", " semelhante a: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX6A chave do bitlocker s", "m aktivujeme syst", "yor. Ba", "jabb telep", "$hmtxO", ", om Windows Server 2019 er klar til din pc endnu. Luk installationsprogrammet, og pr", "*$$$$$$))", "ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo", "installation.#Cela peut prendre quelques minutes.~Vous ne pourrez pas utiliser votre PC durant l", "mKdT]", "tNu reu", "GetObjectW", "en er fjernet.", "nda muud v", " intereseaz", "&Refresh", "ga nedarbojas. M", "rtus ei sobi, sisestage ", "CInstallUI::ShowProgress: Ignoring since error page is shown", "0 0/0<0V0e0", "6'7y7", "Segoe UI Bold", " ajut la perfec", "mies, vai instal", "mas Windows 10 instal", " att installationen kan forts", ".?AVbad_alloc@std@@", "ilo se otev", "kkelenNInstallasjonsprogrammet kan ikke fastsl", "got hindrar installationen fr", "Kaut kas noticisNLai instal", "n en el medio de instalaci", "+;8`R", "lis karakterb", "pM`|S|||||Q|S|Q", "Kontrollerer denne n", "ili./Na tomto po", " de produit ne peut ", "tu Windows", "s\"Mantieni i file personali e le app6Mantieni le impostazioni di Windows e i file personali", ";3;B;I;O;T;`;k;", "%c:JTietokone k", "[M:^Z", "Installing this edition of Windows 10 will configure your PC to run in S mode. Choose this edition only if you are installing Windows on a PC designed to run in S mode.UThe USB flash drive must be at least %1!d! GB or larger. Please select another drive.", " proizvoda nije ispravan. Poku", "t install the latest Windows 10 features and security improvements on your PC due to low disk space. Follow the instructions below to complete the update.'Free up %1!s! on your PC (%2!c!: drive)ESelect or connect an external storage device with at least %1!s! free", " nejsou na instala", "na go u", " sitten uudelleen.;Joidenkin tiedostojen lataamisessa palvelimesta oli ongelma", "n.(No pudimos instalar Windows Server 2019.fRevertimos tu equipo al estado en el que estaba justo antes de empezar a instalar Windows Server 2019.@Vamos a seguir instalando Windows Server 2019 en Windows Update.", "no odprite ko", "2!2)2x2", "trehoz", "iTXtXML:com.adobe.xmp", "fremdrift", "netir.", " produkta atsl", "tres %d%%", "jes automatisk%Produktn", "delmet, az akkor lesz ism", "Errore imprevisto dell'installazione di Windows. Verifica che le origini di installazione siano accessibili, quindi riavvia l'installazione.", " jour et reprendra quand vous vous connecterez ", "%d tegn tilbage Bindestreger tilf", "omu by ste mali venova", "oare f", "po aktualizaci pak Windows", "k sedan installera igen.", "es#Estamos a fazer alguns preparativos", "tor cu aceasta: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "i vanjski pogon pa kliknite \"U redu\" da biste ponovno pokrenuli ra", "Windows 10 installeren", "Tikrinti suderinamum", "??1type_info@@UAE@XZ", "rgmise identifikaatoriga: #Windows vajab v", "i instalarea.", ">:>R>j>", "e to chv", "jo disku un noklik", "Mai multe informa", "it. Inscrip", "t)Windows 10 se n", "s seguro de que quieres salir?", "i cheia de produs Windows 10 mai jos sau s", "ljer att inte acceptera licensvillkoren avslutas installationen.gMinst 350 MB ledigt utrymme kr", "a sa odstr", "SYSPREP_SPECIALIZE", "o mais recente{Uma vers", "737L7a7~7", ") olu", "3\"3*30363B3Z3_3x3", "eMediaFormat", " jour&Se connecter en tant qu", ". %1!s!", "CInstallUI::OnActionChanged: Exit is requested. Ignoring OnActionChanged", "Schalten Sie den Computer nicht aus.", "Otvori DVD snima", " denne PC-en for f", "e funkcije su izmenjene ili uklonjene; Windows 10 se automatski a", "Weiter", "rankai nepavyko patikrinti produkto kodo;S", "nda daha fazla bilgi i", "=4=H=Q=a=j=", "as %d rakstz", "Prenos", "te, su kuo sutinkate.", "1UwL-\"", "SelectImage: Available Image index [ %ld ] -> [ %ld ]", "Installasjonsprogrammet for Windows vil koble til for ", " online per recuperare aggiornamenti, driver e funzionalit", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "Preveri zdru", "s izmantojat. Windows 10 instal", "?'?5?S?d?", "Avaa1Haluan k", "jumus, draiverus un papildu l", "ekajte:Do", "pte online, p", "m jste u", "KZZYYYYUYob~", "i dost m", "Continuar de onde eu parei", "Instalando o Windows 10@Seu PC ser", "Abrir Downloads$Abrir Configura", " parametruose, kad pa", "<1<@6", "kleFWindows y", "ene pre po", "<5H$?", "PPPPPPPPh", " stato installato e attivato in precedenza in questo PC e lo stai reinstallando, puoi ignorare questo passaggio. Windows verr", "2==ed2", "L'operazione potrebbe richiedere alcuni minuti.", "tat de pr", "N!@|V", "teva momente pentru a verifica dac", "nea de comandos. Para obtener m", "Updates werden abgerufen$Wir bereiten gerade einige Dinge vor", "r Windows 10 fut", "m9Pri sp", " sa vr", "a:Kja/ h`:KjaRich;Kja", "buj ponownie.:H:", "unalniku name", " naujo nuo prad", "re i S-modus. Velg denne utgaven bare hvis du installerer Windows p", ", je ", " un arhitekt", "cuter Windows Server", " i podaj ten kod b", " program Windows Servera 2019", " recente di Windows 10/L'operazione potrebbe richiedere alcuni minuti.iNon ", " opera", "lerleme durumu: %%%1!d!BDevam etmek i", "Kalba:", "Provera spremnosti za instalaciju", "o de continuar. Leia as informa", "Unesite ", "unar spreman da nastavi instalaciju izdanja Windows Server 2019. Poku", "Windows 10 Installation", "e potrajati nekoliko minuta.^Priklju", "ne popravke, a", "kkelen inneholder bare 48 digitale tegn.", "installation.|Nous avons besoin d", "r att de ska fungera. Efter omstarten forts", "UFalha ao abrir a pasta de transfer", "GetLanguageMediaNumber: LANG.INI not found. Path = '%s'. (hr = 0x%x)", "i je po", "Bu bilgisayara Windows 10'u ilk kez y", "%1!d!%% dovr", "ciou e", "t need to enter a product key.", "(-4CFIOOPZZNNYNNnb_", " mere at vide", "Prihl", "Elegir qu", "imdi ba", "n mod automat ", "co se staloQPokud chcete nainstalovat Windows 10, klikn", "Gaunami naujinimai", "8l9{9", "luseadme valiminexUSB-kettal olevad failid kustutatakse. Nende failide s", " anteriormente en este equipo y lo est", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@", " je syst", "kog okvira nije valjan\"Ne mo", " de cea pe care o utiliza", "Architekt", "n a Windows r", "Als u doorgaat zonder uw huidige versie van Windows te activeren, moet u een Windows 10-productcode of -licentie kopen om Windows 10 na de update te activeren.", " pomocou t", " helyet, am", "kselt", " do systemu Windows przy u", "ppp@@@ppp", "SvQ-N", "tson fel lemezter", "#%%%c", "yti ISO fail", "Falls Sie Windows 10 erstmalig auf diesem PC installieren, m", " votre PC ", "+Codice di errore: 0x%1!lX! - 0x%2!lX!", "n func", "ovat v instalaci Windows Serveru 2019. Zkuste restartovat instala", "REGISTER_SYNC_PROCESS", "ber eine getaktete Verbindung erfolgt, ", "ahovania aktualiz", "hlen Sie diese Edition nur, wenn Sie Windows auf einem PC installieren, der f", "FFFGlw", " se desf", "cznie plik ISO na dysku DVD, u", "kinkite, ar reik", "lacak.", "Grabe el archivo ISO en un DVD", "d9{ uy", "Ne zdaj", "ne takto: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX1K", " kurulum dosyalar", "CDlpResponseImpl > > >::SerializeRoutine", "~||xp", "o conseguimos guardar as informa", "tu sist", "tre d", "unaru ima dovoljno prostora za nastavak instaliranja izdanja Windows 10. Poku", "e se koristiti za instaliranje operativnog sistema Windows.", "%c:HRa", "ete ISO datoteku na DVD.", "ete morati ponovno instalirati neke dodatne zna", "do, incluindo arquivos, aplicativos e configura", "FveOpenVolumeW", "uded on t", "ck(WM", "nda Setup.exe", "z haz", " acorda", "Opdateringerne er installeret, men Windows Server 2019 Installation skal genstartes, for at de virker. N", "o de armazenamento nas defini", "{nsZ#cS", "CInstallUI::ShowProgress", "Spremni steCInstalaciju izdanja Windows 10 nastavi", "gle\"Angiv BitLocker-n", "tilanne", "El idioma no coincide", "6(666Y6u6", "CSetupResponsePageEula", "llningar.", "Instalarea Windows a ", "ke: 0x%x]APri instalaciji sustava Windows pojavila se neo", "Detta kan ta n", "ration peut prendre quelques minutes.wNous n", " +++a", "no otvorite Ko", "W0f0O0`0U0D0", "Verificando se h", "nky odm", "8+9r9", "Product key", "Updates ", "i set", "cia zlyhala vo f", "e. Appuyez sur continuer1Choisir un autre p", "inizden emin olman", "wiadczenia pomocy technicznej. Pomoc techniczna mo", "tartujte In", "To lahko traja nekaj minut.}Vseh potrebnih datotek ni bilo mogo", "Oc0f0 ", ", jotta tied", "Kettasektsioon", "hr wie folgt aus: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXYK", "3$3(3<3L3P3`3d3h3", " pronto para o seu PC. Feche a Configura", "i putea gestiona set", "iniet citu atsl", "Opdatering til Windows 10GLagerforbruget kunne ikke ", "CSetupResponseTemplate::OnBack", "owym znakiem", "Ako vas zanima obja", "v derefter igen.", "0W0f0D0~0Y0-", "cznie przejrzyj u", "iu suficient)Continua", "sta om du vill ladda ned de senaste installationsfilerna.", "CDlpResponseImpl > > >::GetState", "Infelizmente, estamos com problemas para determinar se o Windows 10 est", "w licencji, instalacja zostanie przerwana.wDo uruchomienia Instalatora potrzeba co najmniej 350 MB wolnego miejsca. Zwolnij miejsce, a nast", "to se dogodilo, ali ne mo", "t.qNepodarilo sa n", ", kad b", ". Tarkista se ja yrit", "Wybieranie obrazu", "n no pudo cargar los recursos de idiomaGEl programa de instalaci", " jour votre PC|La langue ou l", "\"ID de bo", "6`6{6", " suorittaa tietokoneessasi. Sulje asennusohjelma ja yrit", ".?AVCSetupDlpResponseFactory@@", "INSTALL_RECOVERY_IMAGE", "n den punkt d", "Fazendo alguns preparativos1Essa ferramenta n", "Sleep", "RegEnumValueW", "GetTraceEnableLevel", "CSetupResponsePageDiskSpaceReq::OnCleanMgrLinkClicked", ", mihin se sinulta j", "te probl", "0(181K1^1n1", "uvi internetam. Noklik", "10. Para ayudar a proteger tus datos, conserva el equipo contigo hasta que vuelvas a iniciar sesi", " luettelo ja yrit", "iimis.HUSB-m", " on teht", "Wszystko jest gotoweLInstalacja systemu Windows 10 b", "are disc.", "ga-IE", "paration", "jjk`jjk", "Henter opdateringer", "zda %1!s! bo", "s turpin", ">YYYKKKp", "fen Sie ihn, und versuchen Sie es erneut, oder verwenden Sie einen anderen Schl", " prawid", "Jetzt Upgrade f", ": https://aka.ms/windowsserverupgrade<", "rste gang, skal du angive en gyldig produktn", "zh-CN", "tfen Windows y", " den h", " nytt, fortsetter vi der vi avsluttet.$Denne PCen kan ikke kj", "z), bir Windows 10 ", "ver mer utrymme f", " en pc, der er designet til at k", "ditions sont incompatibles ;", "n Windows 10", ".text$di", "Priprema %d%%", "m seama dac", " et activ", " activado en el equipo. Esto quiere decir que necesitar", "tendre temporairement votre disque dur pendant l'installation des mises ", "t vesz ig", "=1=O=l=", " ir tikai 48 rakstz", "m polo", "SetBrushOrgEx", "o6%1!d!GB de espa", "v igen.%Windows er ikke aktiveret p", "z var. Biraz yer a", "vien kohteiden Windows 10 -yhteensopivuuden tarkistaminen voi kest", "000;0O0X0c0q0{0", " zgodno", "Turpin", "CDlpResponseImpl > > >::InitializeRoutine", "DataOnlyChecked", "buj uruchomi", ": %1!d!%% ", "CSetupResponsePageDiskPartition", "O@Pj Z", " @H!BXo", "avo, nato pa znova za", "0@ $A0", "installation", "prava: %d %%.$P", " Windows Server 2019e", "ru-MD", "ie faili tiks izdz", " Neste for ", "paration de l", " riuscito a determinare le scelte di installazione supportatePIl programma di installazione non ", "i cheia Bit Locker pentru identificator: *Windows necesit", "essayez, ou essayez une autre cl", "Getting ready %d%%", "t&Izv", ".?AV?$CZeroInit@VCSetupResponsePageRecoveryReq@@$00@@", "zyk nie jest zgodny", "riista k", "Izbor putanje", "7&717", "Se caut", "u pri bezprobl", "Wprowad", "liwe korzystanie z komputera. Zapisz i zamknij pliki przed rozpocz", "hZkV/f", "ita resurse jezika5Instalacija nije uspela da pokrene radni direktorijum\"Neva", "ge, nyissa meg a telep", "ramazu", ".idata$2", "ovat.", "Pt**", "0g0W0_0\"", "0!kn0Kb", "Installationen kan ikke forts", " kupi", " PC-en din, st", "erreur.", "su atjaunin", "sti vis", "BEGIN_FIRST_BOOT", ". XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX", "klemeye ", "s7Ha elutas", " danych migracji2Instalator nie mo", " Windows 10G", " systemu Windows 10.", "Bu arka plan indirmesi 4GB+ (de", "Por qu", " desea hacer?", "anai notikt raiti; tajos var b", "SiteLink", "Select a USB flash drivelThe files on your USB drive will be deleted. To keep these files, back them up now to another save location.", " non sono riuscito a riavviare il computer. Chiudi tutti i programmi aperti, quindi riavvia il computer. Riprender", "outil de cr", "Bu bilgisayar i", " a utilizar.", " podm", "Preuzmi\"Ponecha", "o foi poss", "progres", "installation et r", "ifrovania BitLocker funguje! Ke", "Ouvrir les T", "D$`+D$X", "elerin Windows 10 ile uyumlu olup olmad", "laikyti asmeninius failus ir program", "curit", ": %1!d!%%", "talujete teraz, v", "kas min", "lg sprog, arkitektur og udgave", "z de los medios de instalaci", "installation effectue un nettoyage avant sa fermeture.Cette op", "k igen.4Kontrollerar att datorn har tillr", "es, ne quittez pas votre PC tant que vous ne vous ", "darykite savo failus.(Palaukite, kol program", "Operacijski sustav Microsoft", "%hs(%d) tid(%x) %08X %ws", " dodato", "Izjava o zasebnosti za Windows", "i limba, arhitectura ", " Windows Server 2019`", ")Sto reinstallando Windows 10 in questo PC3Devo acquistare un codice Product Key di Windows 10", "rkeotsingu n", " https://aka.ms/windowsserverupgrade9", "ti-ER", "&Sule4Operatsioonis", "6>6y6", " cheie produs nu a func", "d pogre", "ntalo de nuevo.6Ejecutando scripts de implementaci", "elite instalirati Windows.", "ovanie in", "CSetupResponseTemplate::OnCancel", "owe parametry wiersza polecenia", "en-SG", "Izberite pogon USBfDatoteke na pogonu USB bodo izbrisane. ", "e datoteke, da boste lahko namestili najnovej", "inokite daugiau", ")(3CTq", "ane izbore instalacije > > >::GetResults", "dium, kter", "Si vas a actualizar Windows 7 o Windows 8.1 o si vas a reinstalar Windows 10, no necesitar", " Windows Server 2019. For at beskytte dine data b", "Se voc", "m reinstalling Windows 10 on this PC&I need to buy a Windows 10 product key", "re installasjonen av Windows bedre", "ili instalaciju sustava Windows.", "tter installationen av Windows Server 2019 i Windows Update.", "rt.&Kravene er fullf", "m Windows restartuje po", "vW[CQ", "dan ud: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.", "lni a telep", "rliecin", "IIDATx", "CSetupLangIniLoader::Initialize: Failed to get the language media number: index = %d. (hr = 0x%x)", "n como las aplicaciones, pero se conservar", "s abajo si quieres averiguar por qu", "\\vQ Rd", "as ier", "na posodobitev na Windows 10 je na voljo le v primeru, da imate v ra", "Dysk flash USB", "Unable to add Drive for selection [ %c ]", "Vl4Xp", "Schijfpartitie", "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> ", "dzie konieczne.", "De installatie van Windows kan niet worden voortgezet, omdat de benodigde installatiegegevens niet zijn gevonden. Start Setup opnieuw om het opnieuw te proberen._De installatie van Windows kan niet worden gestart. Start Setup opnieuw en probeer het opnieuw.", "unalnika. Preden za", "Windows 10 installeren9Updates, stuurprogramma's en optionele onderdelen ophalen", ".oCette cl", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceActionResponse@@@@@@", "o suficiente para continuar a instalar o Windows Server 2019. Experimente reiniciar a Configura", "se sprogressourcerne;Installationsprogrammet kan ikke initialisere arbejdsmappen", "sim atbr", "vate pripojenie ", " poursuivre l", "enje preinstall.cmd+Izvo", "jljai megmaradnak.LMinden t", " fjerne andre store elementer.", "000:0", "8==???//3", "MapWindowPoints", "%2!s!/Your organisation manages your update settings.", "z dilden farkl", "te si stiahnu", "SystemParametersInfoW", "&Zapri(Sistema Windows 10 nismo mogli namestiti_Va", "memset", "Acc&eptera inteHOm du v", "CoInitializeEx", "Lo que requiere tu atenci", ";&;-;4;;;B;I;P;X;`;h;t;};", ";2;G;c;v;", ", na kter", "`Y=.+", "sRimuovi l'unit", " criptografada com o BitLocker. Escolha uma unidade diferente e tente novamente.", " atualiza", "0?0N0W0v0", "Abrir Lixeira", " tomuto.", "tovat poplatky za p", "Apri Download\"Apri Impostazioni di archiviazione", "nju pre nastavka instalacije. Odaberite ", "tnete, instalace se ukon", "zdw^@l", "unar+Proveravamo da li je instalacija je spremna", ".zUporabe prostora za shranjevanje ni bilo mogo", "$bSr6'QF78S9", "une des options disponibles pour continuer.)Kreiranje medijuma sa izdanjem Windows 10(Slobodno nastavite da koristite ra", "i.0Windows 10:t", " naujo.", "#Windows 10 ", "gra saker att t", "laties dar", "Instaliraj Windows Server 2019", "+j*))!", "rXBGW", "jra a k", " probleme ", "Se pretende instalar o Windows 10 no PC pela primeira vez (ou instalar uma edi", "ndan Yenile se", "line (USB-muistitikku, DVD-levy tai ISO tiedosto) toiseen tietokoneeseen", "Izbiranje jezika, arhitekture in izdaje", "o instaladas, mas ", "PrepararQYa has solucionado el problema. Haz clic en Actualizar para quitarlo de la lista.fNos encontramos con un problema al intentar solucionarlo por ti. Actualiza la lista y prueba otra vez.", "Riprendi l'installazione", " Microsoft Corporation. All rights reserved.", "CSetupLangIniLoader::Initialize: IsDefault : %d", "tevajte spodnja navodila, da dokon", " preinstall.cmd se objevil probl", "ordinateur aura red", "Endre hva som skal beholdes", "t run down during the installation.", " lehet", "alinkite didelius arba nepanaudotus failus i", "te raz, skontrolujte inform", "n0eQKb", "{4cXx5", " installationsmediet. Hvis du ikke installerer disse opdateringer nu, vil computeren muligvis ikke fungere korrekt efter installationen, og du skal muligvis geninstallere nogle valgfrie funktioner og sprog.", "i ISO-fail) m", " dever", "dtexv", "Verificando o computador,Verificando se voc", "NW0~0W0_01", "Baixar atualiza", " mali ma", "Vous ", "jas kapcsolat haszn", "tfen bekleyin.", "0L0ckW0O0B0", " limpiando antes de cerrar!Esto puede tardar varios minutos.WConecte su equipo para asegurarse de que la bater", "Wijzigen wat u wilt behouden", "ivitykset tulevat voimaan. Uudelleenk", "ke: 0x%x]HInstalacija operativnog sistema Windows je nai", "ierele de pe unitatea USB se vor ", "%2!s! > > >::Execute", "Noe hindrer installasjonsprosessen. G", "e se kada se prijavite u Windows Server 2019. Da biste lak", "Prijavite se kao administrator\\Da biste koristili ovu alatku, morate se prijaviti u Windows preko administratorskog naloga.1Mora", "`{veQ ", " naujinimas", "::........:40", "4&454t4", "ja izveide", "is kodas0", "o.3Verificando se seu computador tem espa", "Select language, architecture, and edition", "ti vai no", "&{}K~[", "r notiek izie", "ClientToScreen", "'Persoonlijke bestanden en apps behouden7Windows-instellingen en persoonlijke bestanden behouden&Alleen persoonlijke bestanden behouden", " funkcie (odpor", "FoQTT", "vesti nereik", "rios. Certifique-se de que est", "CDlpResponseImpl > > >::Deserialize", "n de Windows Server 2019.?Continuaremos instalando Windows Server 2019 en Windows Update.", "t=Ja noraid", "<$<,<4<< >$>(>,>0>@>H>L>P>T>X>h>", "%1!ld!%% baigta", " Windows 10h", "ajte ponovno pokrenuti postavljanje.~Na", "emami diski", "agZ USB k", "Ei nyt", "ra om datorn har tillr", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "to se zatvori#Ovo mo", "nchidere", "lg et andet drev, og pr", "We are unable to continue due to one of the following:", "zu-ZA", "v igen.", "na verzija sustava Windows vjerojatno instalirana u nepodr", "m na tla", "bban m", ", DVD veya ISO dosyas", "Instalando Windows 108P8Z8", "Espere", " (%2!s!)c", "A&ceptar", "(%1!c!:) - %2!s! free", "e.9>D>U>b>p>", "m: %1!s!", "dami pad", "?\"?M?U?b?x?", "emy pom", "t take command line arguments. For more information, see Setup Help or run \"setup.exe /?\" in the root directory of your installation media.", "=B>O>y>", "Flytbare drev", ")UCsatlakoztasson egy olyan k", "1,1;1^1", "valo duomenis", "O(uY0", ", Windows 10", " Internet e tente novamente.0Executando scripts de implanta", "CInstallUI::ShowRollbackMsg: Posted MSG_INSTALLUI_SHOW_ROLLBACK_PAGE", "Prijavite se kao administratorWDa biste koristili alat, morate se u Windows prijaviti pomo", "a$Kontrola pripravenosti na in", " beskytte dataene dine b", "ssen Sie zur Installation das Medium erstellen und anschlie", "elite prekinuti?", "Obtendo atualiza", "CSetupResponseTemplate::OnSuspend", "%3!s!=Riavvio del programma di installazione di Windows 10 in corso", "Nav eti", "Prima di chiudere il programma di installazione, viene eseguita un'operazione di pulizia", "9^Ht(", "Summary", "nn-NO", " len osobn", "te.|Va", "si be", "labilir. Windows", ",Windows Server 2019 ", "paration de certains ", "tani, hogy van-e el", "in Geri D", ".?AVCRtfHelpDialog@UX@Common@ConX@@", " Elementy wymagaj", " preinstall.cmd$", " stato possibile scaricare tutti i file necessari. Verifica di essere connesso a Internet e riprova.7Esecuzione degli script di distribuzione preinstall.cmd6Esecuzione degli script di distribuzione precommit.cmd4Esecuzione degli script di distribuzione failure.cmd*L'operazione pu", "s..Ce PC ne peut pas ex", "Ne rien conserver", "ivati va", "DeleteCriticalSection", "CDlpResponseImpl > > >::DeserializeRoutine", "GLeoe", "rt! Trykk p", ", turite atkreipti d", "Termos de licenciamento", "re fois Windows 10 sur ce PC, vous devez entrer une cl", ", co se stalo, ale tento n", "chten.", "SetupDiGetDeviceInterfacePropertyW", "pa-Arab", "ku, kas atsitiko, ta", "rni&A term", "GB podatkov. ", " diegimo laikmenos ", "Odpri mapo Ko", "ce elementy.HPoni", "Andamento: %1!d!%%4Selecione uma das op", "jo Windows versiju, izmantojot produkta atsl", "A mover as suas defini", "1 caract", "Puede continuar usando su PC.", "ssel ein.4Geben Sie einen BitLocker-Schl", "d, ktor", "Sprache, Architektur und Edition ausw", "Nismo mogli najti informacij o namestitvi, ki jih potrebujemo za nadaljevanje namestitve sistema Windows. ", "VirtualQuery", "CSetupResponsePageBitLockerKeyValidate: DoDataExchange", "Voulez-vous vraiment quitter?", "ebovat k", " la execu", "tottak. A Windows 10 a t", "&Seuraava", "as tejto aktualiz", "3b2+b", "metros de l", "tted ja isiklikud failid$S", ")IgCMxC", "se eset", "\\\\\\[\\[[QQx8", "rvald", "t DVD vypalova", "sait ", "enite mo", "sd-Arab", ".Man ir j", " asennusohjelma uudelleen ja yrit", "am znova(Kupiti moram klju", ": certaines fonctionnalit", "USB-Speicherstick", "rge ilmnes toimingu \"%2!s!\" k", "```@@@@@@@@@@@@@@@", " yeniden bi", "!ID finestra di dialogo non valido-Non riesco a trovare il contratto di licenza.!Completamento operazione: %1!d!%%ZQuesto codice Product Key non funziona. Verificalo e riprova oppure immettine uno diverso.$Codice Product Key valido. Continua.", "km-KH", "cThe drive you", "Opret installationsmedier (USB-flashdrev, dvd eller ISO fil) til en anden computer", "\\\\.\\%c:", "&Nastavi", ">0>a>j>>?", ".?AVCSimpleWizardPage@UX@Common@ConX@@", "757B7X7e7", "DQyqGjH", " %1!s!", " poni", "o datoru t", "avancement : %1!d!%%6S", "000@@@", "buj ponownie.", "en Windows s", "re minst %1!d! GB eller st", " rije", " ``` ", " jour Nous pr", "0g0n0", " disponibile una versione pi", " pod uwag", " nainstalovan", "pet. Z", "tu.=precommit.cmd komut dosyalar", "Ovo mo", "ju (USB zibatmi", ".?AV?$CZeroInit@VCSetupResponsePageInstallChoice@@$00@@", "i deja Windows 10)Aceast", "GZ+Ik\\", "!7La@+!", "re currently using.", " v in", "rz no", " PC-en for f", "N@b:y:", "s dette, s", "e se nastaviti.", "fen Sie, ob zus", "Preuzima se Windows 10", "0@0h0", "r Windows 10. Wir stellen Ihnen gerne die neuesten Dateien zur Verf", "\"Bindestreker legges til automatisk\"Kan ikke laste inn spr", "250701214655Z0|1", "t+VW3", "vat jenom k p", "te za %1!d! min.(Rzeczy, kt", "dajov", "Kontrollerar datorn", "liorer l'installation. elles incluent ", "kus Windows 10 instal", "i conectat la Windows cu un cont de administrator.>Va trebui s", " func", "tirmeler, s", "040404B0", "vofflps.rtf", "i actualiz", "ste du f", ", so syst", "boru na stiahnutie je pribli", "9@:h:", "k og din arkitektur.", "rengini", "j dysk twardy na czas instalowania aktualizacji. System Windows nie b", "cie syst", "li, izmantojot %1!s!.", "Votre PC va red", "installationK", "tfen Disk Temizleme'yi a", "Download the latest version of Windows", "vel encontrar as informa", "r produktnyckeln fungerade inte. F", "&Pabeigt", "chec du chargement des ressources linguistiques par le programme d", "anu, nepiecie", "s programmas atinstal", "re plass, og pr", "aja i dodatne datoteke koje nisu u instalacijskim medijima. Ako ne instalirate ta a", "o do Windows e execute ", "tzm-Arab-MA", "tres, car vous avez choisi d", "stroje BitLocker funguje! Jestli jste p", "rtraukta. Atvainojiet, bet inform", "es apresentadas abaixo para concluir a atualiza", "ISO-Datei", "r klara", " preparado para continuar a instala", "ieraksta DVD.", "o mais recente para poder continuar.ATransferir a Ferramenta de Cria", " perdavimo mokes", ",aCg^w", "nt a precommit.cmd parancsprogramok futtat", "fr-MC", "ntalo de nuevo.'Windows no est", "e se li", "enite namestitveni program.k", "i din nou, sau ", "s pedig eszk", "iune poate dura c", "eW[g0Y0d", "Apri masterizzatore DVD", " cheie4Aceast", "installationeLe programme d", "&Priimti", "ti azt, kihagyhatja ezt a l", "ovat na webu Windows Update.", ",Naujausios ", ";);0;G;v;", "CDlpResponseImpl > > >::SetResponseName", "CSetupPageProgress", "ynnistet", "unar.", "5+5D5S5l5u5", " denne pc, og du geninstallerer det, kan du springe dette trin over. Vi aktiverer automatisk Windows, n", "ramad", "Odwied", " bent %1!s! laisvos vietos", " tem arquivos de instala", "cution des scripts preinstall.cmd.HUn probl", "< <,<8", "V instalaci se ned", ", naudodami ", "t data migrace.JInstala", "Conseils de d", ", nei naudojate dabar.nNegalite pasilikti fail", "i din nou.P", "gLadattujen tiedostojen kansion avaaminen ep", "Die Downloaddatei ist etwa 3 GB gro", " privatumo patvirtinimas", "La descarga tiene un tama", "Nim`A", "Diese Updates helfen bei der reibungslosen Installation und k", "1D1x1", "bbi tennival", "Me ei leia USB-m", " proizvoda sastoji se od samo 25 znakova.", "riista teie arvutis k", "administrateur[Pour utiliser cet outil, vous devez ", "Co chcete ud", "212A2T2", "lamad", "se eszk", "rez de l", "RtlAllocateHeap", "te pros", "5Nous ne parvenons pas ", "r die Ausf", "n de Windows detect", "Os arquivos em sua unidade USB ser", "line tietokoneeseen ja jatka asennusta suorittamalla setup.exe.", "veleten m", " co najmniej %1!d! GB. Wybierz inny dysk.", "ierele personale ", "%OHHHG99G%$", "o produkta atsl", " jste koupili na internetu.", "jiet instal", "Empezar desde el principio", "kt sist", "Obtener", "o conseguiu iniciar a instala", "o novamente.nPara obter mais informa", "7*7L7~7", " crea", "%s nije valjan znak", "urirati va", "teni a Windows 10-etPA g", "Varmistetaan, oletko valmis asentamaan", "%d caracteres restantes", "wA telep", "n'Kontrollerar att installationen ", " i wersj", "Si vous effectuez une mise ", "tenjem PC-ja.BInstalacija nije uspjela u fazi %1!s! s pogre", "vW0f0O0`0U0D0", "r det lukkes", " e riprova.C?V?o?", "te. Aby je zachowa", "iuos veiksmus. Spustel", "st, ha felk", ")Code d", "n de Windows descarga actualizaciones", "Flere oplysninger", "asemasta poistetut tiedostot pysyv", "llningar eftersom din aktuella version av Windows eventuellt installeras i en katalog som inte st", "o.oPrecisamos de pelo menos 350 MB de espa", "mas.!Acest PC nu poate rula Windows 10", "hlen Sie ein anderes externes Speicherger", "i nen", "bad allocation", "O ID do Di", " Windows 10 medyas", "nnen nicht beibehalten werden, da Sie ausgew", "5!5)5|5", "ds*Det gick inte att verifiera produktnyckeln9Det g", "Pentru a recapitula, a", "ri utilizarea spa", "t-f9>t(Vh", "zelebb csatlakozik az internethez, a Windows aktiv", "%s(%d): Result = 0x%X", "vX[>e", "@@@@@@", "i computerul. Instalarea Windows va continua automat.", " continuar tendo problemas, mencione o c", "ks saadaolevatest suvanditest.", "CreateThreadpoolTimer", "%1!ld!%% valmiina", " di aggiornamenti6Verifica della disponibilit", "c tam restart", "$Windows ", "i osobne datoteke i aplikacije1Zadr", "Ne sada", "r a g", " %1!s! dans une langue diff", "2788kppqPPPnib]", "jies.&Nevar", "lls.8Allt tas bort, inklusive filer, appar och inst", "Siin on m", "o do Windows 10 para funcionarem corretamente. Depois de esta ser reiniciada, retomamos a partir do ponto onde t", "r online for at hente opdateringer, drivere og valgfrie funktioner. Disse opdateringer hj", "est pas prise en charge par cet outil.", "PW0f0D0~0Y0 ", "'_B%!", "ta oper", "s rendszergazdak", "$+.CC|", "Olvassa el a szerz", "Aktion an der zuvor erreichten Stelle fortsetzen", ". Visos teis", "s ginamos.", "tta aega.$Oodake, kuni installiprogramm sulgub", "6]6d6", "nnen wichtige Fixes, aktualisierte Ger", "vHr,g", "Als u Windows 10 voor het eerst op deze pc wilt installeren, moet u een geldige productcode van Windows 10 invoeren.", "Reprendre d", "ti6Sisestage BitLockeri v", "n, onko Windows 10 viel", "0g0W0_0-", "anjem posodobitev. Windows ne bo znova oblikoval zunanje naprave za shranjevanje, zato jo lahko po dokon", "da no ", "cution7Scripts de d", "Speichereinstellungen ", "cken Sie ", "Instalacija operativnog sistema Windows 10", "ieb z", "lectionnez l'image que vous voulez installer.", "rengin", "These updates will help the installation go smoothly, and can include important fixes, updated device drivers and additional files which are not on the installation media. If you don't install these updates now, your PC might not function properly after the installation and you might need to re-install some optional features and languages.", "jumi. Sist", ")CCCDDEIEFFFnDDF_", "ration %2!s!", " girmeniz gerekiyor.", "lida do Windows 10.", " prostora@Potrebno je %1!d!GB slobodnog protora na disku za resurs (%2!s!)", "Nu am g", " asigura c", "anja sistema Windows 10. Poskusite znova zagnati namestitveni program.", "CSetupLangIniLoader::Initialize: %d languages found.", "o resultar", "0[0W0~0Y0", "nud#Tootev", "ajte ponovo.+Windows 10 jo", " jazykov", "dz atkal esat pierakst", "e name", "0@$$?/", "%s nu este un caracter valid", "Licencne odredbe", "elite instalirati.", " datorn (enhet %2!c!:)HV", " automaticamente.", "Arhitektura se ne podudara", "%2!s!;Sua organiza", "! Devam d", "g`O/f,{", "kkelen fungerer! Fortsett n", " haluat tehd", " necessario hardware avanzato. Alcune funzionalit", "tes pas reconnect", "den y", "Descargar actualizaciones, controladores y caracter", "Windows Setup will go online to get updates, drivers, and optional features. These updates will help the installation go smoothly, and can include important fixes, updated device drivers, and additional files which are not on the installation media.", "94989P9T9X9\\9`9d9h9l9p9t9x9|9", ":6;e;", " pour reprendre l", "CDlpResponseImpl > > >::Initialize", "p tov", "ra vilken version av Windows du k", "ani, da ", "ban legyen vele, mit fogad el.", "elite uporabljati to orodje, morate biti v sistem Windows vpisani s skrbni", "%hs: couldn't get host product name", ";v<8v", "lL7Ki\"0", "ite upotrebu skladi", "sa6A Windows-be", "s facultatives. Ces mises ", " Windows 8.1, ", " gjort nogle f", "ny percig.lNem siker", "ine t", "Kohaldatavad teated ja litsentsitingimused", " Windows\" ", "%WINDOWS_LONG%", "Sistema Operacional:", "2:2W2r2", ";#;6;D;Q;u;", "CreateSolidBrush", "Vorbereitung", "lasszon az el", " chcete nain", "ine actualiz", "CSetupResponsSelectMediaFormat", "1R1g1", "s restart", "rer til ekstra utgifter.-Hvilke andre oppdateringsalternativer finnes?", "teva ori. Procesul poate dura un timp.(A", "o da instala", "echno m", "Verwisselbare stations", " deve baixar e executar a vers", "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageSelectImageImpl.h", "Ihre Dateien, Apps und Einstellungen k", "dos. Para manter esses arquivos, fa", ": 0x%x]8", "k igen.&K", "taVRu", " %2!s! wolne", "<$<@::IsBackEnabled", " de produit que vous avez saisie n", "<% > > >::Serialize", "enie probl", "rlopp: %1!d!%%6Forts", "n de si las cosas que quieres conservar son compatibles con Windows 10 puede tardar algo de tiempo.yEsta clave de producto solo se puede usar para agregar caracter", "Pomoc techniczna", "0Bunun yerine harici depolama kullanmak istiyorum%Harici depolama kullanmak istemiyorum", "<)<73Q3c3", " kullanamayacaks", "r Windows 10 nedan, eller avsluta installationen, aktivera Windows och starta installationen igen.", "t pour ce PC/Nous nous assurons que l", "93:S:`:z:", "mtar uppdateringar", "ben tartsa mag", "5g5t5", "ServerHPC", "n solo si vas a instalar Windows en un equipo dise", " recenti.", "s de Windows 10 n", "Promenite na", "r datorn,Jag beh", "68<$?JJJ````KKKKK|KK|<[", "llet0Jag vill inte anv", "Sto preparando: %d%%", "sitsi.", "z saklan", "ssel funktioniert! Setzen Sie den Vorgang fort, sobald Sie soweit sind.", "Arkitekturen matchar inte", "ve already dealt with this. Click Refresh to remove it from the list.cWe ran into a problem while trying to sort this out for you. Please refresh the list and try again.", " bir harici depolama cihaz", "%1!d!%% baigtae", "ado; alguns recursos existentes foram modificados ou removidos; o Windows 10 ", "tani, hogy k", "iti podprtih mo", "toarele motive:", "VU5Hi", "Opgrader denne computer nu", "0Ik wil Windows 10 opnieuw installeren op deze pc3Ik moet een productcode voor Windows 10 aanschaffen", "Oba`Ten klucz funkcji BitLocker nie dzia", "Os ficheiros na pen USB ser", "De pc wordt verschillende keren opnieuw opgestart. Dit kan even duren.", "o para atualizar", "essayez.EUn probl", "Neder", "%s no es un car", "cej miejsca2Potrzeba %1!d! GB wolnego miejsca na dysku (%2!s!)rUsu", "iu-Latn-CA", "unalnik na viri napajanja, da se baterija med name", "5a5h5n5s5", " a Windows Server 2019.", "+Unesite BitLocker klju", "L$,_^[3", "o da Unidade", "- ISO ", "jHhBf|v", "7$7,747<7D7L7T7\\7d7l7t7|7", "ati datoteke, aplikacije i postavke jer instalirate izdanje sustava WIndows koje se razlikuje od onoga koje trenuta", "tCela peut prendre quelques instants pour v", "a pas pu d", "CSetupResponseTemplate::ExecuteRoutine", " gravar o arquivo ISO em um DVD mais tarde.", "R EX[", "Prenesi posodobitve, gonilnike in izbirne funkcije (priporo", "Install Windows 10", "t, jo esat izv", "]..%Fo", "rskendatakse tugiteenuste pakkumise perioodil automaatselt. Tugiteenused v", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX)", " Windows 10#", "\\ddld|hx", "Installerer Windows 105Din pc genstartes flere gange. Det kan tage lidt tid.#Vens, mens installationen afsluttes", "SI INFORM", " 4GB ", "x_jPA", "IDATh", "s reinicia la instalaci", "_wcsicmp", "Espera7Hubo un problema al ejecutar scripts de preinstall.cmd.6Hubo un problema al ejecutar scripts de precommit.cmd.", "Avaa Lataukset", "o eliminadas, mas os seus ficheiros ser", ";!;@;_;~;", "pQw]}]\"", "7!7&717;7@7T7b7j7q7w7|7", "ivityksen Windows 7:st", "rankai nepavyko i", "Ne zadr", "ll personliga filer och appar1Beh", "es A procurar atualiza", ".((%2!s!)", "Selecionar uma pen USB", "e se odstran", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationActionResponse@@@@@@@@", "owe wyja", "5 6p6", "imalusi on v", ":-;Y;m;", "CInstallUI::FormatResourceString", "CSetupResponseTemplate::OnSuspend", "o estamos a conseguir determinar se o seu PC consegue executar o Windows Server 2019. Feche a Configura", "Laufwerkauswahl5Setup f", "vel kapcsolatos tov", "Den udgave af Windows, der matcher den angivne produktn", "i.\"Pute", "Tas var ilgt vair", "LoadStringW", "?Klju", " kter", "Nedok", "eni! Pritisnite Nastavak)Odaberite drugi vanjski ure", "Instalar o Windows 10", "ialit", ";&$??+", " executando o Windows 10", "%hs: Dialog initializing - DownloadReq.", "jet igen.7Der er opst", "ppp000", "ete pokra", "&Godta", " ominaisuuksia Windowsiin. Sit", " &Seg", "Ladda ned uppdateringar, drivrutiner och valfria funktioner (rekommenderas)", "tse a list", "PREPARE_FIRST_BOOT", "!This program cannot be run in DOS mode.", "rinstal", "eHeW[&{8", ">PUUOHHHHGE9$", "Kan niet doorgaan met de installatie omdat de computer niet opnieuw kan worden opgestart. Sluit alle actieve programma", "ku-Arab-IQ", "939C9Q9k9z9", "vate.%In", "DIEGIMO INFORMACIJA: daliai ", "Dieser Hintergrunddownload kann ", "N9Y-N Rd", "pokra", "Instaliranje sustava Windows 10", "trukti.", "kai u", "10 wird vorbereitet. Dies kann einige Minuten dauern.", "iunile de instalare acceptate'Instalarea nu a validat cheia de produsGInstalarea nu poate determina versiunea de Windows pe care o executa", "sti. Lai patur", "PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "vyko netik", "te v PC dostatok miesta na pokra", "Oppdatering for Windows 10IKan ikke ", "W~~~~V~VUU", "l vagy Windows 8.1-r", "Supporto", "geket2A telep", "CREATE_FILE", "Unidades extra", "o nestes itens.", "as mantener el equipo contigo hasta que vuelvas a iniciar sesi", "la#6k0", "charger les fichiers d'installation les plus r", "onnistui. Avaa tallennustila manuaalisesti asetuksista.?Roskakorin avaaminen ep", "unalnik name", "ionale (recomandat)", "&Abbrechen", "6!6,666I6e6p6", "Atsvaidzin", " atkursime, kai prisijungsite prie Windows Server 2019", "oc-FR", "ch ni", "inot par ", "%2!s!2Nastavitve posodobitve upravlja va", "ncepe instalarea Windows 10.", "wt$\"evu", ">#?:?L?a?q?y?", "Oprettelse af Windows 10-medie0Du kan stadig forts", "o do Windows encontrou um erro inesperado.", "hlen Sie \"Aktualisieren\" aus.", "%Rn0 ", "t datus, turiet PC datoru tuvum", "t. Nyissa meg manu", "ptitud. Valige m", "sticas y las mejoras de seguridad m", "t egy term", "n. Esta ventana se cerrar", "Uppdateringarna har installerats, men installationsprogrammet f", "This background download can be 4 GB+ (may vary) and Internet access fees may apply. Click Next to download the latest installation files.", "USB izbrisivi memorijski pogon", "rile ", "sa. A Windows Server 2019 telep", "555uuu588", "Si est", "Windows Setup ", "i programul DVD-writer", "i kasutage ruumi vabastamiseks kettapuhastust, seej", "Nainstalovat Windows 10/Z", "UnmapViewOfFile", "s a be", "essayez.\"Windows n'est pas activ", "Izbor slike", "der inte kommandoradsargument. Mer information finns i hj", "de-CH", "sr-Latn", " nekoliko napomena:", "FveIsRecoveryPasswordGroupValidW", "nak aktiv", "e izbrisane, ali va", ")R(ug0M0", "Keele, arhitektuuri ja v", "sik sz", "kkulcs nem m", " reiniciado em alguns momentos", "-Aktuelle Version von Windows", "bory.", "1 caractere restante", "zania?", "&Nastavi(Instaliranje sustava Windows Server 2019", "Preuzimanje najnovije verzijetDostupna je novija verzija ove alatke. Da biste nastavili, morate da preuzmete i pokrenete najnoviju verziju alatke.,Preuzmi a", "lieties citu ", " preinstall.cmd1", "tn-BW", "initi. Ovaj ", " samo malo", "to spre", "CSetupPageBase", "|_RIQ", "ama Windows 10 produkta atsl", "Nepavyko rasti diegimo informacijos, reikalingos norint toliau diegti ", ":*:6:M:V:j:q:", "GetSaveFileNameW", "sw-KE", "SetRectEmpty", " ativado neste computador", "OF:{n", "CreateDCW", "ete ho pros", "nstalleerdUUw pc is weer helemaal zoals deze was voordat Windows Server 2019 werd ge", "eni namestitveni program za Windows Server 2019", "Unerwarteter Fehler bei der Windows-Installation. Stellen Sie sicher, dass auf die Installationsquellen zugegriffen werden kann, und starten Sie die Installation erneut.", "!D$DVf", "CSetupResponseTemplate::GetResultsRoutine", "%d caratteri mancanti", "&Installi", "te k internetu. ", "jiet: %1!s!", "%WinDir%", "1$1+10191@1E1N1U1Z1d1h1n1u1|1", " olan Windows yaz", "ts darb", "kmak istedi", "elite prekiniti?", "dia Windows 10*Vous pouvez continuer ", "cii Windows Servera 2019 v slu", "Atnaujinti ", ",+�", "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel", "e koristiti samo za dodavanje zna", ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXXR", "x!qHe", " %2!c!.mJei ", "n tus archivos.OSe eliminar", "GlobalUnlock", "r-e.)Milyen egy", "Verifica la compatibilit", " to, ", "Ezek a friss", " Microsoft Corporation. ", " dit USB-drev bliver slettet. Hvis du vil bevare filerne, skal du sikkerhedskopiere dem nu p", "nl^w!", ". Otev", "n no puede decirte qu", "rge l", "Preostao je jedan znak", "n, voiko Windows 10:t", " dostupn", "hrte Windows-Version nicht ermitteln.*Fehler bei der Installation von Windows 10", "#Zachowaj pliki osobiste i aplikacje", "Particija na disku", "emo nastaviti zbog jednog od sljede", "r~akow", "ma Windows nav aktiviz", "cDet kan ta en liten stund att kontrollera om det som du vill beh", "iendamise kohta leiate lisateavet siit: https://aka.ms/windowsserverupgrade", "241A04B0", "lj vilka media du vill anv", "Instalar %sEWindows est", "du laiku.XWindows 10 atjaunin", "Storage UseLManually explore your storage usage in settings to remove other large items.!Select an External Storage Device", "[Koda napake: 0x%x]APri namestitvi sistema Windows je pri", "sze elementy wymagaj", "gt, um die Installation von Windows Server 2019 fortzusetzen. Starten Sie Setup erneut.", "0W0j0D04X", " nejde zachovat, proto", ", voici ce que vous avez choisi de faire", "CSetupLangIniLoader::Initialize: Language name : %s", "r Windows 10. Vi kan hj", "Instalacijski program ne prihva", "ni minut.kK", "Sigur ie", " Windows avec un compte administrateur.;Par la suite, vous devrez graver le fichier ISO sur un DVD.", "i modul ", "latamad", "nost %1!s!.", "ajte ponovno.", "ckh_YS", "tigen mindestens 350 MB Speicherplatz zum Ausf", "Tai gali trukti kelias minutes.mKol diegiama ", "re Windows Server 2019", ";&R>X>_>", "Immettere la chiave BitLocker", "unalnik", "[Cod de eroare: 0x%x]5Instalarea Windows a ", ":0L0v0", "rer.'Installation af Windows 10 er mislykket", "i apoi s", " stato interrotto.0Non ", "Sprawdzamy, czy wszystko gotowe do instalacji", " Windows 10R", "sWindows", "a0R`O", " informacji dotycz", "FveCheckSuspendBitLockerOnUpgrade", "1 1$1(1,1014181<1@1D1H1L1`1d1t1x1", "lathoz, ", "Sistem Windows v tem ra", "nika systemu Windows 10(Mo", "i continua f", " versi", "_ftol2_sse", " spreman za va", "ra. Ind", "e informacija o nadogradnji operativnog sistema Windows Server posetite: https://aka.ms/windowsserverupgrade", "installation et essayez ", "vel no seu idioma e arquitetura atuais.", "li byste m", "0f0O0`0U0D0", "es em %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para resolver o problema e execute a Instala", "hlen Sie ein externes Speicherger", "Deze download wordt op de achtergrond uitgevoerd en kan meer dan 4 GB zijn (dit kan vari", "r; Windows 10 destekleme d", "gle virker ikke. Pr", "*())-\\t", " sudaro tik 48 skaitmeniniai simboliai.", "unaru , a vi obavljate ponovnu instalaciju, mo", "n, consulta la Ayuda del programa de instalaci", "CreateSetupObject", "nosti za posodobitev?", "3Introduce", "lat je", "O idioma n", "r datorn. Det inneb", " bandote naudoti, u", "Produkta atsl", ".?AVIDlpAction@@", "uhkmAKK", "Selleks v", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX:", "Nesten klar", "ste du s", "Ei ole varmaa, onko tietokoneessa riitt", "LIDATx", "dku. Dal", "unalniku (pogon: %2!c!)_Izberite ali priklju", "gebbi verzi", " olabilir veya Windows'un eski bir s", "u!j-Xf", " recenti di Windows 10 nel PC. Spazio su disco insufficiente. Libera spazio e seleziona Aggiorna.", "ngere har brug for, eller brug Diskoprydning til at frig", "iam kompiuteriui", "najte po", "e nastaven", "kkelig plads p", "re version de Windows 10", "6(6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "mu Windows 10 budeme pokra", "gra minuter.`Anslut datorns n", " informace", "tirme bulunamad", ".8DVD ", "CoUninitialize", "u alatke ", "Ha Windows 7-r", "t find the installation info we need to continue installing Windows. Restart Setup to try again.ESetup couldn", "0g0M0", "Als u Windows 10 (of een andere editie) voor de eerste keer op uw pc installeert, hebt u een Windows 10-productcode nodig.", "Przygotowywanie (%d%%)", "Neatbilst valoda", "enoZTento k", "ivitysten asentamisen ajaksi ulkoisella laitteella, kuten USB-avaimella, SD-kortilla tai ulkoisella kiintolevyll", "kleyemiyoruz. G", "5Zadajte k", "ConstructPartialMsgVW", "se2A meghajt", "Windows 10 installimine?V", "Jezik se ne podudara", "ge.?USB-flashminnet m", "APostanowienia licencyjne dotycz", "ordinateur pour qu", "o na fase %1!s! com um erro durante a opera", " vous avez d", "mas.*Acest PC nu poate rula Windows Server 2019r", ", kol diegiami naujinimai, naudokite i", "Provera ove ", "=0=@=Z=v=", "&Schlie", ".CRT$XLZ", "kenleri almaz. Daha fazla bilgi i", "rt atkritni. L", "et et problem under download af nogle filer", "des apliecin", " %s > > >::Cancel", "ck(W8h", " pripraven", "Naprej", "Die Architektur stimmt nicht ", "n.tLa clave de Bitlocker tiene un formato similar al siguiente: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX ", "J30_,", " tuettuja asennusvaihtoehtoja(Asennus ei voinut vahvistaa tuoteavaintaCAsennus ei tunnista tietokoneessa k", "ISO datoteka", "is produkto kodas neveikia. Patikrinkite j", " %1!ld!%%", "karmak i", "030J0g0", ".#Windows 10 ", "Zadat k", "ldre installationsfiler", "_ftol2", "lassza ki a part", "Introducir clave de BitLocker", ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@@@@@", "asa.bKonfiguriranje posodobitve za Windows 10", "xh-ZA", " cheieSAceast", " pronto per continuare l'installazione di Windows 10. Prova a riavviare il programma di installazione.qNon ", "```@@@@@@```", "3+3M3", "Partici", "~Nismo mogli prenesti vseh potrebnih datotek. Preverite, ali ste povezani z internetom, nato pa znova poskusite zagnati orodje.*Pri zagonu tega orodja je pri", "jlra a telep", "buj ponownie.6System Windows nie zosta", "FindResourceW", " funkcionira! Nastavite kada budete spremni.", "Bude to n", "rvieto", "vetelm", "du Product Key nen", "(Estou a reinstalar o Windows 10 neste PC5Preciso de comprar uma chave de produto do Windows 10", "n systemenheten.", "enje diska.", "Declaraci", " Internet", "Perskaitykite ", "uriranja su instalirana, ali se program za instalaciju sustava Windows 10 mora ponovno pokrenuti da bi postala funkcionalna. Kada se ponovno pokrene, nastavit ", "d Product Key pre Windows 10 alebo ukon", "issue de la mise ", "Uscire?", "in %1!s!", "PripravaKZa to ste ", " jonkin aikaa.jT", "CInstallUI::SwitchToErrorPage", "chargement\"S", "6&7?7", "Patientez", "D$`#N", " nebo nepou", "Wybierz no", "&Zatvori;Va", "#Preinstall.cmd ", "ppna papperskorgen. ", "\\[[[Z[VMMMMMJ@=%\"\"D", "uab l", "EventUnregister", "= =2=s=", "Sv5X2?", " polo", "unalnik.", " pietiek vietas, lai turpin", "=$=<=T=l=", "re felf", "re Windows 10. Luk Installation, og pr", "sszes sz", "Tip til fejlfinding", "installation, puis r", "iona ", " zabezpe", "^^_$>0>P>\\>|>", " a impedir a instala", "Dlaczego to widz", "8(808@8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "dzenia.", "Installa %s:Sto riavviando il computer per continuare l'installazione.", "Atlasiet valodu, arhitekt", "da-DK", "Brug ", "ProblemaGPara instalar o Windows 10, clique em Setup.exe na m", "n ve yeniden deneyin.0Windows 10, bu bilgisayar i", "o estamos a conseguir determinar se o Windows Server 2019 j", "Sprog:", "e naprej lahko uporabljate ra", "Hva vil du gj", "021R1[1p1", "o suficiente para continuar a instalar o Windows 10. Tente reiniciar a Configura", "tko OK restartuje po", "Select Image", "Open DVD burner", "cie nevybila.", "Loo installikandja (USB-m", "jlok megtart", "der comme suit :", "i su tro", "FEdldlx", " instalowanie systemu Windows Server 2019 w us", "Mora da bude najmanje %1!d! GB.", "i (ieteicams)", ", SD ", "Neatbilst izdevumi", " Setup.exe p", "3>DI\\+", "ll ingenting", "Preparando %d%%", "r bakgrundsnedladdningen kan ", "0o0B}", " souboryBOdeberte velk", " zmluvu.", "anjem sistema Windows ne boste mogli uporabljati ra", "kkel og velg deretter Oppdater.", "tan ba", "n ve yeniden deneyin.*Windows bu bilgisayarda etkinle", " sucedi", "shoz le kell t", "Nous pr", "re installasjonen av Windows.", "@ ;F uZ", "7 7,7L7T7\\7h7", " dabartine kalba, atitinkan", " vanhempia asennustiedostoja", " exclu", "Unidades amov", "Please input bit locker key for the identifier: ", "tkame Windows Server 2019 installimist Windows Update", ". Zadejte pros", " meghajt", "i Windows 10", "r tiek instal", "l, hogy a let", "EDenne produktn", "rformat", "fo-FO", "kleme i", "H~U~UUUUUUUHUHHHHEGG88", "\\[[cNn", "rskendused aitavad installimisel ladusamalt sujuda ning v", "%1!s! %2!s!*Wyst", "dpanel-azonos", "Atlas", "0n0_j", ".idata", "%1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ", " o instala", "r du loggar in i Windows Server 2019. Skydda dina data genom att ha datorn i n", "dos da unidade do sistema.", "Meiryo", ".?AVCSetupResponsePageSelectImage@@", "ver g", "o. Se n", " voi k", "F0Vh0", " toimi asennuksen j", "es-NI", "zda tutmal", "ilita isiklikud failid ja rakendused$S", "-Nn0 ", "r die Installation", "Tuoteavaimen pit", ">eW0f0O0`0U0D0 ", " ponownie instalatora.", "5;6h6", "Az aj", "%1!s! %2!s!8Er is een probleem opgetreden bij het maken van de media{De editie van Windows die overeenkomt met de ingevoerde productcode is niet beschikbaar in uw huidige taal en architectuur.", "ar-AE", "stroja. Ak chcete pokra", "?Nastavitve sistema Windows boste lahko upravljali tudi pozneje.RVa", "MFC42u.dll", "yK{{[c:", "t, vagy ", "FillRect", "Weryfikowanie pobranych danych", "n de Windows Server 2019;Reiniciar el programa de instalaci", "g: %1!s!", "n actual de Windows mediante una clave de producto y luego selecciona Actualizar.", "Flytter dine indstillinger %d%%", "POST_OOBE", "0#0W0w0", "cznie obszar Magazyn w aplikacji Ustawienia..Nie mo", " l'installazione di Windows automaticamente.", "labilir s", "6$6R6", "s de reiniciar, seguiremos desde donde lo dejamos..Este PC no puede ejecutar Windows Server 2019.", "#'6'6'66'666'#*", "va 1 znak'K", "o est", "ga nedarbojas. Izmantojiet citu atsl", "imai ir licencijos s", ", aby bylo mo", "Kontroll", "vcu.+ISO s", "ak sa chyst", "c!8w,", "laties sist", "?4?C?Y?h?~?", " naujo paleiskite s", "fil-PH", " at batteriet ikke brukes opp under installasjonen.", "2019K", "ana tiks aizv", "CDlpResponseImpl > > >::CheckUserInterrupt", " system Windows.", ": 0x%x]6", "Soubor ke sta", "chten, ist mit BitLocker verschl", "se folyamatban van. A Windows nem form", " sa zhoduje so zadan", " bio instaliran i aktiviran na ovom ra", "ywane pliki z folderu Pobrane.", "\\j0O0h0", "dzie kontynuowana w witrynie Windows Update.^Konfigurowanie aktualizacji dla systemu Windows 10", "$Defises tiks pievienotas autom", "kih programa i opcijskih zna", ".2Windows Server 2019 ", "Sunte", " na %1!ld!%%", ", jo %2!s! oper", "~_NzM", "zellikleri almak i", "#Nie mo", "ete v", "o necessita ou utilize a Limpeza do Disco para libertar espa", " PC-ul", "Ingen", "Na disk jedinici koju poku", "IsWindowVisible", " Windows, ", "glen for gruppen %d er forkert. Angiv en korrekt n", "njenje, potra", "vel se tiver uma c", "gas v", " dost", "Lejupiel", "Uklonite ovaj spoljni disk i kliknite na dugme ", "sit se jako spr", "ranka ", "Invalid command line parametersqWe couldn", " ukladacie zariadenie", "BitLocker protection will be suspended during this update, and will resume when you sign in to Windows Server 2019. To help protect your data, you should keep your PC with you until you sign in again.'We couldn", "es, vous devriez conserver votre ordinateur avec vous jusqu", "te na instala", "li system Windows 10 zosta", " prostora3>F>V>l>{>", "Keel ei sobi", "es, controladores e funcionalidades opcionais. Estas atualiza", " de uma chave do produto (Product Key) do Windows 10.", "0~0W0_0", "w precommit.cmd.", " &Haluan auttaa kehitt", " izdelka ni deloval. Vnesite drug klju", ".?AV?$__func@V@@$$A6G_NPAXI0II@Z@__function@wistd@@", "%3!s!4Reiniciando el programa de instalaci", "Vypad", "A Windows telep", "Valoda", "ke, podr", "GetTickCount", "lg en af f", "(%1!c!:) - %2!s! bo", "Veuillez s", "Selectare unitate", " do nast", "r Windows ansluter till Internet f", "CSetupResponseTemplate::ExecuteRoutine: Next button clicked.", "ekajte da zavr", "3M4^4", "nTa bort f", "t1uk0d0D0f0o0", "installation de Windows 10 dans Windows Update.`Configuration de mise ", "lectionner Image", "n ott folytatjuk, ahol abbahagytuk.2Ezen a g", "n de Windows Server 2019 debe reiniciarse para que funcionen. Despu", "dzu, uzgaidiet, l", "CSetupResponseTemplate::ExecuteRoutine", "Atjaunin", "imu.CUSB flash disk mus", "&Prihvati", "ZKontrola kompatibility toho, ", "&Concluir", "djon arr", " utilizez stocare extern", "es recomendadas para este PC", " starsz", "CSetupResponsePageDiskSpaceReq::OnLearnMoreLinkClicked", "Ein Problem ist aufgetreten.XKlicken Sie zum Installieren von Windows 10 auf dem Installationsmedium auf ", "hren des Befehls ", "CSetupResponsePageBitLockerKeyValidate::CSetupResponsePageBitLockerKeyValidate", "_a>OD", "Language", " ve ki", "i ce s", "<9=p=w=~=", "o pode usar seu computador enquanto o Windows ", "TargetISO", "S0n0 ", "s reciente de Windows 10", "emt vair", "ta nije uspelo. Ru", "t.;Az Adathordoz", " hardware. N", "GetPrivateProfileSectionW", "Escribe la clave de Bitlocker", "Instalac", "0j0D0g0O0`0U0D0", "Server", "Seleziona la partizione in cui vuoi installare Windows.", " obecnie u", ", nes dabartin", "Tato akce m", "Wenn Windows 10 zuvor auf diesem PC installiert und aktiviert war und Sie eine Neuinstallation durchf", "s versijas lejupiel", "gesini manuel olarak ", "ajte ponovo.'Windows nije aktiviran na ovom ra", "1(2;2", "4=5i5", "%s installerenGDe computer wordt opnieuw opgestart om door te gaan met de installatie.", "Fichier ISO!S", " valida. Continua.", "eddef", "rateur %2!s!", ". Paleiskite s", "r att installationen g", "Nie mamy pewno", " izdelka za Windows 10.", "n a que la instalaci", "zyka lub wydania wersji systemu Windows zainstalowanej obecnie na tym komputerze.", ": %1!s!", " DVD ", ".?AVCWebBrowser@UX@Common@ConX@@", "installation n", "trukti.xDiegiant ", "o porque o Windows n", "c restart", "to sledi.ZBitlocker izgleda otprilike ovako: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX2BitLocker klju", " przerwano.ANa tym komputerze nie mo", " potrebn", " funkcie a jazyky.", "cuter la version la plus r", ".?AV?$CZeroInit@VCSetupDialogDownlevelInstall@@$00@@", " z tego narz", "m apenas 48 caracteres.?O valor de chave %d de grupo ", "re om Windows Server 2019 er klar for PC-en din n", "ynnistyksen j", "ouverture de votre dossier T", "Partycja dysku", "[1N39", "0`0Q0k0", "ku. Nap", "ib olla installitud toetuseta kataloogi v", " soubory", " instalace. Vy", "k igen.3Windows Server 2019 ", "Pre nedostatok miesta na disku nem", " narz", "Downloads8Remove large or unused files from your Downloads folder.", "=+>F>y>", ". Folytassa a telep", "Pasirinkite skaidin", "=\\=c=j=v=", "e ni pripravljen za ta ra", "La protezione BitLocker verr", "o atual do Windows, voc", "gle.HProduktn", "te desc", "rifiez-la et r", " naujo..S", "Windows 10 kandja loomine(V", "PreuzimanjaCUklonite velike ili nekori", "eCette cl", "Leelawadee UI Bold", "anai ", "ku Windows versiju.fDisk", "ktu instal", "Declara", "ISO-tiedosto", "ji si zjist", "cija v", "s varam pal", " ne funkcionira. Provjerite ga i poku", "ntr-un director neacceptat sau ", " tento po", "e se povezati sa mre", "pet vissza", "gumu.", "&Osve", "Architektura", "Elija que medio usar", "Kui j", "DuplicateHandle", "n. St", "%2!s!=Din organisation administrerer dine opdateringsindstillinger.", " komputer i uko", "tuves iestat", "nnen es nach Abschluss der Installation entfernen.:Die Anforderungen sind abgeschlossen! Dr", "i nebo zkou", "installation.ULa cl", "o para tentar novamente._A Instala", "anas izv", "rieure de Windows.zLe lecteur que vous essayez d", "NWindows Server ", "jat pirmo reizi, ir j", "n de almacenamiento.", "Veja abaixo se quiser saber o motivo.", "installation.#Cela peut prendre quelques minutes.", "Arhitektuur ei sobi", "nd de ", "A&nnuler", "ts-ZA", "irties.", "%hs: Dialog Initializing - Gated Unknown", "X,VgYV", "e da potraje nekoliko minuta.", "dia se objevil probl", "e obejmowa", "zerindeki bilgileri g", "ploiement precommit.cmd en cours d", ".idata$5", "ServerStandard", "s, mais vos fichiers le seront.NTout sera supprim", "lkeen oikein ja sinun on mahdollisesti asennettava jotkin valinnaiset ominaisuudet ja kielet uudelleen.,Utiliser les anciens fichiers d'installation", "iadavky boli splnen", "[Hibak", "2,3l3", "ExpandEnvironmentStringsW", "ndirmeniz do", "(Tento k", "emo tamo gdje smo stali.-Na ovom se PC-ju ne mo", "rifiez-la, puis r", "NtQueryWnfStateData", "nk a feladat elv", "040904B0", "Microsoft Time-Stamp Service0", "elite namestiti Windows 10, kliknite datoteko ", " de produit Windows 10 valide.", "Redmond1", "VoorbereidenQDit hebt u al gedaan. Klik op Vernieuwen om het item uit de lijst te verwijderen.UEr is een probleem met deze bewerking. Vernieuw de lijst en probeer het nog een keer.", "tirme, yaln", "p kijel", "s\"A Windows adatv", "), reikia tur", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "s biztons", ">*>@>N>d>", "2'242=2M2d2p2{2", "ete da ga uklonite po zavr", "l operacijos %2!s! klaidos", "Vor dem Update sind einige weitere Schritte erforderlich. Sobald der Vorgang abgeschlossen ist, werden Sie benachrichtigt und ", "rankio j", " listo7Vamos a seguir instalando Windows 10 en Windows Update.VConfigurando la actualizaci", "Niets behouden", "tom. Kad se pove", " instalacji, poniewa", "Asenna Windows 10", "9$909T9\\9d9l9t9|9", "nicu da se tijekom instalacije ne bi potro", "CurrentIP", "eno je %d%%", "v igen.*Windows 10 er ikke klar til denne pc endnu'Kontrollerer, at installationen er klar", "Kirjaudu j", "r%E~&B", " rula", " il tuo PC1Sto verificando la disponibilit", " nebeidzas akumulatora ener", "ywana wersja.", "#USB ", "0~0Y0)", "o.*Requisitos Conclu", "9`9t9", " najnowsz", "bs-BA-Latn", "Ja veiksit jaunin", "o sa toto zobrazuje?", "Odaberite put", "teva minute.", " din pc pga. manglende diskplads. Frig", " cheie.", "354w4", "n tietokonettasiUT", "a e avisos aplic", "6<6D6", "reiz j", " entrar nele novamente. Para recapitular, voc", " pronto para continuar a instalar o Windows 10. Tente reiniciar a Configura", "-Ladda ned den senaste versionen av Windows 10", "rKak0;b", "v at genstarte Installation.", "ajte ponovo da pokrenete alatku..Do", "s a Windows 10 leg", "6$6V6", "Installatiemedia (USB-stick, dvd of ISO-bestand) voor een andere pc maken", "emo da utvrdimo da li na ra", "n vagy a v", "laszt", "Koristite vanjski ure", "lt, ez", "cia Windows Servera 2019 zlyhala In", " o seu PC para ser executado no modo S. Escolha esta edi", "WaitForThreadpoolTimerCallbacks", " bitlocker ", "iama ", " sa stiahnut", "ll.BA(z) %d. csoport kulcs", "CSetupResponseTemplate::OnCancel", " ISO ", "Windows-privacyverklaring", "s;Ezzel az eszk", "velet k", " USB-", "ke: 0x%1!lX! - 0x%2!lX!", "Papirkurv>T", "elite ohraniti, jih varnostno kopirajte na varno mesto.", "V[VVMMMMM>%%\"%\"\"?", " kullanmaya devam edebilirsiniz.", "unalniku dovolj prostora*Ali ", "000PPP", "cution.Cette op", "ticamente1La clave de producto solo contiene 25 caracteres.", "Segoe UI Semibold", "Jh~bVf-P", "To recap, you", "m~Vydanie Windowsu, ktor", "505X5{5", "n priz", "kkel for Windows 10", "ne Windows 10 funktsiooni kasutamiseks on vaja lisav", "stroje. Abyste mohli pokra", ": :D:L:T:\\:d:l:t:|:", "nderen kunne ikke ", "ku DVD diskov", "8'8;8E8L8R8W8c8s8", "tta. Granska informationen i %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml f", "o existem?", "s nevar", "0A$$@/", "2x(uiR(", "quc-Latn", "memmove_s", "FreeLibrary", "vU_-N", "080@0H0P0\\0|0", "::IsBackEnabled", "Verifiserer nedlastingen Velg hvilket medium du vil bruke", "Eiga: %1!d!%%6Nor", " jour ?!Pourquoi ce message appara", "rtu diska t", "ments suivants n", " \"\"-@6-\" ", "sentait avant le d", "Me ei saanud salvestada installimisteavet, mida on vaja Windowsi installimise j", "u pievieno", "cia pripraven", " kapsayabilir.", "neet asennustietoja, joita tarvitsemme Windowsin asennuksen jatkamista varten. K", " da dove ", "bory, aby ste mohli nain", "t k instalaci Windows.", "Nous devons effectuer d", "Most nem", "n necesaria para seguir instalado Windows desde donde lo dejaste. Tendr", "mes, signalez le code d", ".?Votre cl", "BEGIN_SECOND_BOOT", "l az eszk", "stroje BitLocker m", "r att ta bort det fr", "pule viidud", "ivitage oma installikandja juurkaustast fail ", "digo de erro quando contactar o suporte ao cliente.", "i o versiune mai veche de Windows.zUnitatea pe care ", "pa en Windows 10-produktnyckel", "Pozosta", "ifru pogre", "n no pudo empezar a instalar Windows. Reinicia el programa de instalaci", "Posodobitve so name", "Jau naudojate ", "nju na ovo ", "outil.:Un probl", "rifiez que vous ", "Der BitLocker-Schutz wird w", "juVh(", "If you continue without activating your current version of Windows, you", "No se encuentran los archivos de instalaci", "n automaattisesti(Asennus ei voinut ladata kieliresursseja'Asennus ei voinut alustaa ty", "es Manter apenas ficheiros pessoais", " verzi.2St", "tirmeden sonra Windows 10'u etkinle", "o e tente novamente.#O Windows n", "u yeniden ba", "\"Microsoft Window", " dzia", "/~=sd", "lle sisse logite.=Operatsioonis", ">)>A>Q>g>u>", "\\:N`O", "kustannuksia.#Mit", " z listy.UPodczas za", "ico.3Prenesite posodobljeno orodje za ustvarjanje medija", "%1!d!%% abgeschlossen", "6;6H6V6]6c6h6s6~6", "o ou execute ", "lja meg ", " PC-en. Aktiver den n", "ouverture du graveur de DVD. Veuillez graver manuellement le fichier ISO sur un DVD ", "Ett tegn igjen(Produktn", "ADVAPI32.dll", "Pole kindel, mis juhtus, kuid me ei saa seda t", "rankai nepavyko inicijuoti darbinio katalogo%Neleistini komand", ". Daugiau informacijos rasite s", "nosti Microsoft0Vyhl", "Ar tikrai norite baigti?", "ierele necesare. Asigura", "CDlpResponseImpl > > >::GetResults", "Melkein valmista", "no pokrenite %1!s! da biste otvorili alatku ", ": %1!d!%%6", "WARNING", "rheten tills du loggar in igen.0Det gick inte att installera Windows Server 2019ZDatorn har ", " problem podczas tworzenia no", "ilo se n", "sr-Latn-CS", "SO toto ste sa u", "tik a telep", " %1!s! (%2!c!: ", "iului de stocare. Rula", "zca ki", "ujete sa sustava Windows 7 na Windows 8.1, ili ponovno instalirate Windows 10, ne", "[hQ'`9e", " tyto aktualizace nenainstalujete, nemus", "0~0_0o0 ", "rolnia egy Windows 10-term", "CDlpResponseImpl > > >::CheckUninitialized", ".?AVIDlpResponseFactory@@", "'?DD````S|STRR\"", "Ja Windows 10 dator", "CSetupDialogBase", "rer %1!s! sur le lecteur %2!c!:.", "rjar./V", " do zainstalowania systemu Windows.", "zVi kan ikke sige, om pc", " ```", "r att aktivera Windows 10 efter uppdateringen.", "Zainstalowanie tej wersji systemu Windows 10 spowoduje skonfigurowanie komputera do dzia", " navr", " jednotku a sk", " ir spustel", "l elt", "1Ponovno pokretanje instalacije izdanja Windows 10", "ne hetke.uSeda tootev", "CDlpResponseImpl > > >::Initialize", " zainstalowane, ale aby zacz", "Semmi/Lehet", "i o edi", "lj vad du vill beh", "Instalacijski program malo posprema za sobom prije zatvaranja", "lg et andet drev.", "cente version de Windows", "aurez pas besoin de cl", "itajte ovo da biste znali na ", "tani a telep", "rsniegt 4 GB (var at", "&Turpin", "Media Creation Tool", "Sprawdzanie komputera", "6,6D6\\6x6|6", "lineell", "Failed to get free space for drive [%c]. Error: [0x%X]", "IOtvaranje mape Preuzimanja nije uspjelo. Ru", "Aby se dalo v instalaci pokra", " Vai tie", "y}gg2i", "&Fermer.Votre PC va red", "chten, sollten Sie sie jetzt an einem sicheren Ort speichern.", "t Windows iestat", " precisa estar conectado ao Windows usando uma conta de administrador.9Voc", "i mai t", "mogatott telep", "n de Windows 10.", ".idata$3", "Forbereder installation ", "unalnik ne more izvajati sistema Windows Server 2019cDraiv, mida proovite kasutada, on BitLockeriga kr", "iti jezikovnih sredstev>Namestitveni program ni uspel inicializirati delovnega imenika#Neveljavni parametri ukazne vrstice", "Preverjanje tega klju", "ller bara 25 tecken.", "des manu", "it instala", "ri.pDeschiderea inscriptorului de DVD-uri nu a reu", "j-X9E", "paration en cours", "CInstallUI::ShowExitingSetup", "787?7O7Y7x7", "daki harici s", "0De koppelstreepjes worden automatisch toegevoegd'Het laden van de taalbronnen is mislukt+Het initialiseren van de werkmap is mislukt!Ongeldige opdrachtregelparameters", "o somente se voc", "rbaud", "&Chiudi%Non ", "cia Windows Servera 2019. Pok", "daki y", "no si budete musie", "ydy. Aseta Windowsin asennustietov", "re reinstalling Windows 10, you won", ">YDlC", ". Windows ", " aktivovan", " doar dac", " Windows 10c", "V redu", "toru sa nepodarilo pou", " obtenir les derniers fichiers afin de garantir que vous installez la version la plus r", "lieties ", "En son s", ">.>;>Q>^>p>}>", "es-EC", "pade, ", " kopij", "Idioma", "Overuj", " attivato automaticamente al termine dell'installazione.$Installazione di Windows Server 2019=Riavvio del programma di installazione di Windows Server 2019", "Download updates, drivers and optional features (recommended)", "Na re", " avec BitLocker. Choisissez un autre lecteur et essayez de nouveau.", "iunile de mai jos pentru a termina actualizarea.'Elibera", "dakilere dikkat edilmesi gerekir.@Y", "emtu no saraksta.]M", "\\W0J0", "iame kompiuteryje anks", " un error no esperado.", "Comprobaci", "Odaberite particiju na koju ", " partir de Windows 7 ou Windows 8.1 ou que vous r", "ek0o0zzM0", "est produit lors du t", "2&3J3n3", "ploiement preinstall.cmd2Ex", "m Windows toto extern", "pa en Windows 10-produktnyckel eller -licens f", "0n0k0", "tL0B}", "iniet citu. ", "Windows Server 2019 Setup)Windows Server 2019 Setup opnieuw starten", " medio se usar", "as diska kr", "lectionner la partition sur laquelle vous voulez installer Windows.", "noton komentosarjoja5Suoritetaan precommit.cmd-k", "0@$$>/", "Ikke sl", "|T|R|RRRRRM1", "Nyckeln kontrollerasYDen h", "jak takto: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX6Kl", "ltima vers", "ajke sustava Windows 10 ni sigurnosna pobolj", "ng alla ", "tkamiseks valige ", "No drives found", "SysListView32", "F|Pje", ", om Windows 10 er klar til din pc endnu. Luk installationsprogrammet, og pr", "alej pou", "&Hylk", " kullanarak ge", "kove.$Koje su druge mogu", ": %d#Br", " @@@@@@", "N.FR?", "9*:8:Y:c:", "z pabeigts", "r telep", "# y4TJ", "ete nain", "etku instalacije.9Zahtevi su dovr", "rej chcesz zainstalowa", "%s installierenCWindows startet den Computer neu, um die Installation fortzusetzen.", "This background download can be 4GB+ (may vary) and internet access fees may apply. Click Next to download the latest installation files.", "Levyosio", " soubor", "i Windows 10 pe acest PC pentru prima dat", "iului-disc redus. Elibera", "z anahtar", "DWindows ", "de-LU", "dokon", " klucz produktu", "z gerekir.7ISO dosyas", "te si pros", "cii br", "?%p!Gn", "ncia\"Escolher o suporte de dados a usar", ".?AV?$CZeroInit@VCSetupDiskSpaceDlpResponseFactory@@$00@@", "Ouvrir les t", "s sat", "avons pas pu installer Windows Server 2019", "uriranja", "?8?S?c?}?", " prie", "Microsoft YaHei Bold", "Privacyverklaring", " se aktualizace. Zji", "Ekran &Klavyesi", "en-PH", "oAA instala", "ia versiunii de Windows care este instalat", "unara", ";3;[;", "ierele de instalare Windows. Introduce", "en (eller installerer en anden version), har du brug for en produktn", "unaru,Moram da kupim ", "i operaci %2!s! do", "a pentru clien", "ne datoteke i aplikacije(Zadr", "|=9t$", "A procurar atualiza", " de groupe %d n", " possibile determinare se Windows 10 ", "Sprogene stemmer ikke overens", "e masz po", "ngre beh", "?/?L?R?[?g?", "(DFIIIOOppppOOOka", "t vyu", "No mantener nada", " k internetu, a zkuste to znovu.+Spou", "A preparar a configura", "izmanto", "000@@@PPP", "rednio sprzed rozpocz", "lja n", "o do Windows Server 2019. Tente reiniciar a Instala", ")Es wurde kein USB-Speicherstick gefunden.", "tkata?~Teie faile, rakendusi ja s", " budete pripraven", "tions arr", "ar-JO", "SelectedDUOptIn", "dHm0o", "Windows 10 installiprogramm", ". Jo negalima naudoti diegiant ", "Windows 7", ";:<@.>t>", "kalu uudelleen.*T", "laszthat", "X~xhpp", "i anlam", "Produktnyckeln ser ut ungef", "%1!ld!%% dovr", "cia instalacji systemu Windows Server 2019.WB", "7*7P7", "o.`Susid", " disk, a do", "Cette cl", "owy identyfikator okna dialogowego%Nie mo", "\"Dashes will be added automatically/Setup has failed to load the language resources4Setup has failed to initialize the working directory", "winbrand.dll", "tenje sa najmanje %1!s! slobodnog prostora", "tottak vagy elt", "iame kompiuteyje gali b", "Actualizaci", "no ho pou", "NEz a term", "Vous ne pourrez pas utiliser votre ordinateur pendant l", "Windows 10 installieren", " la mise ", "Ange BitLocker-nyckeln", "Installer Windows Server 2019.Cette op", "&Weiter", " diegiate pirm", "CSetupResponsePageBitLockerKeyValidate: OnOSKBtnClicked", "es que precisa de analisar", "Ninguna etiqueta", "diegti senesn", "ti.CTiks dz", " BitLocker ile ", "ivitab Windows arvuti.", "&Geri", "6D6J6Q6", "echny pot", "j-Xf9", "CSetupUIManager::~CSetupUIManager", "tekli", "Papildinform", "/#<,v@WH", "ia naujinimus", "chte stattdessen externen Speicher verwenden.-Ich m", "LagringsbrukRUtforsk lagringsbruken manuelt i Innstillinger for ", " Even kijken wat er moet gebeuren", "|Q|SRRRRRN", "jljait, alkalmaz", "r endast tillg", "Prenesite najnovej", "v/fHr,g", "Installationsprogrammet rydder op, f", "nico. Cuando te conectes a Internet, activaremos Windows por ti.", "&Bildschirmtastatur", " soubory a aplikace+Zachovat nastaven", "lamadan ", " Windows 100", "?(?8?K?^?q?", "ngen beh", "rt! Tryk p", "n en Windows 10. Para ayudar a proteger tus datos, deber", "ller dig, hvad du s", "onnistui. Ota k", "anje sistema Windows 10 bomo nadaljevali v storitvi Windows Update.[Konfiguriranje posodobitve za Windows 10", "OpslaggebruikYBekijk het opslaggebruik handmatig via Instellingen om andere grote items te verwijderen. Extern opslagapparaat selecteren", "Vytvo", "&Fertig stellen", "Velg ekstern lagringsenhet", "bory. Ak chcete tieto s", "unalo za nekoliko trenutaka ponovno pokrenuti", "hoz helyezze be a Windows telep", "re oppdateringen.)Frigj", "x5:$*", "i ales s", "hemalt 350 MB kettaruumi. Vabastage kettal ruumi ja proovige siis uuesti.AOper", "555(433", "g nem telep", " system Windows nie mo", "es-AR", "dhat.", "t cit", "nimo.", "gP}_g", "i se va relua c", "Elle ressemble ", "Entfernen Sie bitte das folgende externe Laufwerk, und klicken Sie auf ", "3(4@4", "sik part", "Za&instaluj", "na bak", "s parametrai", "Atsisiun", "BitLocker-skyddet pausas under uppdateringen och ", "no odprite mapo ", " katalogu roboczego)Nieprawid", "kkelen ser slik ut: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX4Bitlocker-n", " podczas instalowania.", ":a5L.Y", ": %d%%\"D", "zh-Hans", "RW0f0O0`0U0D0:", "ff-Latn-NG", "essayez.ENous allons ensuite vous aider ", "8aX`^i/-JR;M", "7;7^7", "cii Windows Servera 2019. Sk", "IsValidCodePage", "94:::J:Z:j:z:", "jumi ir instal", ">$>D>P>p>|>", "ke. Provjerite je li pristup instalacijskim resursima mogu", "- PC ", " BitLocker ne contient que 48 caract", " nem kezel parancssori argumentumokat. Ha b", "avons pas pu ex", "kat tapasztal, forduljon az ", "ovat a aby se mohlo zachovat va", "let. K", "zt.#Hiba t", "Sag>k", " podporovan", "ane.CSve ", "re fois (ou une autre ", "Licences nosac", "r diesen PC noch nicht bereit./Sicherstellen, dass die Installation bereit ist", "6/6;6T6^6w6", "n ve ard", "tter vi der, hvor vi kom til.!Denne pc kan ikke k", "teva aspecte de care trebuie s", "|l|Vx", ".?AVAFX_MODULE_STATE@@", "tani a g", " produkto kod", "7C7e7", "Rg\"x:y%O;V", "M@VMM@OE4~", "hr-BA", "i.9Windows Server 2019:", "6'''''''''''", "Complete", "Selecionar Imagem", " Microsoft Corporation. Vse pravice pridr", "?#?(?%\"\"\"!x", "chr-Cher-US", "cu extern", "nda pilinizin bitmeyece", "tfen ba", "ta5Windows postavkama ", "'Neplatn", "rtslDen h", " Iestat", "t tell if your PC has enough space to continue installing Windows 10. Try restarting Setup.$Making sure your PC has enough space-Do you want to continue using this selection?", "p]]]$", "Selecteer de partitie waarop u Windows wilt installen.", "Vi kan ikke afg", "Aggio&rna", "Keep personal files and apps(Keep Windows settings and personal files", "rskendage loend ja proovige uuesti.", " poder", ";$;7;f;", "tirme yap", " identifik", "oikeus, jotta voit aktivoida Windows 10:n p", " kullan", "avons pas pu installer Windows 10.}Nous avons remis votre ordinateur dans le m", "o livre", "e enkrat poskusiti, znova za", ":,:4:8:T:l:", " Windows 8.1 ", "ete.1Nismo mogli namestiti sistema Windows Server 2019[Ra", "s, nous ne pouvons pas d", "chargement de Windows 10", "re den seneste version for at forts", " necessario il tuo intervento per completare queste operazioni.`Per continuare l'installazione, ", "Adatv", "Asenna Windows Server 2019", "Gatavs instal", " nytt. Installasjonen av Windows vil fortsette automatisk.", "Dette kan tage flere minutter.YS", " Kosza. Otw", "GetVolumeInformationW", "Nismo prona", "pne lagringsbruken. Du m", "ra om datorn ", "t izmantot ", "a/Ta klju", "CSetupUIManager::OnActionChanged", "Produkto kodas", "%1!s! %2!s!8Pojavio se problem prilikom stvaranja medijskih sadr", ">99yaa", " introduce", " saattaa kest", "6'6/6A6l6z6", "en-ID", " internet. ", " pronta", "Windows 7 veya Windows 8.1.", "in, tekrar oturum a", "LocalAlloc", "USB-flashstation", "s le red", " scripturile de implementare preinstall.cmd4Se execut", "tt genom att v", "$99898886#t", "veic v", "pen, mert kev", "8 8$8<8@8X8h8l8|8", "ru un izdevumu", "bi, et teaksite, millega te n", "n Windowsin asennusta", "tanje postavki (%d%%)", "s papildomai mok", "kkulcsra lesz sz", ":5:C:q:", "DeviceIoControl", "Tarkistetaan p", "e je bil sistem Windows 10 v tem ra", "?$?,?4?::IsBackEnabled", " @@@ppp", "ib kuluda m", "uriranje", "i-l pute", "uga automat-Cheia de produs con", "dami apsaugoti savo duomenis, tur", " possibile trovare un'unit", "<5><>", "kleyemiyoruz. A", "Arkkitehtuuri", "nun yeniden ba", "n ya da yer a", "Otvori stavke za preuzimanje", "fy-NL", "No se pudo instalar Windows 10YSe ha establecido el equipo al estado anterior al inicio de la instalaci", " para retomar a instala", ".|Jei reikia daugiau informacijos apie ", " de %1!d! Go ou sup", "mu Windows. Nemo", "om-ET", " pronto para seu computador. Feche a Instala", "jra fog indulni. Ez a folyamat hosszabb ideig is eltarthat.", "o gerencia suas configura", " k internetu a zkuste n", " riuscito a pulire i file di installazione`Il programma di installazione non ", "n de failure.cmd!Esto puede tardar varios minutos.", "Yg0M0~0[0", " baigs ", "rification de la cl", "QSVW3", "as in", "rliecinieties, vai ier", " jenom 48 digit", "8(8C8N8i8t8", "Download opdateringer, drivere og valgfrie funktioner (anbefales)", "lb-LU", "ivitys noudattamalla alla olevia ohjeita.*Vapauta %1!s! tietokoneessa (%2!c!:-asema)QValitse tai liit", "marrage de l", "e bude nutn", "[-NKb", "Instalacija operativnog sistema Windows ", "Nincs", "l/^94", "te instalarea ", " ting, vi er n", "n timp ce am ", " (se razlikuje) in morda bo treba pla", "mentaires.0Quelles sont les autres options de mise ", "hist Interneti-", ".?AVCSetupResponsePageUpdateMedia@@", ". Ukon", ", kuriuose reikia atsiminti:", "/@-$A0", "ntalo de nuevo.8Ejecuci", "rio raiz da m", " sur cet ordinateur. Ceci signifie que vous devez saisir la cl", "eni! Kliknite na dugme da biste nastavili1Odaberite drugi spolja", "ete instalaciju.rZa pokretanje instalacije je potrebno najmanje 350 MB prostora. Oslobodite deo prostora, a zatim poku", "rile: %1!d!%%,Aceast", "Izbor disk jedinice", "6L7R7j7v7", "lectionner un chemin", "Error reporting telemetry for bToggledtoExternalStoragePage = %d: [0x%X]", "marrer l", "gle fungerer ikke. Pr", "62xmm", "Nekaj prepre", "ke programe i dodatne zna", "iek tiek u", "W0f0K0", "nstalleerd op uw pc wordt niet ondersteund door dit hulpprogramma.", " do za", "re installationsprogrammet. Frig", "et til. Du skal angive oplysningerne igen senere.8Installationsprogrammet kan ikke anvende overf", "NKNMR-N", "ver eller anv", "Pobierz najnowsz", "PPP ", "ka bir anahtar girin.?Bitlocker anahtar", "Uporabi priporo", "&Folytat", "hDost", "rt DVD rakst", "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X", "tkame sealt, kus me pooleli j", "SET_PRODUCT_KEY", "ciu Windowsu 10 zak", "vojiet dator", "es-VE", "Recapitulando, optou por:", " jour, les pilotes et les fonctionnalit", "te na po", ".\"Zvolte m", "cijai rad", "ste to znova.", "INSTALL_RECOVERY_ENVIRONMENT", " bilmiyoruz. Kurulum'u yeniden ba", "t work. Please check it and try again or try a different key.3Your product key works! Continue when you", "hr-HR", "digo de erro: 0x%1!lX! - 0x%2!lX!", "tireXV-a", "Dette kan tage et par minutter.bDu vil ikke kunne bruge pc'en, mens Windows installeres. Gem og luk dine filer, f", "gle fungerer ikke med denne udgave af Windows. Pr", "?'?]?n?", "anas programma pirms aizv", "243n3", "Tarkistetaan tietokonetta&Varmistetaan, oletko valmis asentamaan", "ticamente durante el per", " verificato un errore durante la risoluzione del problema. Aggiorna l'elenco e riprova.", "as diska atlas", "gon produktnyckel.", "ej klucz produktu systemu Windows 10 lub zako", "\"Vi finner ikke en USB-flash-enhet.", "en-US", "Dla bie", "ajte ponovno. > > >::UpdateState", "rjon be minden fut", "2L2g2", "CoTaskMemAlloc", " Bitlocker ", "De taal of editie van de versie van Windows die momenteel is ge", "ie disc", "se. A Windows Server 2019 telep", "10 requi", " klucz produktu lub licencj", ". To znamen", " de BitLocker n", ": 1\"K", "Chiave BitLocker", "Ins&talar", "Ava(Soovin kasutada hoopis v", ", aplikac", "BitLocker-suojaus keskeytet", "Se ob", "it!Se instaleaz", "qtYzt", " el equipo para ejecutarse en modo S. Elige esta edici", "Deschidere6Doresc s", "t cea pe care o utiliza", "dzu, palaidiet %1!s! manu", "unalnik pripravljen za nadaljevanje name", "CDlpResponseImpl > > >::UpdateState", ".?AVCSpinningProgress@UX@Common@ConX@@", "nce temizleniyor!Bu i", "4 4$4(4,4044484<4@4D4H4L4P4T4X4h4p4t4x4|4", "0@P$A0", "e da prelazi 4GB+ (", ".?AV?$CZeroInit@VCSetupCompatDlpResponseFactory@@$00@@", "%1!s! %2!s!)Do", "=4>\\>", "ar-EG", "lassza ki, mit szeretne megtartani", " a tentar utilizar n", "fr-SN", "klemenin sorunsuz ", " Windowsin asetuksesi, henkil", "ku, jums ir j", "/?$$@/", "informations", "toru sa nepodarilo inicializova", "rjestelm", "sait, mert a %1!s! telep", "Impossible de conserver vos param", "bn papirkurven manuelt.MLagerforbruget kunne ikke ", "line ja suoritettava asennus sit", "CSetupResponsePageCompat::InitializeDownloadResponsePageRoutine", "tte, og dine Windows-indstillinger, personlige filer og apps kan bevares.KF", " naudojate.", "luseade on valmis", "unalo. Zatvorite sve pokrenute programe pa ponovno pokrenite ra", " nytt.1Her er et sammendrag av hva du har valgt ", " pe PC. Activa", "SNo se pudo abrir la carpeta de descargas. Abre la carpeta de descargas manualmente.[No se pudo abrir la grabadora de DVD. Graba el archivo ISO manualmente en un DVD con %1!s!.", " prep", "veis para continuar.", "zi %1!s!. P", "i v PC m", "Esta transfer", "m haklar", " laste ned og kj", "%s ni veljaven znak", "Er wordt eerst netjes opgeruimd voordat Setup wordt gesloten", "iti ima li na PC-ju dovoljno prostora za nastavak instalacije sustava Windows Server 2019. Poku", ", do ktorej chcete nain", "tfen ", "s a atualiza", "n avaaminen ep", ".2Windows 10 ", "sto n", "o, ativar o Windows e, em seguida, iniciar a configura", " na %1!d! %%\\Tento k", ".?AVCCriticalSection@@", "ni muu v", "+>@@@>", "Ona izgleda otprilike ovako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "&Manter aplicativos e arquivos pessoais;Mantenha as configura", "ams br", "jo iki pradedant diegti ", "rojamie pazi", "Arhitektura se ne ujema", "1(141@1L1X1d1p1|1", ".BToliau diegsime ", "CDlpResponseImpl > > >::CheckUninitialized", " za sme", "0F0k0-", ".\\%s.mui", "Forts", "uje nadaljevanje name", "k a BitLocker-v", "n &JB", "em.;Bitlocker klju", "ncia n", " informacji instalacyjnych potrzebnych do kontynuowania instalacji systemu Windows. Uruchom ponownie Instalatora, aby spr", "+|'T*", "9C:U:s:", "z gerekir.", " seu dispositivo de armazenamento externo e voc", "g0n0 ", "ifrelenmi", "m|z{LV", " saglab", "iniet citu.", "ani, kaj se je zgodilo, a tega orodja v va", "D$@WP3", "in bilgisayar", " leidim", "Hr,g ", "i aten", ".Installin Windows 10 sellesse arvutisse uuesti%Mul on vaja osta Windows 10 tootev", "i cheia BitLocker", " miksi.", "CSetupResponsePageGated", "7$747D7T7d7t7", ", kad ", "sa2Tov", "marrage du programme d", ";!;.;;;H;U;s;", "w.CWarto", "s futtatnia kell a leg", "jiet: https://aka.ms/windowsserverupgrade", "gbar ist.*M", "unar. Zatvorite instalaciju i poku", "tica de privacidade do Windows", "t tiedostot Lataukset-kansiosta.", "ia scripturilor precommit.cmd.", "CDlpResponseImpl > > >::CheckUninitialized", "inde ne yapt", "Vyberte odd", "Folyamat: %1!d!%%7A folytat", " possibile determinare se lo spazio nel PC ", "}", "<'<5 > > >::GetResponseName", "ed zah", "unalo", "El programa de instalaci", " ancora pronto per questo PC$Verifica dell'installazione in corso", "che la poursuite de l", "Az ISO-f", "%hs: Dialog initializing - InstallReq.", "o consegue reiniciar o computador. Feche todos os programas abertos e reinicie o computador. A instala", "Dators tiks vair", "mu Windows. Re", " encriptada com o BitLocker. Selecione uma unidade diferente e tente novamente.", "6D6Y6", " jour, ainsi que des fichiers suppl", ", nie je dostatok miesta. Vyberte in", "Stiahnut", "mu Windows sa vyskytla neo", "}W0f0O0`0U0D0", "Bruk en ekstern enhet, for eksempel USB-n", "Tai gali ", "kilo problema vykdant precommit.cmd scenarijus.", "n tietokoneeseen$Varmistetaan, ett", "Saveti za re", "ili.,Windows 10 sa v tomto po", "i instalovali a aktivovali u", "vesti ", "Namestitev sistema Windows 104Pridobite posodobitve, gonilnike in izbirne funkcije", "ssel wird ", "r det er genstartet, forts", "Liko simboli", "Devo riavviare il PC pi", "r din dator ", "Kui kavatsete ", "BitLocker korumas", " trouver un lecteur flash USB. Actualiser la liste des lecteurs(Sa taille doit ", "a nije uspjelo. Ru", "%d Zeichen ", "se sikertelen", "Co&ncluir", "re dette verkt", "&Finish", "t disku sarakstu%T", " Windows Server 2019", "z.\"Windows Server 2019", "Quase pronto", "zda bulundurun:", "o limpou os ficheiros de configura", "1 character left", "Pt+h,", "niku instalacyjnym.", "e ispravno funkcionirati nakon instalacije i mo", "diegti kai kurias pasirinktines funkcijas ir kalbas.", " proizvoda za Windows 10 ili iza", "ajte ponovno.5Instaliranje sustava Windows Server 2019 nije uspjelo(Instaliranje sustava Windows Server 2019", "s atsl", "anas m", " disk po", "9Felk", "Preparing setup ", ".?AVCEdit@@", "Ako Windows 10 na PC namjeravate instalirati prvi put (ili instalirati drugo izdanje), trebat ", "Ange produktnyckel", "es agora, o seu PC poder", "les1Palikti ", ".?AVCDialogEx@UX@Common@ConX@@", " w innej lokalizacji.", "sa el", "yorum(Windows 10 ", "e uruchomi", "{|||{{qokg_[S", "USB flash disk", "mplat, dar nu am reu", "ploiement failure.cmd.Cette op", "sta, aby se dalo pokra", "taluje sa Windows Server 2019", "^(uck(W", "amd64", "[Kod b", "k ki Windows 10'un bilgisayar", "istit soubory instala", "o do Windows Server 2019-Reiniciando Instala", "ti. Ko vzpostavite povezavo z internetom, bomo aktivirali Windows.", " v nepodporovanom adres", "w wdra", " valido. Immetti la chiave corretta2Immetti la chiave BitLocker per l'identificatore: (Spazio necessario per aggiornare Windows", "?1?V?{?", "%d merkki", "Quedan %d caracteres(Los guiones se agregar", "tte installationen af Windows 10. Pr", "CInstallUI::Quit", "20201008074426.155Z0", "Nismo prepri", " jour : %1!d!%%.Cette op", "ite selle etapi vajele j", " program a zkuste to znovu.:Syst", "[\\\\\\[\\[[[MJ@VM@MJ@O", " Microsoft Corporation. T", "enia. ", "hnout v", "o do Windows transfere as atualiza", "nd en extern enhet, t.ex. en USB-nyckel, ett SD-kort eller en extern h", "nda filer fr", "&Slutf", "Apsilankykite: %1!s!", "&Dalje", ", a znova spustite in", " varias veces. Esto puede tardar un poco.", "000ppp ", "Geri D", "l|vWw", "o. Clique em Atualizar para a remover da lista.hFoi detetado um problema enquanto tent", "n listan._Vi st", "DynamicUpdate", "Failed to determine source edition type! Error: [0x%X]", " nu func", "WdsSetupLogMessageW", "ves. Adja meg ", "m papirkurven for at fjerne slettede filer fra systemdrevet.", "fr-RE", "unuz s", "e internetu za dobivanje a", "K6746", "rz teraz ich kopi", "gerbereinigung frei, und versuchen Sie es erneut.*Problem beim Herunterladen einiger Dateien", "Prawie gotowe", " (%2!s!)~", "ft*Die Installationsbereitschaft wird gepr", "1/0-0", " diegim", "st jazykov", " unos minutos.", "om po", "j{J70", "hren.2Aktualisiertes Medienerstellungstool herunterladen", "lo do nepri", "Termes du contrat de licence", "t4y=\\G", "ni funktsioon on eemaldatud. Operatsioonis", "hjendage pr", "Det tager et par minutter.", "_onexit", " zariadenie, napr", "ete morati da ponovo instalirate neke opcionalne funkcije i jezike.", "vMRn0", "tfen Depolama'n", "genes de la instalaci", "iska. Otvorte ", "See n", ". Patikrinkite interneto ry", "0'0H0q0", "Making sure you", "zben t", "progression", "BitLocker-beskyttelse deaktiveres under denne oppdateringen og aktiveres p", ", DVD ", "steemi Windows Server 2019 sisse logite. Andmete kaitsmiseks hoidke arvuti enda l", "Last ned den nyeste versjonen av Windows", "lreiz.2P", "in Disk Temizleme", "ti naudojama ", "e jste se rozhodli nainstalovat %1!s! v jin", "tab Windows 10", "}M0OUL", "sents sur le support d'installation.", "installation de Windows. V", " izpildiet komandu setup.exe /?.", "7Licen", "- Windows Server 2019. ", "M0K0I", "De ce v", "kkel, SD-kort eller ekstern harddisk, til ", "to po", "n recomendado para este equipo", " var darboties Windows 10. L", "2e8hj", "o e volte a tentar.", "o do Windows Server 2019. Experimente reiniciar a Configura", "", "CDlpResponseImpl > > >::Restart", " odstranili. Kliknut", "o falhou na fase %1!s! com um erro durante a opera", "o. Reveja as informa", "ivanjem mo", "r %1!s! manuelt for at ", "8&9C9K9", "Stiahnite si najnov", "in prenosa posodobitev v programu Windows Setup", "n en la que quieres instalar Windows.", "tiute ", " %2!c!:.qAko Windows 10 ", "t work. Please check it and try again, or try a different key.3Your product key works! Continue when you", "pertoire racine de votre support d", " unitate.#Desc", "cia syst", "Logige sisse administraatorinaZSelle t", "e da se nastavi jer Windows ne mo", "ate nain", "ti ma", "o a instala", "t sist", ". Po pripojen", "dition) sur votre PC, vous avez besoin d", "ConX::Setup::Common::CSetupLangIniLoader::GetLanguageMediaNumber", " informace o upgradu Windows Serveru najdete na webu https://aka.ms/windowsserverupgrade.", "bn-BD", " volte. L'operazione richiede alcuni minuti.0Chiusura del programma di installazione in corso/L'operazione potrebbe richiedere alcuni minuti.cDurante l'installazione di Windows non potrai usare il PC. Prima di iniziare salva e chiudi i file.0Attendi la fine della disinstallazione dell'app.", "Windows 10 esmakordsel installimisel arvutisse (v", "hese kettaruumi t", "Ninguno", "9<:g;", "t data chr", ": :(:0:8:D:d:p:", "rt`Denne produktn", "Installimise ettevalmistamine ", "b~0_0o0", "- Windows 10", "o livre em disco na (%2!s!)rElimine os ficheiros de que j", "7 7$7(7@7D7L7d7t7x7", "%d%% abgeschlossen", "S&chlie", " jenom 25 znak", "4;4u4", "ssen Sie einen Windows 10-Product Key eingeben.", "des. L", "lineen luomisessa oli ongelmarAntamaasi tuoteavainta vastaavaa Windowsin versiota ei ole saatavilla nykyiselle kielellesi ja arkkitehtuurillesi.", "CDlpResponseImpl > > >::CheckInitialized", "in, y", "e se nekoliko puta ponovno pokretati. To bi moglo potrajati..Pri", " nepotrebujete, alebo pou", "ii de Windows 10 va configura PC-ul s", "000```", "8\"8O8", "6.6h6", "|ldvG", "ltek! Kattintson a Folytat", "dzu, atsvaidziniet sarakstu un m", "se-FI", "s l'installation et vous devrez peut-", "D$8PVS", "terst", "ntalo nuevamente.", "Noget forhindrer installationen i at forts", "butiez l", "USB-flash-enheten er klar", "li.`Neizdev", "moh-CA", "ku Media Creation Tool Pierakstieties k", ".?AV?$CZeroInit@VCSetupResponsePageGated@@$00@@", " tento n", "i manual Co", "cution des scripts preinstall.cmd.FUn probl", "tirme s", "i apoi ", "%c:RA sz", "##'####&##", "Vi kan inte avg", "rskendused on installitud, kuid Windows Server 2019 installiprogramm tuleb taask", "s par to jau par", "Overf", "te nasleduj", " Kullan", "Uusima versiooni allalaadiminehSelle t", "eKNMR", "ttes, eller du pr", "Inovova", " informado quando estiverem conclu", "t tikai personiskos failus", "aj, poput USB klju", "kolik minut trvat.tNepoda", "Windows 10:t", "]wQBf|v", "o funciona. Tente usar outra chave.", "La causa non ", "s futtassa ", "GB br", "Aseman valinta", ",Ir'Kn", "Ser etter oppdateringer Ser etter oppdateringer: %1!d!%%", "ImmAssociateContext", "&Anulare", "r installationen ", "lieties datu nes", "rios mais alguns passos antes de poder efetuar a atualiza", "Ga naar: %1!s!", "&)-.CFDA86ANXYYUUUNna", "Lisateavet", "Neplatn", "ljande externa enhet och klicka p", "ge a friss", "e de Windows 7 ou Windows 8.1 install", "a izdelkaUNamestitveni program ne more ugotoviti, katero razli", "A|M`.", "Pronto per l'installazione", "jumus, personiskos failus un programmas, ir j", "pak vyberte Aktualizovat.", "o sa m", "Ma on nast", "tres, fichiers et applications, car votre version actuelle de Windows est install", "%d karakter kald", "s aptuveni ", "zina, pirms s", " nemus", "External Storage Device", "n y prueba otra vez.", "ajte ponovno pokrenuti postavljanje.", "ProductVersion", "ima.PKapacitet USB fle", "gi labojumi, atjaunin", "Langue ne correspond pas", " iepriek", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2", " de Windows 10 sur votre PC en raison d'un espace disque insuffisant. Lib", "talova", "n porque Windows no puede reiniciar el equipo. Cierra los programas que se est", "7F7_7e7q7", "e soubory, aplikace a nastaven", "PCen startes straks p", "9K t~3", "avanja skripti precommit.cmd.", "r%Neplatn", " ten krok. Automatycznie aktywujemy system Windows po zako", "ekajte izlazak iz instalacije#Ovo mo", "o do Windows Server 2019 falhou", "Abrir Quero usar armazenamento externo$N", "ciu spusti", " jonkin aikaa.|Windows-asennuksessa tapahtui odottamaton virhe. Tarkista, ett", "elite li zaista da odustanete?", "s recientes de Windows 10 en tu PC debido a que el espacio en disco es insuficiente. Sigue las instrucciones que aparecen a continuaci", "iama s", "CDlpResponseImpl > > >::CheckUninitialized", "ndan ", "Drive Letter = %c: is Read Only", "*Licentiebepalingen voor Microsoft-software", "go{{|||~H", "rulan", "mn-MN", "hemmin.AAsetukset ja sovellukset poistetaan, mutta tiedostot s", "IMAGE", "te, ale pliki zostan", "@@@ppp", "USB-m", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4", " ta en titt p", "s escribir una clave de producto v", " fereastr", "ltenie ", "idlo Pokra", "tor: /Syst", "niej zainstalowany oraz aktywowany na tym komputerze i chcesz go ponownie zainstalowa", "ssal?", "t$4hx", ":6:Q:l:", "ku podr", " tai versiota.", "cWindows 10 m", "Downloading Windows 10", "vaketast), et ajutiselt laiendada k", "n (%2!c!: s", "it. Po dokon", "enia.", "t nastaven", "bne Diskoprydning.", "Er worden geen opdrachtregelargumenten geaccepteerd. Zie Setup Help voor meer informatie of voer setup.exe /? uit in de hoofdmap van het installatiemedium.", "ovat v instalaci Windows 10. Zkuste spustit instala", "OX[W0f0", "lg et USB-flashdrev{Filerne p", "+Tarkistetaan p", "o nos suportes de dados instala", " Levyn uudelleenj", "r media skulle skapas}Windows-utg", "ajte jo", " **$**$*$)0", "; ;8;<;T;X;p;t;x;|;", ", tada pasirinkite Atnaujinti.", "pta&l", " od komputera do czasu ponownego zalogowania.!Oto podsumowanie wybranych opcji:", "i Windows 10 pe PC pentru prima dat", " plik", "ll continue installing Windows Server 2019 in Windows Update.", "585T5X5\\5`5d5h5l5p5t5x5|5", "es porque a sua vers", "mas-Cheia de produs con", "se-SE", "dKullanmaya ", "dfveapi.dll", " Windows.j", "Kasutage selle arvuti jaoks soovitatavaid suvandeid", "tsladd f", "SelectedSqmOptIn", "n actual de Windows est", "\"Nenoriu naudoti i", "nt a preinstall.cmd parancsprogramok futtat", "ltere Installationsdateien f", "Snimanje ISO datoteke na DVD", "Die Installationsinfos, die zum Fortsetzen der abgebrochenen Windows-Installation ben", "puleviimiseks nuppu OK.", "Windows needs space to update", "unaru. To zna", "Brak dost", "The free update to Windows 10 is only available if you have an activated copy of Windows 7 or Windows 8.1 installed on your PC. Activate your current version of Windows using a product key and then select Refresh.", ".?AVISetupObject@@", " stato possibile scaricare tutti i file necessari. Controlla per assicurarti di essere connesso a Internet e riprova a eseguire lo strumento.DSi ", "Dit kan een paar minuten duren.|Steek de stekker van uw pc in het stopcontact om er zeker van te zijn dat de batterij niet leegraakt tijdens de installatie.", "klemenin tamamlanmas", "t vagy futtassa a ", "ra szeretn", " Windows Server 2019 este gata pentru acest PC. ", "ie), ave", "cio, retomaremos a partir do ponto onde t", "cutez le programme d'installation.tPour plus d", " voi kest", ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatActionResponse@@@@@@@@@@", " naujo ir bandykite dar kart", "%sGB?PC", "ppna Lagring i Inst", "Esto puede tardar varios minutos.", "Selecteer een USB-flashstation", "Obter", "%1!ld!%% terminat", "m svoje s", "ste to znova.3Windows 10 e", "Korpa za otpatke\\Ispraznite korpu za otpatke da biste uklonili izbrisane datoteke sa sistemske disk jedinice.", "tres de stockage", "ti sobib. J", "iant ", "hendus Internetiga, ja proovige uuesti.*Preinstall.cmd juurutusskriptide k", "ujejo pomembne popravke, posodobljene gonilnike naprav in dodatne datoteke, ki niso del namestitvenega medija. ", "iama %d%%", "CDlpResponseImpl > > >::GetResultsRoutine", "g0S0n0", " Windows 7 ", "cej wersji j", "es-PA", "iame kompiuteryje ", "APoteka priprava na prenos najnovej", "na zapisa", "cych u", "Windows Setup gaat online om updates, stuurprogramma's en optionele functies te ontvangen. Deze updates zullen helpen de installatie vlot te laten verlopen en kunnen belangrijke fixes, bijgewerkte apparaatstuurprogramma's en extra bestanden omvatten die niet beschikbaar zijn op het installatiemedium.", " failure.cmd#", " po vytvoren", "Hilfe", " esat izv", "tes pr", " facoltative", "dos, mas os arquivos ser", "ebujeme v", "jlt k", "%c: (%s)", "Windows-installationsfilerne blev ikke fundet. Inds", "tu, kam piekr", "hendage arvuti vooluv", "re ready to install", "i kasutage m", "xuSShG", "cijas failus. M", "re Windows Server 2019tDysk, kt", "Instala", "vMRHr,g", "te Pokra", " alman", "-:5/=", "iniet uz T", "4D5i5", "[%hs(%hs)]", " innego klucza.", "Kontrola po", "Promijenite na", "re oppmerksom p", "ch za", ": :0:4:8:P:`:d:t:", "i ales:", "Reprendre depuis le d", "ngelig. Du skal downloade og k", "Pobierz", "in na koji program za instalaciju sustava Windows preuzima a", " %2!s!", "%1!s! %2!s!$Hubo un problema al crear los medios", "9s t\\", "vat na n", "- DVD ", " program, aktivovat Windows a spustit instala", "R_U(u ", "miyor", "%s er ikke et gyldigt tegn", "installation.0V", "M0~0W0_0", " Windows autom", "m prov", "Hvis Windows 10 tidligere har v", " nieko", "ErrorCode", "o de armazenamento. Abra manualmente o armazenamento nas defini", "n a agilizar la instalaci", "cccsKK", "o do Windows 10^Falha ao abrir a utiliza", "? ?`?", "w wiersza polecenia. Aby uzyska", " aten", "517I7_7", ".?AV?$CZeroInit@VCSetupActivationDlpResponseFactory@@$00@@", "Este download em segundo plano pode ter mais de 4 GB (pode variar) e taxas de acesso ", "<$<3<^<", "%d %% valmis", "8.1 kopija. Aktiviz", "tirmeleri ", ".?AVIDlpError@@", "t install the latest Windows 10 features and security improvements on your PC due to low disk space. Free up some space below and then select Refresh.", " nytt.ESystem Windows Server 2019 nie jest jeszcze gotowy dla tego komputera", ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@", "Namestitveni program ne sprejema argumentov ukazne vrstice. ", "lnej verzie Windowsu, po aktualiz", "ie numai dac", "9(9,90949H9L9P9h9l9", "Denne bakgrunnsnedlastingen kan v", "chargement est d'environ 3", "tkamiseks ning Windowsi s", " datorn st", ", kan det hende at PC-en ikke fungerer som den skal etter installasjonen, og det kan hende du m", "1 merkki j", "Lisateave", "syr-SY", "DefaultOfferIndex", "ljute installiprogrammist.qInstalliprogrammi k", "= =,=8=D=P=\\=h=t=", "s de que inicies sesi", " 4 GB+ (st", "Installa Windows Server 2019/L'operazione potrebbe richiedere alcuni minuti.oConfigurazione dell'aggiornamento per Windows 10 in corso", " igjennom informasjonen i %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml for ", "kkel.5BitLocker-n", " naujo paleisti ", "1 car", "n diferente), necesitar", "iu, apoi ", "3<4X4v4", "%2!s!3J", " BitLocker ressemble ", "Det finns inga uppdateringar", "%d caracteres restantes(Tra", "z yerden devam etmemiz i", "anjem sistema Windows Server 2019 v storitvi Windows Update", "ini se", "installation a ", " 25 simboli", "rente de celle que vous utilisez actuellement.", " chyba.", "0k0o0 ", "o funcionar corretamente ap", " instalada en un directorio no admitido o porque est", " ne funkcionira s ovim izdanjem sustava Windows. Poku", "%s nie jest prawid", "nika instalacyjnego.", ", tento krok m", " escolheu instalar o %1!s! usando outro idioma que n", "lem birka", "ico sistema Windows.oNa pogonu, ki bi ga radi uporabili, ni dovolj razpolo", "Learn more", "im: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX9Bitlocker atsl", "&Installer", "cie: %1!d!%%", "\\Ez a BitLocker-kulcs t", "i m0s", ", ki ste ga kupili v spletu.", "Atsisi", "Failure.cmd ", ".?AVCSetupPageBase@@", "ovat v instalaci.", "Izbor USB fle", "itati jezi", "luseadet*Ma ei soovi kasutada v", "installez, vous pouvez ignorer cette ", "lj enhet3Installationsprogrammet rensar upp innan det st", "Nainstalovat Windows 10", "ite: https://aka.ms/windowsserverupgrade", "Prenosi", "Lingua:", " program Windows Servera 20195Re", "\"ZNGy", "jlokat", "CreateICW", "Vianm", "n de Windows Server 2019. Intenta reiniciar el programa de instalaci", "te naujausius diegimo failus.", "A&vanti", "itamine'Failure.cmd juurutusskriptide k", "7 ou de Windows", "pne, a nast", " jour de Windows 10y", "j~{f_+;h", "\"Nu putem g", "041E04B0", "gon extern lagringsenhet", "23456789BCDFGHJKMNPQRTVWXYbcdfghjkmnpqrtvwxy", "Palaukite, kol baigiama s", "du laiku.zWindows instal", "0i1t1", "sticas opcionales.-Utilizar ficheiros de instala", "t Windows Server 2019 instal", " urmeaz", "nosti aktualiz", " citi", "charger tous les fichiers n", "%1!s! ", "V6eR{]", "ite pod", " podle objemu dat, rad", ".?AV?$CUnknownImpl@UIUnknown@@@@", "Przygotowywanie instalacji ", "Logga in som administrat", "tta. Aktiveerime Windowsi p", "elim uporabiti zunanjega prostora za shranjevanje", "Det g", ", kompiuteris bus sukonfig", "ppna H", "EventWrite", " retenir :", "sik k", "gt.2Die Sprachressourcen konnten nicht geladen werden.9Das Arbeitsverzeichnis konnte nicht initialisiert werden.!Ung", "/x84\\`", "m KutusuTSilinen dosyalar", "n Windows 7 eller Windows 8.1, eller om du installerar om Windows 10, beh", "='\"RJ}I", "zben nem fogja tudni haszn", "installation de Windows, puis ex", " systemu Windows 10VKomputer zosta", "Wenn Sie Windows 10 erstmalig auf Ihrem PC installieren (oder eine andere Edition installieren), ben", "essayez..", "o consegue executar o Windows Server 2019", "3F4k4t5", "co nav", "akniniame kataloge.", "lata eset", " ativado neste computador. Isso significa que voc", "eiti i", "mogatja a g", "te ISO s", "LI`+*", "in.YUSB flash s", "n %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml pentru a rezolva problema ", "Cit[ PsA;", "i ned", "Om Windows 10 tidigare var installerat och aktiverat p", "[Fehlercode: 0x%x]1Unerwarteter Fehler bei der Windows-Installation.", "}D0g0D0~0Y0 ", "p en ny.", "Keel:", "ll personliga filer och appar", ".?AVCWizardPage@UX@Common@ConX@@", " uruchomiony", "To lahko traja nekaj minut.~Med name", "ii Windows", " Operativsystem", "lt a Windows Server 2019 telep", "i USB uklonjivi pogon.", "s folytat", "sakorkA megadott term", "Rm}Pi", "Rediger, hvordan Windows Installation downloader opdateringer", "Sxzl;", "n de Windows Server 2019 debe reiniciarse para que funcionen. Una vez que se reinicie, continuaremos desde donde lo dejamos.2Este equipo no puede ejecutar Windows Server 2019.xA unidade que est", "tajte si to, aby ste vedeli, s ", "Izbiranje pogona", "gle, et SD-kort eller en ekstern harddisk til midlertidigt at udvide din harddisk, mens opdateringerne installeres. Windows vil ikke omformatere den eksterne lagerenhed, og du kan fjerne den, n", "installation pour Windows 10. Nous pouvons vous aider ", "7@7`7", " denne computer for f", "ivitykset on asennettu, mutta Windows Server 2019:n asennus on k", "dzie gotowe", "n.5Asegurarse de que su PC dispone de espacio suficiente)", "rt.,Installasjonsprogram for Windows Server 2019?Starter installasjonsprogrammet for Windows Server 2019 p", " kompiuteryje gali b", "%d%% on l", "264u4", " instalace ho budete moct odebrat.-Po", "rio de trabalho(Par", ": 0x%x]EUne erreur inattendue est survenue lors de l", "in Windows Server 2019 Kurulumu", "mni-IN", "l lentebb t", "a para software Microsoft\"Pol", "Alege", "ifrom.?Va", " sufficiente per continuare l'installazione di Windows 10. Prova a riavviare il programma di installazione.@Sto verificando che lo spazio disponibile nel PC sia sufficiente)Vuoi continuare a usare questa selezione?", "e que pour ajouter des fonctionnalit", "FileVersion", "Bez ozna", "&Zavrni>", "o funciona com esta edi", "n uudelleen", "rqsppnmmTP84211h", "bai S re", "a %d skupiny je neplatn", " Windows 10 a fost instalat ", "jdete v Pomocn", "rda f", "Den kostnadsfria uppdateringen till Windows 10 ", "nPPqqZq", "Odaberite jezik, arhitekturu i izdanje", "avanje skripti za primenu precommit.cmd*Izvr", "CSetupResponsePageBitLockerKeyValidate: SerializePage", "re installing Windows 10 on this PC for the first time, you need to enter a valid Windows 10 product key.", " poistetaan, mukaan lukien tiedostot, sovellukset ja asetukset.", "stra aceste fi", "iona cu aceast", "r vi slutade.2Det g", "tme v", "Installationen f", "imini de", "2T2q2", "Pravne informacije", " ne funkcioni", "m apenas 25 caracteres.", " jatketaan, kun kirjaudut sis", "i %1!s! utiliz", "z nem t", "n av f", "lo je do te", "UxTheme.dll", "m Kutunuz a", "lI!0>SF", "https://go.microsoft.com/fwlink/?LinkId=724295", "t Windows 10. M", "e se nekoliko puta ponovno pokretati. To bi moglo potrajati.", "bn dvd-br", "kkelen nedenfor eller avslutte installasjonen, aktivere Windows og deretter starte installasjonen p", "Spremenite na", "BitLocker-avain", " jour.+Lib", "z gerekti", "n Windows-version kanssa. Kokeile toista avainta.ITuoteavain olikin v", " jour sont install", "$,Aah?@", " tietokonetta uudelleen. Sulje avoimina olevat ohjelmat ja k", "installation est pr", "INSTALLASJONSINFORMASJON: Noen Windows 10-funksjoner krever avansert programvare. Noen eksisterende funksjoner er endret eller fjernet. Windows 10 oppdateres automatisk i st", "rent votre attention", "Pripremamo neke stvari\"Ovaj alat ne mo", ">>>:@DDDDD??D?I", "Meghajt", "Esta descarga en segundo plano puede ser de m", "lg ekstern lagerenhed", " v Nastaven", "ite datoteko ISO na DVD", "buj ponownie.?Nast", "rz folder Pobrane", " entrar nele novamente./N", "DrawFocusRect", "r jag slutade", "Hvad vil du foretage dig?", "s ind", "i programul de instalare.*Asigura", "fr-029", ": :,:8:D:P:\\:h:t:", "Creando el medio de Windows 10$Sigue usando tu PC con tranquilidad.", ":5:d:k:q:v:", "o, tem de resolver as quest", ".?AVCObject@@", "o ocorrer sem problemas e podem incluir corre", "urira ra", "hi-IN", "re mediet for at installere det.+Du kan stadig forts", " funkcji i zabezpiecze", "Die Installation kann aufgrund eines Problems nicht fortgesetzt werden. Lesen Sie die Informationen in \"%1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml\", um das Problem zu beheben, und f", "o e tente novamente.7O Windows 10 ainda n", " du finne ut om dette f", "prava instalace. ", "TI_}Mj", "Nous avons constat", "Comunicazioni e condizioni di licenza applicabili", "LixeiraKEsvazie a Lixeira para remover os arquivos exclu", "cy-GB", "Arkitektur", " 0x%2!lX!", "am-ET", "rankai nepavyko pritaikyti perk", "administrateur. > > >::Restart", "vod najdete dole.", "o.)A verificar se o PC tem espa", "_Allalaaditavate failide kausta avamine nurjus. Avage oma allalaaditavate failide kaust k", "ierele mele personale", "iimis. Valige see v", "!kx0]", " Twojego komputera za pomoc", "9995=", " desteklenmeyen bir dizinde y", "Clave de Bitlocker", "senie o pou", "re reinstalling it, you can skip this step. We", "eti namestitve sistema Windows. Znova za", "ngs automatiskt om %1!d! minuter.%Saker du beh", " przywr", "e nadaljevati, ker Windows ne more znova zagnati ra", "i parametri komandne linije", "seGFriss", "s!X&'", "me et r", ": 0x%x]", "rminos de licencia del software de Microsoft$Declaraci", "te tla", "CSetupResponseTemplate::ExecuteRoutine: Cancel button clicked.", "&Akcept", "n.{Tenemos problemas para determinar si tu PC puede ejecutar Windows 10. Sal del programa de instalaci", "rLanguage", "7F7v7", "=8=M=T=Z=_=j=t=y=", ".OKonfig", "kom u toku operacije %2!s!", "DThis product key didn", "CSetupResponsePageBitLockerKeyValidate: CSetupResponsePageBitLockerKeyValidate", "ft werden.=Setup konnte die ausgef", "Notez les informations suivantes :", "stroj Media Creation Tool", "&Elfogad", "essayez.:Scripts de d", "nn ISO-filen p", "%Microsoft Windows Production PCA 2011", ". Galime pad", "rst skapa och sedan k", "Kurulumun devam etmesini engelleyen bir ", "rification de l'", "8$808<8H8T8`8l8x8", "ch mo", ".?AVCSetupDlpResponse@@", "2019. Essayez de red", "Instaliranje ovog izdanja operativnog sistema Windows 10 ", "tzm-Tfng", "tiniz:", "%2!s!=", "ticamente@El programa de instalaci", "Your files, apps, and settings can't be kept because you've chosen to install %1!s! using a different language than you're currently using.", "Uaktualnij ten komputer teraz", "rbereder nedladdning av den senaste versionen av Windows 10", "Selectare unitate'Instalarea cur", "We can", "Installationsprogrammet f", "EHet downloaden van de nieuwste versie van Windows 10 wordt voorbereid", "WoU.L~", "Ficheiro ISO", "i Instrumentul de creare a suporturilor fizice actualizat", "iustusi. Vabastage allpool ruumi ja seej", "Dette kan tage flere minutter.", "Zaloguj si", "tten og oppgi feilkoden.", "ava nastavak instalacije. Da biste rije", "CDlpResponseImpl > > >::SetResponseName", " Windows Update ", ", SD kortel", "Windows 10 allalaadimine Allalaaditud faili kontrollimine", "zben.?Hiba t", "tu aizsarg", " disponibile per la lingua e l'architettura correnti.", "quz-PE", "Uso de almacenamientofExplora manualmente el uso del almacenamiento en la configuraci", "o e tente novamente.+Houve um problema ao baixar alguns arquivos", "en kom i, eller i din mailkvittering. N", "hrend die Updates installiert werden. Das externe Speicherger", "m stiahnu", "%1!s! %2!s!", " o computador para ser executado no modo S. Escolha esta edi", "riist ei saa teie arvutit v", ", aby se odstran", "n az S m", "lja umbes j", "mtade filer manuellt.TDet gick inte att ", " %s;Windows ", "ier ISO) pentru alt PC", "il, l", "gsw-FR", ")Stiahnite si najnov", "Installer Windows", "to se zatvori", "Izmantojiet ", "mas diska no", " verze tohoto n", "ll need to burn the ISO file to a DVD later.", "s et langues facultatives.", "inome, ar kompiuteris parengtas t", "[Moderator Suggested Translation] - Nous avons restaur", "i4Chcete pokra", "0?{$A0", "strojem BitLocker se b", "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X", "8!989K9m9", "elles fonctionnent. Une fois le red", "utilisation du stockage. Ouvrez manuellement votre espace de stockage dans Param", " nem tudta alkalmazni az ", " ir tada v", ".3Saisissez la cl", ".?AVCSetupResponsePageCompat@@", "1Startar om installationsprogrammet f", "me emp", "lectionnez une autre cl", "0n0\\O", " Windows.", " vontade para continuar usando seu computador.", "w instalacyjnych", "}L0j0D0", "o miejsca. Post", "Tiene un aspecto similar a este: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXPAntes de seguir con la instalaci", ">G>M>X>l>q>}>", "veletet ezzel a be", "t Windows Server 2019.>Turpin", ".CRT$XCA", "CDlpResponseImpl > > >::CheckUserInterrupt", "1;Wls", "n. Libera espacio y luego int", "\"Namestitveni program za Windows 10", "Vi kan ikke downloade alle de n", "nd contacta", "Atpa&ka", ".?AVCSetupCompatDlpResponseFactory@@", "steem:", "%3!s!$Windows 10 Setup wird neu gestartet.", "b5_Y0", " tuoteavainta ja valitse sitten P", "Isto pode levar alguns minutos.oVoc", "2E2[2y2", "No en este momento", ".lNepoda", "jakou dobu trvat.0Po", "i folosi ", "inome, ar kompiuteryje u", "site nesuaktyvin", "rimas kitam kompiuteriui", "es %d%%", "O&drzu", "FOOOqqZqZoZoZqmb", "je funktioner til Windows. Den kan ikke bruges til at installere Windows.", " versiunea curent", "Instalar Windows 10", "no otvorite korpu za otpatke.pOtvaranje iskori", "Fast geschafft!", "%s nije va", " jazyk a architekturu.", "u stiahnu", "Seleziona un percorso", ", kad t", "nete pode", "=&>L>i>", " jazyk.", "hrt werden.", "O(u}T", ">&>6>_>t>y>", "puleviimist automaatselt.", "4$4D4r4{4", "m probl", "es, drivers e recursos opcionais", "mu Windows", ": 7Windows a besoin d'espace pour effectuer la mise ", "Ei mit", "ments", "e sur votre PC n", "elim pri izbolj", "sto pomoc", "diegsite ", "INSTALL_DRIVERS", "e uporabljate povezavo z omejenim prenosom podatkov, preverite, ali lahko nastanejo dodatni stro", "&Namesti", "Your PC will restart several times. This might take a while.", "Zasady zachowania poufno", "Altre informazioni", "< <$<(<,<0<4<8<<<@ > > >::GetResponseId", "rizze az internetkapcsolatot, ", "tta med installationen och beh", "na by", "ramayaca", "n de problemas", "GetPrivateProfileIntW", "i ce dori", "elite instalirati na drugoj particiji, morate stvoriti pa pokrenuti medij za njegovu instalaciju.'Slobodno nastavite s kori", "ju oper", "n de Windows.]Se eliminar", "tirmesiUDepolama kullan", "asT@w`O", "Aqui est", "Updates, stuurprogramma's en optionele onderdelen downloaden (aanbevolen)", "Preparazione dell'installazione ", " informacij o nadgradnji sistema Windows Server, obi", "Kies wat u wilt behouden", "cuter l'installation.jPour plus d'informations sur la mise ", "Opera", ". Kurulum program", "liwia kontynuowanie instalacji. Zajrzyj do informacji w %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml aby rozwi", "hoz rendszergazdai fi", "rym j", "a do Windows 10 no seu PC devido a espa", " veiksm", "tme kontrolliminePSee tootev", "Installimiseks valmis", "r. Niektor", "s ejecutando Windows 10", "2(282<2@2D2H2L2P2T2X2l2p2", "tirmeler al", "Pripravuje sa in", "050<0e0", "cute en mode S. Choisissez cette ", " versiune", " iniciar sess", " zlep", "su datoruXPa", "rota maksa par piek", " ceci : XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "p\"Vhmd", "768=8C8H8S8^8r8|8", "kleme se", " con la instalaci", "ite datoteke, aplikacije i postavke jer ste izabrali da instalirate %1!s! na jeziku koji trenutno ne koristite.", "im Kutusu Kimli", "&Devam", "rt pc'en til den tilstand, den havde, lige f", "ta diegti automati", "t datus, turiet datoru sav", "est produit lors de l", "7O7j7", "ite kori", "e a voliteln", "unara&Proveramo da li spremni za instalaciju", "hlen Sie eine der verf", "*Identifica", "tta anv", "Windows pole selles arvutis aktiveeritud. See t", "FullUpgChecked", "my-MM", "iu disponibil. Alege", "Me ei oska ", "CSetupResponseTemplate::OnNext", "CSetupResponseTemplate::IsBackEnabled", "Mora imati najmanje %1!d! GB.", "INFORMACIJE O NAMESTITVI: nekatere funkcije sistema Windows 10 zahtevajo napredno strojno opremo; nekatere obstoje", "ekivane gre", "n para completar la actualizaci", "dition de la version de Windows qui est pr", "ine ba", "040<0D0P0p0|0", "Immetti il codice Product Key", "yti diegimo informacijos, kuri reikalinga norint toliau diegti ", "i samo 25 znakova.", "nn ISO-filen manuellt p", "tit sisestada.", ".9Ryhm", "Abrir9Como alternativa, pretendo utilizar armazenamento externo+N", "8L9V9q9", "/Pobieranie najnowszej wersji systemu Windows 10", "ierele de care nu mai ave", "iere de instalare mai vechi pentru Windows 10. V", "7 7:7P7c7s7", "o aceita argumentos de linha de comandos. Para mais informa", "r Windows 10 wird konfiguriert", "Change how Windows Setup downloads updates", "zca etkinle", "s a(z) %1!s! f", "ipraveno k instalaci", "In&staller", "&?:DDDDDJDJJJJ`JJJ9)", "KqZZZZZZXZqmf", "Vyberte cestu", "rrelsen kan variere), og Internett-kostnader kan p", "termination des choix d", ", da element odstranite s seznama.iKo smo posku", "ments,Cet outil ne peut pas mettre ", "CInstallUI::ConfirmEulaDecline: Eula decline confirmed", " niveau ce PC maintenant", ". Windows ei alusta ulkoista tallennuslaitetta, ja voit poistaa sen asennuksen p", ".?AVCSetupResponsePageInstallNowOrLater@@", "t, mus", "Unten sind die Gr", "Progression : %1!d!%%CVeuillez s", "+Je r", "ivityst", "Din pc genstarter om et ", "Hvis du installerer denne udgave af Windows 10, konfigureres din pc til at k", "Rj0zzM0", "xx|lH", " na DVD disk.", "Leelawadee UI Light", "o do Windows 10 falhou", " prie interneto, ir bandykite dar kart", "s meg", "ekajte da se zavr", "Digite a chave do Bitlocker", "l nevaram noteikt, vai oper", " Windows 10E", "04080<0@0H0L0T0`0", "GDI32.dll", "Sprawd", "?%'**", "rba van telep", "te instala", " izdelka deluje! Ko ste pripravljeni, nadaljujte.", "jeblikket.", "be en Windows 10-produktn", "ajke BitLocker. Odaberite neki drugi pogon i poku", "ana kadar bilgisayar", "ra den senaste versionen f", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceActionResponse@@@@@@@@", "'#%'6'6''6", "Priebeh: %1!d! %%3Pokra", " attivato in questo PC", "r verktyget igen.!Ett problem uppstod med verktyget", "7Windows 10 ", "line salvestusseade", "n no pudo validar la clave de productoUEl programa de instalaci", " enhet %2!c!:.]", " solicit", "o#6=Hm", "ano: %d%%", " Windows Server 2019B", "A preparar algumas coisas+Esta ferramenta n", "seRA sz", " jour facilitent l'installation et peuvent inclure des correctifs importants, des pilotes de p", "rende version af Windows ved hj", "te vyrie", "jiet un darbiniet jaun", "Angajament de respectare a confiden", "\"Hibak", "pnych opcji, aby kontynuowa", "&Sulje", "n, te ayudaremos a liberar %1!s! en la unidad %2!c!:.", "&Fortsett", "Aceste actualiz", "unaru.", " program..Zji", "tte med at bruge pc", "ama papildu aparat", "Prostor za shranjevanje", ">A>J>S>\\>e>n>", "jumu ieg", " jour et elle sera r", "&Ekraaniklaviatuur", "ierul ISO pe un DVD.", "kkelen", "jra kell telep", "installationR", "USB-muistitikkua ei l", "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageDiskPartitionImpl.h", "nternet'e ba", " do syst", "BrandingFormatString", ">M?y?", "Kontynuuj od miejsca, w kt", " PC-ul are spa", " yetersiz oldu", "n y quiz", "ber jednotky-Pred zavret", "INSTALLATIONSINFORMATION: F", "xhzxxx'l", "im postavkama a", "CSetupResponsePageGated::UpdateView", "ntat fel uppstod. Kontrollera att installationsk", "trzny dysk twardy, aby tymczasowo rozszerzy", "itamine", "Tiene un aspecto similar a este: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.", "Velik mora biti vsaj %1!d! GB.", "Dine filer, apps og indstillinger kan ikke bevares, fordi du installerer en udgave af Windows, der er anderledes end den, du bruger i ", "o funcionou. Tente uma chave diferente ou compre uma nova.", "installation est en attente, car les ", "dn%s^\\$ ", "cii syst", "bI0|:", "chte keinen externen Speicher verwenden", "em PC-ju dovoljno prostora#", "Instalarea nu poate continua, deoarece Windows nu poate reporni computerul. ", " kompiuteris$Tikrinama, ar esate pasireng", "4!uhM", "i textul, pentru a ", ";7EP:EP:EP:EP:EP:", "3O3w3", "USB flash s", "CInstallUI::CreateDownlevelInstallUI", "Installer Windows 10IObtenir des mises ", "6(6H6P6X6`6p6", "N!k(Wdk", " jste za", " se aktualizace: %1!d!%%", "Dit kan een paar minuten duren.cNiet alle benodigde bestanden zijn gedownload. Maak verbinding met internet en probeer het opnieuw.1Implementatiescripts van preinstall.cmd uitvoeren0Implementatiescripts van precommit.cmd uitvoeren.Implementatiescripts van failure.cmd uitvoeren", "teignez pas votre ordinateur.", "D$@+D$8", "onnistui", "PPP000", "Takmer hotov", "Impossibile continuare l'installazione. Per risolvere il problema, esamina le informazioni in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ed esegui di nuovo il programma di installazione.lPer ulteriori informazioni sull'aggiornamento di Windows Server, visita: https://aka.ms/windowsserverupgrade}Non ", "n.hSizin i", " DVD-", "ar do in", "Causa del messaggio", "bW0_0_0", "tirece", "n de Windows que coincide con la clave de producto que has escrito no est", ".5Windows Server 2019 ", "eme uvo", "rminos de licencia aplicables", "sit informa", "t work with this edition of Windows. Try a different key.FThis product key didn", "6R6\\6h6", "Starter", " su administratoriaus paskyra..Tur", "su PC dator", "inden emin olmak i", " parti", "ch pokyn", "Tootev", "n de medios actualizada!Iniciar sesi", "s abajo si quieres conocer las razones.", "lerini ve y", "ti sisaldab ainult 25 m", "USB flash disk nejde naj", " almam gerekiyor", "rt, de az ", "191023231921Z", "$Hata kodu: 0x%1!lX! - 0x%2!lX!", "Preostalo znakova: %d", "tigt werden, konnten nicht gespeichert werden. Daher m", "a backup deles agora em outro local de salvamento.", "2019. Afin de prot", "OX[4X@bk0", "rtoti, varat izlaist ", "gu identifikatoram: 7Sist", "ivitada. Sulgege k", "Er zijn een paar dingen die nog moeten gebeuren voordat u een update kunt uitvoeren. U krijgt bericht als het zover is en wat u daarna moet doen. Dit venster sluit automatisch over %1!d! minuten.!Wat u moet weten voordat u begint", "040C0L0U0j0", "n y vuelve a intentarlo.-Windows 10 a", "% k|I ", "?2?9???D?P?`?t?~?", " di sistema.", "pi asetusten avulla manuaalisesti ja poista muita suuria kohteita.", "ivitage installimine.", "Geef de BitLocker-sleutel op", "ali s instalac", "1(1g1{1|2", "d chyby.", "installation de Windows se poursuivra automatiquement.", "8<\\D6", "re trying to use is encrypted with BitLocker. Choose a different drive and try again.", "9Windows 10 ", " Prenosi", "s aceptando.", "CDlpResponseImpl > > >::Cancel", "lni a munkak", "PL0~0`0g0M0f0D0~0[0", "t install Windows 10WWe", "Sprawdzanie komputera-Sprawdzamy, czy wszystko gotowe do instalacji", "Installer Windows Server", "nceki h", "rskenduse konfigureerimine", "s elemet.", " a aplikace se odstran", "Windows Server 2019 Kurulumu1Windows Server 2019 Kurulumu yeniden ba", "0W0f0D0~0Y0:", " funkc", "Licen", "Vi har lagt merke til at du har gamle installasjonsfiler for Windows 10. Vi kan hjelpe deg ", "r vi er ferdig, samt instruksjoner om hva du skal gj", "Lisensvilk", "n de preinstall.cmd7Ejecuci", "anas s", "re trying to use doesn", "tta p", "SSSSht", "kalun suorittamisessa oli ongelma", "TL0B0", "rcarea celei mai recente versiuni de Windows 10,Aceast", "jlok ", "ni toiming. Kui toimingud on tehtud, anname teile teada, mida edasi teha. See aken sulgub automaatselt %1!d! minuti p", " OK f", "6 6$64686<6T6X6l6p6", ". Suaktyvinkite dabartin", "vs avancerad maskinvara; vissa befintliga funktioner har ", ".\\Lang.ini", "installation.1V", "GetDeviceNumberFromPath: Drive %s CDeviceIoControl returned Error: 0x%X", "sIJ@=\"\"\"\"\" $!", "Instalacija ne mo", "10 est pr", " tarvitse, tai vapauta levytilaa k", "%Ne mo", "&Tilbake", "ObefTento k", "Wird vorbereitet (%d%%).Benutzereinstellungen werden verschoben (%d%%)", "o estamos a conseguir determinar se o Windows 10 j", "Keep personal files and apps", "letet manu", "rja be a Telep", ". Obnov", " limpiando antes de que se cierre!Esto puede tardar varios minutos.SEnchufa tu PC para asegurarte de que la bater", "ny fontos szempont:", ".?AVCWebbrowserUIHandler@@", "tfen Kurulumu kapat", "e se kada se prijavite u sustav Windows Server 2019. Da biste pridonijeli za", "*Instalacija operativnog sistema Windows 10;Nabavi ispravke, upravlja", "anje sistema Windows 10", "z silinir, ancak dosyalar", "Ne nyn", "cych przyczyn:", "L'installation de cette ", "N_U(u", "renin.", "Instalowanie systemu Windows 10JKomputer zostanie uruchomiony ponownie kilka razy. Mo", "jlokat a Let", "Valitse osio, johon haluat asentaa Windowsin.", " nameV", "o do Windows. Guarde e feche os ficheiros antes de come", " program znova.", "Se estiver a instalar pela primeira vez o Windows 10 neste PC, precisa de introduzir uma chave de produto do Windows 10 v", "sokat ", "Den Windows-version, der i ", "r du godk", "|||S||Q|Q|QS", "1+161E1", " dodane automatycznie0Instalator nie mo", "tijZP", "t Windows 108Ieg", "+Ocaw", "to edice Windows 10 nakonfigurujete po", "m komut dosyalar", "Nadogradite odmah ovaj ra", "r du starter", "klemeye devam edebilmeniz i", "(W`O6e0R", " et vous indiquerons ce que vous devrez faire. Cette fen", "d Product Key nefunguje. Znova zadajte k", "rast installimist ", "ite listu i poku", "rast.%Mida peaksite enne alustamist teadma?", "r utrymme och f", "O(udk", "imi$Kurulum kapanmadan ", "tigen Sie einen Windows 10-Product Key.", "e konfigurisati ra", "Microsoft Corporation1&0$", ";3;^;m;~;", " proizvoda ili licencu za Windows 10 da biste aktivirali sustav nakon a", "em ili kupite novi.", "lvfgH", " pode ser usada para adicionar recursos ao Windows. Ela n", "A~vbbS", "\"Bindestreck l", "ties, rad", "o validou a chave de produto (Product Key)PA Configura", "cijas datu nes", "~w~zz", "Vyberte jazyk, architekturu a edici", "#Licensvilk", "Hangi", " incapables d", "n. Si no instalas estas actualizaciones ahora, es posible que el equipo no funcione correctamente despu", "Sprache", "=$=-=6=h=", "rz9Chc", "kite Atnaujinti, kad pa", "ajte ponovno.&Windows 10 jo", " di download degli aggiornamenti di Installazione di Windows ", "kohtaiset tiedostot ja sovellukset'S", "installer Windows Server", "h: %1!d!%%6Pokra", "Ces mises ", " ustawienia systemu Windows, pliki osobiste i aplikacje, sprawd", "re Windows Server 2019. Lukk installasjonsprogrammet og pr", "ciu. Po", "nstalleerd.JDe installatie van Windows Server 2019 wordt voortgezet in Windows Update.", "k, lai lejupiel", "Su PC se reiniciar", "stup na internet. Kliknut", "}Q0~0Y0", "Bitlocker ", "Questi aggiornamenti consentiranno di eseguire l'installazione in modo corretto e possono includere correzioni importanti, driver di dispositivo aggiornati e file aggiuntivi non presenti nel supporto di installazione. Se non si installano gli aggiornamenti ora, il PC potrebbe non funzionare correttamente dopo l'installazione e potrebbe essere necessario reinstallare alcune funzionalit", "re having trouble determining if your PC can run Windows 10. Please close Setup and try again.", "klemeye devam etmek i", "%s ge", "Arhitekt", "Utilizarea spa", ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX/", "nstalleerdLUw pc is weer helemaal zoals deze was voordat Windows 10 werd ge", "Izjava o privatnosti", "iku, kdy byla instalace p", "teni.^A haszn", "Preparando instala", "BusinessN", " la desc", "Zainstaluj system Windows 105Pobierz aktualizacje, sterowniki i funkcje opcjonalne", "m Windows Server 2019", "sigyti ", "t mit mindestens %1!s! freiem Speicherplatz aus oder schlie", "Storage UseLManually explore your storage usage in settings to remove other large items.", "enim podatkovnim prometom, provjerite ho", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack", "Se Windows 10 ", "ljande saker f", "4 4$4(4@4D4\\4l4p4t4x4|4", "hoz sz", "CSetupUIManager::Register", "ISO dosyas", "; Windows", "[7b/e", "nce y", "es.5Falha ao abrir a Lixeira. Abra manualmente a Lixeira._Falha ao abrir o uso do armazenamento. Execute manualmente %1!s! para abrir a Limpeza de Disco.", ".LWindows Server ", "te nejd", "r kan du kontakta kundsupport och ange felkoden som referens.", ">?>U>", "tdeFGE", "2)31373D3", "=vldvnf", "Un probl", "ll. Ez az ablak %1!d! percen bel", "b nagym", "o da Unidade3A instala", "Ako Windows 10 na ovom PC-ju instalirate prvi put, morate unijeti valjani klju", "emiet ", "is kodas neveiks su ", "o atual do Windows, tem de comprar uma chave de produto ou uma licen", " pracovn", "Es konnten nicht alle erforderlichen Dateien heruntergeladen werden. Vergewissern Sie sich, dass eine Internetverbindung besteht, und versuchen Sie es noch einmal.7Preinstall.cmd-Bereitstellungsskripts werden ausgef", "CSetupResponseTemplate::InitializeRoutine", ", kokia buvo iki pradedant diegti ", "s befejez", "sok haszn", "&Aktualizovat", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX3", "nnen Ihren PC weiterhin verwenden.", "Windows 10 bu bilgisayara daha ", "- Windows 10.X", "m toto, abyste v", "i edi", " nije spreman za ovaj PC", "L0eQc0f0D0_0", "izveido un p", " naujo paleisti s", " diska mora biti %1!d! GB ili ve", " kontrol edip yeniden deneyin veya ba", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7", "a %d nije valjana, unesite to", "hem chvilky restartuje.", "ssel f", "Af;:u", "sticas opcionales. Estas actualizaciones ayudar", "tkamiseks valmis. Proovige installiprogramm uuesti k", "2$202<2H2T2`2l2x2", "A Windows nincs aktiv", "u Denetle", "CSetupResponsePageSysReq", "GetParent", "ruojame ", "e je v po", "($.:4?/CC?C??.41", "Leia este texto para saber com o que est", " Windows 10f", "ivog prostora. Odaberite neki drugi pogon i poku", "We need to do a few more things before you can update. We", "i instalarea ", "dzu, atlasiet nodal", "es do Windows.[As seguintes a", "rile Windows.CSet", "INFORM", "@@@@@@ ", "e uporabljati sistema Windows 10 Sistem Windows 10 ", "echno p", "anu un patur", "pet a telep", "wnym no", "ievada der", "chargements. Ouvrez manuellement votre dossier T", " Uppdatera f", " podmienky", " sufficiente per continuare l'installazione di Windows Server 2019. Prova a riavviare il programma di installazione.", "(Los guiones se agregar", " informacij, preberite pomo", "&Install", " Masterizza il file ISO su un DVD", "Pogon USB je pripravljen", "Microsoft ", ", pero no podemos ejecutar esta herramienta en tu PC. Si sigues teniendo problemas, haz referencia al c", "r den Internetzugriff anfallen. Klicken Sie auf \"Weiter\", um die neuesten Installationsdateien herunterzuladen.", "tkamiseks piisavalt ruumi. Proovige installiprogramm uuesti k", "Legal", "The bit locker key only contains 48 digital characters.", " nouveau.", " pro tuto edici Windows. Vyzkou", "#Microsoft yaz", "rja be a Bitlocker-kulcsot ehhez az azonos", "ments(Cet outil ne peut mettre ", "ionat. Reintroduce", "0F0j0", "Probl", " din pc. Aktiv", "&Tastatura na ekranu", "(%1!c!:)", "+_A]]", "ma Windows un p", "Trebamo jo", " saklamak i", "prs-AF", "nosti", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX8", "cie sa vy", "utujeme, ale m", "t.RAz eszk", "tta installationen av Windows. Starta om installationsprogrammet och f", "The installation cannot continue because Windows cannot restart the computer. Close any open programs, then restart the computer. Windows installation will continue automatically.", "n de esta edici", " y activ", "o par", "Here are some things to keep in mind:", "Folgende Punkte sollten Sie beachten:", "it deschiderea Co", "rminos de licencia y avisos aplicables", "Ove ispravke ", "re getting a few things ready", "e musisz wprowadzi", "nosti a", "no otvorite mapu Preuzimanja.VOtvaranje DVD snima", "tiski:Uzst", "Wij kunnen niet verder vanwege het volgende probleem:", "No pudimos descargar todos los archivos necesarios. Aseg", "avali da ovo re", "ProductKeyValidate", "a a dokon", "uriranja instaliraju. Windows ne", " olet tekem", "n de Windows encontr", " nytt p", " instalowana wersja systemu Windows jest inna ni", "o adicionados automaticamente1A configura", "hren Sie %1!s! manuell aus, um die Datentr", " postarali. Kliknut", "Windows 10'un bu s", " fona lejupiel", "yor!Bu i", "3.4E4_4p4", "CSetupUIManager: Showing exiting Setup", "ujejo pomembne popravke, posodobljene gonilnike naprav in dodatne datoteke, ki niso del namestitvenega medija.", " dakika i", "x]WUU", "zilleszt", "Niestety, mamy problem z okre", "es novamente mais tarde./A instala", "ivityksi", "uriranje.3Oslobodite %1!s! na ra", " daha sonra bir DVD", "n %2!s!", "Une erreur inattendue est survenue lors de l", "i este posibil s", "lpe dig med at frigive %1!s! p", "Uslovi licenciranja", "tare.", "Skoro hotovo", "Seleccionar una ruta de acceso", " ja muita tiedostoja, joita ei ole asennustietov", "terminer si votre PC est pr", "kseltme hakk", "Vad vill du g", "UnionRect", "HomeBasicN", "ba, un t", "i litsentsi.", "Percebemos que voc", "ges term", "Leggi attentamente per sapere le condizioni che accetti.", "unaru koji je dizajniran za kori", "gle fungerer ikke. Kontroll", " PC-en", "3!3@3_3~3", "CDlpResponseImpl > > >::SerializeRoutine", "Se continui senza attivare la tua versione corrente di Windows, dovrai acquistare un codice Product Key o una licenza di Windows 10 per attivare Windows 10 dopo l'aggiornamento.", "Am observat c", "ie, trebuie s", "La clave de BitLocker funciona! Contin", "ring av skript for precommit.cmd.", "pne programmer, og start deretter datamaskinen p", "bory Windowsu 10. M", "CDlpResponseImpl > > >::CheckInitialized", "%d%% complete", " autom", "DiskPartition", "CSetupResponsePageDU", " parametre pr", "s nevaram dator", "Ija/ o`0Kja/ j`:Kja/ c`^Kja/ ", "3UHHHHHHGG%", "Megtartand", "Seleziona un'unit", "D$D+D$,>K>X>`>", " to odstr", "i seznam pogonov", "e ispravno funkcionisati nakon instalacije i mo", "ter auf eine DVD brennen.", "707@7D7\\7l7p7t7", "'Windows ", "Palun oodake", "recek.", "itie ", "ries tie", "Wybierz obraz, kt", ">C>_>", "Lai turpin", "Architektura nie jest zgodna", "RBB1/", "StretchBlt", "m, a restartujte instalaci.", "&Instalare", "es, drivers e recursos opcionais (recomendado)", " cheie.;Cheia Bitlocker func", "Sans ", "^ck(W", ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationActionResponse@@@@@@@@@@", "nosti.", "rcarea unor fi", "d Product Key nefunguje. Sk", "Verifying your download", " verzi Windows pomoc", ".?AV?$CZeroInit@VCSetupResponsSelectMediaFormat@@$00@@", "undan bilgisayar", "emo u usluzi Windows Update.", "Asennus ei hyv", "pEr kan niet worden bepaald of de pc gereed is om Windows Server 2019 verder te installeren. Start Setup opnieuw.mEr kan niet worden bepaald of uw pc Windows Server 2019 kan uitvoeren. Sluit Setup af en probeer het opnieuw.1De installatie van Windows Server 2019 is mislukt", "_purecall", "tter installationen.", "200304183039Z", "vel encontrar uma pen USB.", "Windows 10-updatePUw opslaggebruik kan niet worden geopend. Open Opslag handmatig in Instellingen.>Prullenbak kan niet worden geopend. Open Prullenbak handmatig.`Uw opslaggebruik kan niet worden geopend. Voer %1!s! handmatig uit om Schijfopruiming te openen.", "END_SECOND_BOOT", "ku navedite tu ", "CDlpResponseImpl > > >::GetResultsRoutine", " se n", " bir dil kullanarak y", "1(2K2", "acak ", " (Edition) ", " cheie.;Cheia de produs func", "MigChoice", "wGerekli olan t", "555O5`5", "Lecteur flash USB", "s ejecutando.\"Error de instalaci", "Tu unidad flash USB est", " versiune de Windows 10.", " (sau s", "cej informacji dotycz", "Ann&ulla", "Criando a m", "lp af et andet sprog end det, du bruger i ", "sim no vietas, kur p", " PC-ul este gata pentru a continua instalarea Windows Server 2019. ", "Quieres continuar usando esta selecci", ":#;];", "{Kahjuks ilmnes probleem Windows 10 valmiduse kontrollimisel teie arvuti jaoks. Sulgege installiprogramm ja proovige uuesti..Windows 10 pole veel selle arvuti jaoks valmis%Veendumine, et installimine on valmis", "SizeofResource", "ovat%Instalovat syst", "n.lDepolama kullan", "CInstallUI::GetDefaultLanguage", "senia.&Zhrnutie toho, pre ", " dabar", " Windows 10n", "rken l", "buj ponownie..Uruchamianie skrypt", "zvetlen", "ami, vai izmantojiet r", "r./In", "CheckHotPluggableDriveEx: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X", "%d verbleibende Zeichen,Bindestriche werden automatisch hinzugef", "nybe vehet.^A Windows 10 friss", "dzu, ierakstiet ISO failu DVD manu", "ine doar 48 de caractere digitale.", "~0_0o0 ", "pne Diskopprydding.", "mto vydan", "Download den nyeste version af Windows", "em PC-ju dovoljno prostora za daljnju instalaciju sustava Windows 10. Poku", "Kontrollerer din pc", "Finner ikke installasjonsinformasjonen som kreves for ", "}P0PA", " yapmay", "&Avbryt", " inform", "m souboru setup.exe.", "Me ei saa j", "eck8^", "Ondersteuning", ".PBitLocker", "Datorn kommer att startas om flera g", " instalarea.", "mi podmienkami nes", "ai besoin d", "Usa las opciones recomendadas para este equipo", "CSetupResponsePageDiskSpaceReq", " Internet ", "%d tekens resterend0De koppelstreepjes worden automatisch toegevoegd'De productcode bevat slechts 25 tekens.", "z gerekiyor. ", "e nie dzia", "unalo mo", " nastavenie syst", "lg en anden ekstern lagerenhed", " &Quero ajudar a melhorar o processo de instala", ", nous ne pouvons pas d", " tik tuo atveju, jeigu diegiate ", "vW[CQ:", " ting klar&Dette v", "lla dina Windows-inst", "zda yeterli alan oldu", "ste to znova.`In", "X,\"2l", "%2!s!%", "_rWW'", " kilka minut.sNie mogli", " ei voitu asentaahTietokone on palautettu tilaan, jossa se oli juuri ennen Windows Server 2019:n asentamisen aloittamista.>Windows Server 2019:n asentamista jatketaan Windows Updatessa.", "architecture actuelles.", "Installerar Windows Server 2019", "%c: > > >::ExecuteRoutine", "actionString", "ku Obnovi", " installata una copia attivata di Windows 7 o Windows 8.1. Attiva la tua versione corrente di Windows usando un codice Product Key, quindi seleziona Aggiorna.", "s a szabad lemezter", "cie pozastaven", "ste to znova.,Sp", "ifra proizvoda se mo", " 'setup.exe'", "Nadaljuj tam, kjer sem ostal", " &klaviat", "INSTALLIMISTEAVE. M", "gsQGS", "Ayarlar", "ncepe.-A", "o necess", "%d tegn tilbage", ".?AVCSizableControl@UX@Common@ConX@@", "Aseman valinta/Asennus puhdistaa tietoja ennen sulkeutumistaan$T", "GetLocaleInfoEx", "tfen Windows", "Pokud na tento po", "2$2)242?2S2n2", "cie pr", "erli de", "&Reddet>Lisans ko", "e bez problema, a mo", "Il codice Product Key ha questo formato: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "u mapi", "i o cale", "Windows 10 u", "re opdateringen.$Frig", "a4Ovaj klju", "%VF;+", "Tu PC se reiniciar", "o ficar", "ivad seadmeti erineda.", "1,UEd", "re mindst %1!d! GB. V", "glicherweise in einem nicht unterst", "INFORMACIJE O INSTALACIJI: Neke Windows 10 funkcije zahtevaju napredni hardver; neke postoje", "vas vietas disk", "urira tijekom razdoblja podr", "elite narediti?", " nytt, fortsetter vi der vi avsluttet..Denne PC-en kan ikke kj", "t instala", ".?AV?$CUnknownImpl@VIDlpResponseFactory@@@@", "o corresponde", "$AAA<", "OX[g0M0~0[0", " legge til funksjoner i Windows. Den kan ikke brukes til ", " naujo t", "zt. Ha tov", "status", "Mamy problemTAby zainstalowa", "lit soubor ISO na DVD pozd", "charger l", "Necesitamos m", "owy klucz produktu systemu Windows 10.", "k dizininde ", "o\\#P\\", "rios ou use a Limpeza de Disco para liberar espa", "s detta s", "v vytvo", "mt-MT", "Langue", "asne zv", "@4199795", " komentoriviparametreja", "A term", "m soubor ISO na disk DVD ru", "CDlpResponseImpl > > >::GetResultsRoutine", "Her er noen ting du m", "5-5=5_5t5", "n S mode. Alege", "unaru. Ako se problem bude i dalje javljao, zatra", "Kasutage m", "itelja Windows Server posjetite: https://aka.ms/windowsserverupgrade", " pre v", " versijos atsiuntimas", "Disse opdateringer hj", "ltiger Befehlszeilenparameter", "Besturingssysteem:", "cia Windowsu 10RNepodarilo sa otvori", "ersiz ", "Quest", "e li vam to izazvati dodatne tro", "Vydanie", "Atidaryti", "jiet atjaunin", "Programme d'installation de Windows 10", "|C9t$", "onnistui vaiheessa %1!s!, koska toiminnon %2!s! aikana tapahtui virhe", "=<=D=P=t=|=", "n vaiheen. Windows aktivoidaan automaattisesti, kun asennus on valmis.", "\\[\\[\\[[[[[[MQODv", "Pode continuar a usar o PC.ROcorreu uma falha na instala", "bbra is nyugodtan haszn", "~0_0o0%Rn0", "niej nagra", "ver du ange en Windows 10-produktnyckel.", "kas reizes restart", "Architectuur komt niet overeen", "mi zadan", " > > >::SetResponseName", "nliche Dateien und Apps beibehalten#Nur pers", "kt no s", "Installation de Windows 10[Votre PC va red", "Uklonite sljede", "ve already taken care of this. Click Refresh to remove it from the list.gWe ran into a problem while trying to take care of this for you. Please refresh the list and try again.", ", co zrobi", "ynnistyy uudelleen useita kertoja, ja t", "etka instaliranja izdanja Windows Server 2019.LInstalaciju izdanja Windows Server 2019 nastavi", " Behold personlige filer og apper", " olur ve ", "8S9`9", "list m", "pte nov", "ni muu draiv ja proovige uuesti.", "SystemTimeToTzSpecificLocalTime", " Internet, puis r", "ltere Version von Windows zu installieren.", "tres ne seront pas conserv", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "iadne", ".?AV_com_error@@", "lectionnez la partition dans laquelle vous voulez installer Windows.", "tor nedok", "kresurserna*Det gick inte att initiera arbetskatalogen", "gbar. Um den Vorgang fortzusetzen, m", " actualizare.", "installation pourra reprendre..Ce PC ne peut pas ex", "o do Windows 10.", "Installa Windows 10", "i upgrade de la Windows 7 sau Windows 8.1. sau reinstala", "Windows no est", "qps-plocm", " %2!s! voln", " tietokoneessa Tietokoneessasi on jo Windows 10", "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX", " prozkoumejte sv", " &Chcem pom", "tenja alata", "cii vo va", "##'638", "t$USB-flashdrevet skal v", "rations suivantes :", "arm64", " utiliser votre PC.", "Datora p", " &Jag vill hj", "lg, hvad du vil bevare", "dhasson.bA Bitlocker-kulcs form", "ana, un t", "10 produkta atsl", "e biti potrebno nekoliko trenutaka da provjerimo je li ono ", "rende versjonen av Windows med en produktn", "Termenii licen", ">,>0>H>X>h>x>|>", "Liko 1 simbolis", "i je Windows 10 pripraven", "000 ", "t Windows", "ffnen Sie Ihren Downloads-Ordner manuell.pDer DVD-Brenner konnte nicht ge", "m se bohu", "ja val", "Microsoft Time-Stamp PCA 2010", " kompiuterio b", "Nije mogu", "ni minut.", "t, mit", "sleduj", "<%===c=", "n. Para conservar estos archivos, realice una copia de seguridad en estos momentos en otra ubicaci", "hren anfallen.3Welche anderen Updateoptionen stehen zur Verf", "Koristite spoljni ure", "pa-IN", "Ei otsikkoa", "du: 0x%1!lX! ", "Espere um pouco", "n de Windows 10 se configurar", "%s non ", ":M:S:o:y:~:", "skajte aktualiz", "Valitse kieli, arkkitehtuuri ja versio", "emiet lielus vai neizmantotus failus no mapes Lejupiel", "lygomis, i", "CBitmapDialog", "Instalar o Windows 100Obter atualiza", "!Reinstalez Windows 10 pe acest PC.Trebuie s", "S%&_7", "ilo nainstalovatkNastavili jsme v", "mogatott k", " proizvoda", "tkame Windows 10 installimist Windows Update", " impedindo a instala", "LoadLibraryW", "SetUnhandledExceptionFilter", ". Izberite drug pogon.", "~A[[;mmm5", "klemeye haz", "jo ier", "7(828", "ile nemoteno namestitev in lahko vklju", "r du er klar.", "tartovan", " forneceu n", "Vi kan ikke installere de nyeste funktioner og sikkerhedsforbedringer i Windows 10 p", "du per", "o de ArmazenamentocExplore manualmente a utiliza", " kertaa, sinun on annettava kelvollinen Windows 10 -tuoteavain.", "t able to download all the necessary files. Make sure that you", "Om du installerar Windows 10 p", "=,=X=", "lp til Installation, eller du kan k", "5kVcv", " reiniciando el equipo para continuar con la instalaci", "Link de site", "Ne kapcsolja ki a sz", "ali ove datoteke, odmah napravite njihove rezervne kopije na drugoj lokaciji za ", "t install Windows Server 2019aWe", "BWindows ", "unaru nije mogu", "ges f", "Saugyklos naudojimashRankiniu b", "6Windows 10", "X0~0Y0", "o manter nada", "ncerca din nou.UInstalare nu a ini", "Last ned oppdateringer, drivere og valgfrie funksjoner (anbefales)", "ky. Vybrat extern", "es mais tarde./A configura", "Espere7Hubo un problema al ejecutar scripts de preinstall.cmd.6Hubo un problema al ejecutar scripts de precommit.cmd.", "m~/1{`", "O(ug0M0~0[0", ".'Preinstall.cmd ", ":Notiek gatavo", "2 2x2", " k instala", ".text", "Windows Server 2019", "6Preparing to download the latest version of Windows 10", "o;mS_MR", "n de Windows 10", "etka instaliranja sustava Windows 10.", "en eine Bereinigung durch.)Der Vorgang kann ein paar Minuten dauern.`Schlie", "o do Windows atualmente instalada no seu PC n", "Comprobando esta clave(Esta clave no funciona. Prueba con otra.", "vesse az al", ", introduce", "IsWow64Process", "installation ne peut pas continuer, car Windows ne peut pas red", "y wzi", "dition de Windows que vous installez est diff", "bW0f0O0`0U0D0", "hoz.=Szabad", "moire flash est pr", "lmayan dosyalar", "Nk0TS", " PC. Zatvorite Postavljanje i poku", "&Instaliraj", "ber toho, ", "ia scripturilor preinstall.cmd.;A ap", "iniet uz Setup.exe.sNevaram noteikt, vai j", "s recientes para asegurarte de que se instale la versi", "ra diegimo laikmenoje.", "Computer", "Microsoft Corporation1200", "erli bir Windows 10 ", " Behold personlige filer og apper0Behold Windows-innstillinger og personlige filer", "nak telep", "Ambos\\Esta clave de BitLocker no funcion", "si o unitate flash USB.", "rskenduste toomine", "uriranje?", "acWKKkW}", "&Lukk Windows 10 kan ikke installeres.WPCen er tilbakestilt til slik den var like f", "lni k", "= =8=", "Beveik parengta", "sms-FI", "ierele, aplica", "n de Windows que es diferente de la que usas actualmente.", "re, om computeren har nok plads til at forts", "0F0k0j0", "Disk B", "cS_MR", "wCU+Gg", "e aplikacije i postavke bit ", "r du startet installasjonen av Windows Server 2019.BInstallasjonen av Windows Server 2019 fortsetter i Windows Update.", "cia pre Windows 10 ,", "ErrorState", "j komputer po instalacji mo", "Hjelp", "Spikker", "klemeye devam etmemiz i", "Lisez attentivement ceci avant de l", "Preostao je jedan znak.Klju", " prostriedky8In", "ajte ponovo da pokrenete instalaciju.", " reinstala", "", "dition de Windows", "vel instalar os aprimoramentos de seguran", "Ingen etikett", " pochi minuti.", "teignez pas votre ordinateur", "ndas f", " esistenti sono state modificate o rimosse. Windows 10 viene aggiornato automaticamente durante il periodo di supporto, che pu", "8,9j9", "lj ett USB-flashminne|Filerna p", " Nechci pou", "Operativsystem:", "trznego, takiego jak pami", "RtlSubscribeWnfStateChangeNotification", "es agora, seu computador poder", "I&nstalla", "RegCloseKey", " do inej oblasti a", "r jednotky0Instala", "ljuma installiprogrammist, Windowsi aktiveerima ja seej", " verificato un problema durante il download di alcuni file", " atkreipti d", "WWWWW~UUL", "%d%% conclu", "ju. L", "%3!s!$Reiniciando Instala", "%d tekens resterend", " cheie Bitlocker nu a func", "s inform", "aide du programme d", "Du kj", "CSetupResponsePageBitLockerKeyValidate: OnSetCursor", "Kontroluje sa k", "*Utiliza", "3*4:4[4p4", "tuma ehhez hasonl", "2019#Installation de Windows Server", "Vent littBDet oppstod et problem under kj", " suunnilleen t", "rskenduste otsimine: %1!d!%%", "1 tecken kvar", "r nap", "rification du t", "CSetupResponseTemplate::GetResultsRoutine", "Vyberte USB flash diskeSoubory, kter", "te du DVD ou dans le courriel que vous avez re", "%1!s! %2!s!*Pri ustvarjanju medija je pri", "anas, j", "q%07~=", "zh-Hant", "La clave de producto debe estar en la caja que inclu", "Estamos preparando algumas coisas", "Lietas, kas j", "si ja sulje sovellukset ennen asentamista.6Odota, kunnes sovelluksen asennuksen poisto on valmis.", "gd-GB", "1 character left.", " proizvoda sastoji se od samo 48 znakova.=Grupna vrijednost klju", "Der Product Key sieht ungef", "Verificando seu download", "mu programu se nepovedlo ur", "unalnik (ali boste namestili drugo izdajo), boste potrebovali klju", "e sa l", "nea de comandos no v", "Ouvrir le graveur de DVD", "<,<6>6>68666", "Entrer la cl", "Client", ":b'^^!", "o as outras op", "$$$*8", "installation de Windows 10.", "Use an external device such as a USB key, SD card, or external hard drive to temporarily extend your hard drive while the updates are being installed. Windows will not reformat your external storage device, and you can remove it after installation is complete.%Requirements Complete! Press Continue*Choose a different external storage device", "ber Ihre Speichernutzung, um andere umfangreiche Elemente zu entfernen.%Externe Speichervorrichtung ausw", "Windows 10 installieren/Updates, Treiber und optionale Features abrufen", "_CxxThrowException", "verstiga 4 GB (kan variera) och Internetavgifter kan tillkomma. Klicka p", " ou achetez-en une autre.", "$$$$$$$$'", "i introdus-o nu este disponibil", " system Windows 10, kliknij plik Setup.exe na no", "nales el c", "undan emin olunuyor", " %2!c!:-stasjonen.", " %1!d! ", "%1!d!%% dokon", "anas programmu.pLai ieg", "onnistui. Avaa ladattujen tiedostojen kansio manuaalisesti.tTallentavan DVD-aseman avaaminen ep", "bor ISO) pre in", "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d", " reporni", "n+Voit muuttaa Windowsin asetuksia my", "mmis, mille soovite installida.", "b-Nk0OUL", "ste n", "fr-ML", ", na co wyra", "NW0f0", "Licencszerz", " kullanmak i", "7$7<7@7X7h7l7|7", "lreiz.8Oper", "-Nn0Y0y0f0n0", "X{[go", "Dette kan ta en liten stund.VKoble til PCen for ", ". %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml", "OD0W0~0Y0", "lemi s", "pen a Windows Server 2019 telep", ">4?u?", "0?B$@0", "rias vezes. Este processo pode levar algum tempo.", "&Tastatur", "Irdkandjad", "lo do te", "MolemmatOBitLocker-avain ei toimi. Tarkista se ja yrit", "lida. Verifique-a e volte a tentar ou experimente uma chave diferente.QA sua chave de produto (Product Key) ", "#Windows Server 2019 ", "e zavrnete licen", "-Nk0OUL", ";[T>o>", " k internetu, a sk", "o para saber o que est", "ga nedarbojas. P", "!kn0\\OmiL0", "ih varnostnih izbolj", "Your files, apps, and settings can't be kept because you're installing an edition of Windows that's different than the one you're currently using.", "ga vai licence, lai p", " Medya Olu", " cheie de produs se poate utiliza numai pentru a ad", "Ava DVD-kirjuti", "Jei ketinate ", "rifier si ce que vous souhaitez conserver est compatible avec Windows 10.", "Udgaverne stemmer ikke overens", "tes.tWindows instal", "ber t", "kr-Latn-NG", "Filene, appene og innstillingene kan ikke beholdes fordi du har valgt ", "rgmine: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "installez Windows 10, vous ne devez pas entrer de cl", "n nuevamente.", "istiedosto", "elite zadr", "igi failide allalaadimiseks Internetiga ", "rifier et essayer ", "k, arkitektur och utg", " rzeczy, kt", "chargement de la derni", " vom spune c", "Algo est", "1+252f2", "i versiunea curent", " ukladacie zariadenie s vo", "4'5x5", "%s GB/", ", pokra", ")Microsoft Root Certificate Authority 20100", "Csak a szem", "Lo que requiere su atenci", "ID dialog nevalid", "sq-AL", "Bu anahtar denetleniyor1Bu anahtar ", "=A=o=}=", "ho miesta v po", "bn Papirkurv", "il pr", "ajte s drugim klju", " att du f", "SelectedDriveLetter", "Es konnten nicht alle erforderlichen Dateien heruntergeladen werden. Stellen Sie sicher, dass eine Internetverbindung besteht, und f", "van av Windows. F", "su faili tiks saglab", "diegta ir suaktyvinta sistema ", " stato ripristinato lo stato del PC precedente all'installazione di Windows 10.", "```@@@@@@@@@@@@@@@@@@", "ana neizdev", "pnie spr", "n mukaan laskutettavaa yhteytt", "ni pogoji za Microsoftovo programsko opremo", "psake nuppu Edasi.", "atwiona. Kliknij przycisk Od", "kkulcs csak 48 karakterb", "Ievadiet Bitlocker atsl", "enodTaj klju", " vil vi hjelpe deg med ", "r plass, og pr", " Internet peut engendrer des frais. Cliquez sur Suivant pour t", "latman", " galima tik tuomet, jei kompiuteryje yra ", " poprawny klucz5Wprowad", "elite da instalirate Windows 10 na drugoj particiji, potrebno je da kreirate medijum, a zatim da ga pokrenete kako biste obavili instalaciju.(Slobodno nastavite da koristite ra", "r vi f", "n care a fost livrat DVD-ul Windows sau ", "%1!d!%% voltooidcDeze productcode is onjuist. Controleer de code en probeer het opnieuw, of probeer een andere code.7De productcode werkt. U kunt doorgaan als u zover bent.", "labilir se", ". Instalace Windows bude automaticky pokra", "sEi ole varmaa, voiko tietokone jatkaa Windows Server 2019:n asentamista. Yrit", "edenemine", "Nu am reu", "glen indeholder kun 25 tegn.8N", "Almost ready", "CInstallUI::CreateResponsePage", " utiliser", "lida.", "v2j X", " Windows a potom in", "n de scripts de implementaci", "n.rPara obtener m", "Etiket Yok", "henduse, aktiveerime Windowsi teie eest. ", "Det skal du g", "CInstallUI::CInstallUIMessageWindow::SwitchToProgressPage", "o de armazenamento. Execute manualmente %1!s! para abrir a limpeza do disco.", "sitsi uurida.", "Pogon USB", "~Nepodarilo sa n", " yer a", "un eski y", "re having trouble determining if Windows Server 2019 is ready for your PC yet. Please close Setup and try again.\"Windows isn", "Ready to install", "888#ZZ[kggh", "8J > > >::Execute", "klemek istiyorsan", ".?AVCBrush@@", "#Windows 10", "strate, pentru c", "marrer pour qu", "e trajati nekoliko minuta.", "Hbg&~", "%1!ld!%% fuldf", "n.'Windows Server 2019:", "o e tente novamente.+O Windows n", "Voortgang: %1!d!%%8Selecteer een van de beschikbare opties om door te gaan.", "rbaudiet, vai tas nerad", "l v re", "e Windows name", "kleyemedikXBilgisayar", " estar instalada num diret", "&6o9{!-", ". Upozorn", "unar (ili instalirate neko drugo izdanje), potrebna vam je ", "lectionner la langue, l'architecture et l'", "rt a Windows telep", "lemez", "s de la instalaci", "\"\", ,',\"!", "re chcesz zachowa", "bbi probl", "rer scripts til udrulning af precommit.cmd*K", ".rdata$sxdata", "tti tudnival", "\"/@T)", " Windows 109", "anai Windows. To nevar izmantot sist", " gerekiyor. Yeniden ba", "bbi k", "netici hesab", " er du klar. > > >::Suspend", "LOOW<", "D$ SV3", "i u besprijekornom odvijanju instaliranja, a mogu uklju", " komputera.PInstalacja nie powiod", "CreateMutexExW", "nite zo zoznamu.hPo", "0,0u0", "Do not turn off your computer~The following things need your attention to continue the installation and keep your Windows settings, personal files and apps.FThe following things need your attention to continue the installation.]The bit locker looks similar to this: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX7The bit locker key only contains 48 digital characters.", "ENABLE_FEATURE", "97G998989", "_La unidad que intentas usar est", ".1Nous n", "o da aplica", "0S0h0", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", "g. Szabad", "hoz k", "s. Atidarykite ", "ste vara minst %1!d! GB. V", "Malgun Gothic", "re ready7We", "ny spos", "L0ck8^k0_j", "ciu, aktivova", "nder en anslutning med datapriser kan det leda till extra avgifter.)Vilka andra uppdateringsalternativ finns?", "enite namestitveni program.|Namestitveni program ni mogel za", "istenie disku na uvo", "zA unidade que voc", "sob s", "i gata de instalare", "tta med installationen.", "CSetupResponsePageDiskPartition::OnInitDialog", ")CEn az %1!s! bo", "kas neleid", "jabb verzi", "[Error Code: 0x%x]5Windows installation encountered an unexpected error.", "sitsi.SDVD-kirjuti avamine nurjus. Kirjutage ISO-fail k", "ShouldSuspendBitlocker", "i kutuda veya e-posta al", "n0]0p0", "ivitama.EInstallikandja loomise t", " ting f", " jour disponible", " programoje ", " na internet v", "r vissa Windows 10-funktioner kr", ")TufdddF|", "ne so druge mo", "n no est", "V3[:SG^&", "s atsisi", "<<=C=", " angi Windows 10-produktn", "o podem ser mantidos porque voc", "ciju, skatiet uzst", "[%hs]", "ajte ponovo.3Instalacija izdanja Windows Server 2019 nije uspela(Instaliranje izdanja Windows Server 2019", "Namesti %s>Windows znova zaganja ra", "0\"1F1P1]1j1", "r verktyget.", "dition de Windows qui correspond ", " nem tudta inicializ", "9%909E9P9i9s90:C:V:i:", "s az elej", "Nous ne pouvons pas pour l'instant d", " aktualizac", "&Fine", "CRtfHelpDialog", "N,g!k", "3 3,383D3P3\\3h3t3", "6IXYYXXAFC=:", "Bitte warten", "tteperioden. St", "O_U(u ", "GetSystemMenu", "g a friss", "ekajte da se instalacijski program zatvori&To bi moglo potrajati nekoliko minuta.jTijekom instalacije sustava Windows ne", "anje sistema Windows Server 2019", "Er is een nieuwere versie van dit hulpprogramma beschikbaar. U moet de meest recente versie downloaden en uitvoeren om door te gaan.?Download het bijgewerkte hulpprogramma voor het maken van media", "kingstips", ", DVD", "n y vuelve a intentarlo.%Error al instalar Windows Server 2019\"Instalaci", "du laiku.BL", "bu. Kad instal", "BitLockerKeyValidate", "in gereken y", "Your USB flash drive is ready", "lo je do neo", " kapsayabilir. Bu g", "s tov", "041604B0", "+Last ned den nyeste versjonen av Windows 10", "zca Windows", "t), Windows 10-es term", "0W0f0", "Klar att installera", "Otvori postavke skladi", "nde nicht fortgesetzt werden:", ".data$r$brc", "7(747@7L7X7d7p7|7", "avez plus besoin ou utilisez le nettoyage de disque pour lib", "ch. Pokud si te", "utujeme, ale nedok", "ujete ra", "Elementy wymagaj", "ratlan hib", "Prihv&a", "iras no pa", "Kuriama ", " fechada automaticamente em %1!d! minutos.&O que voc", " problemy, skontaktuj si", " eseguire Windows 10. Chiudi il programma di installazione e riprova.", " arba pakartotinai ", "t izmantot, nav pietiekami daudz vietas. Izv", " ripristinata dopo che avrai eseguito l'accesso a Windows Server 2019. Per garantire la protezione dei dati, ", "yi-001", " a dokon", "im Windows izdevumam. M", "gung?", "g a telep", "MapViewOfFile", "t. Ellen", "Czekaj", "u&QQhG", ">?>F>L>Q>\\>f>k>", "Supprimez les fichiers dont vous n", "ve set your PC back to the way it was right before you started installing Windows 10.", "VerSetConditionMask", "re version de Windows 10#Cela peut prendre quelques minutes.{Nous n", "hren, k", "<%<6 > > >::Suspend", "ranka negali nurodyti, koki", "iem nepiecie", "e pokrenuti Windows Server 2019qJednotka, ktor", "sticas de Windows 10 requieren hardware avanzado; algunas caracter", "Uusimpia Windows 10:n ominaisuuksia ja suojausparannuksia ei voi asentaa tietokoneeseen, koska levytila on v", "9+:a:", "Negalime t", "ljande", "t doporu", "To bi moglo potrajati nekoliko minuta.", "jra ezzel vagy egy m", "y osoitteessa: %1!s!", "rdet f", "ation de support mis ", ", czy Tw", "i cheia corect", "/Windows Server 2019 isn", "Neko nepatur", "e za %1!d!", "gra minuter.dDet gick inte att ladda ned alla n", "avons pu trouver les informations n", "cret kesilip kesilmeyece", "toarelor aspecte.dCheia BitLocker arat", "(%2!s!) ", "utilisation du stockage. Veuillez ex", "t save the installation info we need to continue installing Windows from where you left off. Sorry, you", "jumus.SJ", "ahovan", "Hvis du skal opgradere til Windows 7 eller Windows 8.1, eller du geninstallerer Windows 10, skal du angive en produktn", "i pob", "ci, kur", "veskite identifikatoriaus ", "te zada", "mta uppdateringar, drivrutiner och valfria funktioner", "ho okna$Nepodarilo sa n", "dzenie magazynuj", "USB flash disk je p", "progress", "Dokon", " sur ce PC et que vous le r", "e informacija potra", "X0f0K0", "%2!s!1Va", "%2!s!&", "t haszn", "n schimb spa", " nous nous ", "Datorn startas strax om", "klediyseniz kullan", "n ejecutando y reinicia el equipo. Se continuar", "terminer si Windows", "Het is niet gelukt om alle benodigde bestanden te downloaden. Controleer of u verbinding hebt met internet en probeer het hulpprogramma opnieuw uit te voeren.:Er is een probleem met het uitvoeren van dit hulpprogramma", "InternalName", "kkelen du skrev inn, er ikke tilgjengelig for ditt spr", "gu.&Notiek sist", "Kaikkia tarvittavia tiedostoja ei voitu ladata palvelimesta. Varmista, ett", "%% completado", " av datamaskinen", " supportata dallo strumento.", " poss", "hnout 4 GB (m", "u, nu reu", "8$8T8l8", " w zamian u", "v igen.ADerefter kan vi hj", "ajte ponovno.,Izvo", "v7 4\\", "QQSW3", "rXjKz", "ljaanded ei kattu", "rente.BVotre cl", "96:@:y:", "e odpreti. ", "junkite kompiuterio", "e odpreti. Mo", "ve-ZA", "-Unesite klju", "unalnik, da bo nadaljeval namestitev.", "mr-IN", "%3!s! Pr", "AddFontMemResourceEx", "^##P#", "k programlar", "e yarad", "Sto ottenendo gli aggiornamenti", "CDlpResponseImpl > > >::InitializeRoutine", ",Estoy reinstalando Windows 10 en este equipo4Necesito comprar una clave de producto de Windows 10", " indirmeye haz", "u administratorskog ra", "Bitlocker-kulcs be", "tape. Nous activerons automatiquement Windows une fois l'installation termin", "r du kontakte kundest", "Licensvillkor", " a teraz ho chcete prein", "06>)j", "!Felkod: 0x%1!lX! - 0x%2!lX!", "Meiryo UI", " fjerne det fra listen.[Det oppstod et problem da vi pr", "bs-Cyrl", "IDATr", "Installing Windows Server 2019", "0f0D0~0[0", "We need more space-%1!d! GB of free disk space needed on (%2!s!)YRemove files that you no longer need or use Disk Cleanup to create space, then try again.*There was a problem downloading some files", "o pode continuar porque o Windows n", "anu no t", "Escolha a m", "si id", "tietoja alta, jos haluat tiet", "t ready for this PC yet%Making sure the installation is ready", "terge. Pentru a p", "kte fixa det h", "Tips voor probleemoplossing", "m saglab", "zh-CHT", " gerenciar as configura", "boru setup.exe /? v kore", "Klucz produktu powinien znajdowa", " installere %1!s! p", "Introduce", "ti naudojamas tik funkcijoms ", "Vorbereitung6Ihr PC kann mit diesem Tool nicht aktualisiert werden.xDie Sprache oder Edition der momentan auf Ihrem PC installierten Windows-Version wird von diesem Tool nicht unterst", "my.iK", "This may take a few minutes.qWe weren", "ste ladda ned och k", "pen a Windows 7 vagy a Windows 8.1 aktiv", "This may take a few minutes.XPlug in your PC to make sure that your battery doesn", "digo de error.", " jour? Pourquoi ce message appara", " izdelka ali licenco za Windows 10 in Windows 10 aktivirati po posodobitvi.", "as pokusu o vykonanie tejto akcie namiesto v", "Lagringsanv", "zatra, hogy az akkumul", "CDlpResponseImpl > > >::UpdateState", "i mai departe. Aceast", "st visszaigazol", "n bejelentkezik a Windows", "imli jsme si, ", "t. Ind", "tres, fichiers et applications, car l'", "ti ei toiminud. Kontrollige tootev", "OpenSemaphoreW", "Sprawdzanie tego kluczaMTen klucz nie dzia", "unarnOva alatka ne podr", "Odpri mapo Prenosi1Odpri mo", "Fortsett fra der jeg avsluttet", "ti atsisi", "o izdevumu tikai tad, ja instal", "z gerekecek.", "Den har dette format: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX8Du skal g", "R='^gM?", " Windows 10 uzst", "hrt werden. Wenn weiterhin Probleme auftreten, wenden Sie sich unter Angabe des Fehlercodes an den Kundendienst.", "Oppdateringene er installert, men installasjonsprogrammet for Windows 10 m", "ar a instalar o Windows 10.", "Finner ikke lisensavtalen.", "(%1!c!:) - %2!s! ", "ajte ponovo.BZatim ", "EIDATx", "tten kan variere etter enhet.", "unalnik in dokon", "Meiryo Bold", "Selecione a imagem que deseja instalar.", " k instalaci", "e da pokrene Windows Server 2019. Zatvorite instalaciju, a zatim poku", "klenirken sabit s", "tu cieto disku, kam", "potek", "sidarys po %1!d! min..Dalykai, kuriuos reikia ", "tigte Dateien, oder geben Sie Speicherplatz mithilfe der Datentr", "Windows 10 v", "W0f0D0~0Y0", "Atidaryti DVD ", "l automatikusan bez", "anas avoti, un restart", "%s GBc", "anciens fichiers d", "e! Nastavite kada budete spremni.", "Please select the partition that you want to install Windows on.", "k vai j", "LoadLibraryExW", "re on a metered connection, check to see if this will result in extra charges.&What are some other options to update?", "unalnik se bo nekajkrat znova zagnal. To bo morda trajalo nekaj ", "Continue from where I left off", "ndiga filer. Kontrollera Internetanslutningen och f", "c w ulepszeniu instalacji systemu Windows", " https://aka.ms/windowsserverupgrade.", "ndirme yakla", "daug taip: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.", " necessario il tuo intervento per completare queste operazioni.`BitLocker ", "Kalba nesutampa", "Odpri zapisovalnik za DVD-je", "Veja mais abaixo se estiver interessado em saber a raz", "Daugiau informacijos", "ci e-mail z potwierdzeniem. Kiedy po", " &Jeg vil gerne hj", "ti sisaldab ainult 48 arvum", "ete na", "stato", "ger vos donn", "t dig. Uppdatera listan och f", ">,><>@>D>X>\\>t>x>", "i o conexiune tarifat", "ani, ali je va", "^Pode levar algum tempo para verificar se o que voc", " installationsmediet.}Vi kan inte avg", "es abaixo para concluir a atualiza", "IsChild", " BitLocker", "nd ISO-filen til en dvd manuelt ved hj", "ivitada.-Selle t", "Tietosuojatiedot", " Windows 10", "A prote", " disk.", "&Akzeptieren", "stroj vo va", "SetupDiGetDeviceInterfaceDetailW", "CSetupResponseTemplate::ExecuteRoutine: Cancel button clicked.", "ments qui requi", "su PC dators p", "installation. Passez en revue les informations dans %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml pour r", "s valid", "MDeze productcode werkt niet. Probeer een andere code of koop een nieuwe code.", "ebujeme %1!d! GB m", "/,`|r", "o, ative o Windows e, em seguida, inicie a instala", " Windows Server 2019i", "r: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "PC sa nieko", "t. preostalih znakov: 1", "asa.+Po", "Preverjamo, ali je vse nared za namestitev", "o apenas se estiver a instalar o Windows num PC concebido para ser executado no modo S.DA pen USB tem de ter, pelo menos, %1!d! GB. Selecione outra unidade. Transferir a vers", "Check Compatibility", "r jednotky", "Windows-Datenschutzbestimmungen", " u sebe, dokud se znovu nep", "DeleteDC", " niepotrzebne pliki albo zwolnij miejsce za pomoc", "Windows 10 selle v", "Aktuelle Version von Windows herunterladen", "rizze a(z) %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml f", "ddgmx", "OD0n0 ", "&Continuare", "Dette kan tage flere minutter.nVi kan ikke downloade alle de n", "a aktu", "o pode ser usada para instalar o Windows.", "re installationen af Windows.", "LfVFVLlx", "tkata ", "l prisijungsite.&Nepavyko ", "ta-LK", "e potrajati nekoliko minuta.", "* $+*999=IIOOOqqqqqqqZopdu", "n de Windows que coincide con la clave de producto indicada no est", "ovat v instalaci Windows 10. Zkuste restartovat instala", "0W0~0Y0", "jPSV", "diegti.", "Per sapere il motivo, vedi qui sotto.", "A continuaci", "tuvi manu", "n actual de Windows puede estar instalada en un directorio no compatible o es posible que est", "o na qual deseja instalar o Windows.", ">(>,><>L>\\>`>d>|>", ".?AV?$CZeroInit@VCSetupResponsePageActivation@@$00@@", "isesti p", "nacak ve Windows Server 2019'da oturum a", "OX[v^sQ", " sursele de instalare sunt accesibile ", "button", "Preostao je 1 znak'", "Oppdateringer implementert!Ingen tilgjengelige oppdateringer", "QueryPerformanceCounter", "lSprawdzenie, czy elementy, kt", " anlamakta sorun ya", "ug-CN", "i Windows, apoi s", "SiteLink'Rufen Sie die folgende Seite auf: %1!s!", "RAceast", "ipraven", " \"%c\"", " spoljnji ure", "3!4T4^4", " jour pendant la p", "@eT0@", "0h0puj0", "i manual ", " activado en este PC. Esto significa que deber", "0W0f0O0`0U0D0", "i Windows.", "k[1zup", "Installer Windows 101Hent opdateringer, drivere og valgfrie funktioner", " Windows-kiad", "NMRn0", "Nyelv", "kkelen fungerte ikke. Angi den du kj", "echna pr", "n de Windows descarga las actualizaciones", "rQuita la siguiente unidad externa y haz clic en Aceptar para reiniciar y completar la instalaci", " pro v", "%1!s!: %2!s!", "es ajudam a facilitar a instala", "rankai nepavyko ", "0-Nk0", "vel se voc", "[06xm*.", "tre suspendue au cours de cette mise ", "Descarga la ", "CSetupUIManager: Showing Compat resolve message", "nda en extern lagringsenhet i st", "chargement des mises ", "e si nainstalujete nejnov", "anas to var", ", turite b", ".?AVCSimpleWizard@UX@Common@ConX@@", "nite miesto a potom kliknite na polo", "r identifieraren: -Windows beh", "d Product Key pro Windows 10", "8 8.8G8R8s8", "InitializeCriticalSection", "W0~0Y0", ", mihin j", "<4<<)>z>", " a dal", "ico sistema Windows in nato izberite ", "333]3}3", "ete instalaci Windows.", "i spou", "DLPLOG: [0x%X] [%s] [%s]", "rgmised asjad, mis vajavad teie sekkumist.", "unalniku ni aktiviran", "akajte:Pri", "tres.V", " jour de Windows 10.", "T$0QQV", "O(ug0M0", "te star", "alost, imamo pote", "%1!ld!%% completado", "%2!s!", "r die ID ein: 1Windows ben", "sta.\"Chcete pokra", "##''#", "zeltmeleri, g", "emy okre", " concordando.", " de produit.'Votre cl", "hendage v", " nem tudta meg", "Bruk de anbefalte alternativene for denne PC-en", "essayer.+Windows 10 n", " wszystkich potrzebnych plik", "l. Toto okno se automaticky zav", "tfen bekleyin!Bu i", "Uppgradera den h", "Instalovat %sISyst", "einstalaci, m", " poplatky.$Ak", "Instalator nie akceptuje argument", " sa nenach", "wcsncmp", "installation de Windows introuvables. Ins", "Create installation media (USB flash drive, DVD, or ISO file) for another PC", "ajte ponovno pokrenuti program za instalaciju.", "h%EGG9%", "No updates available", "jumu/Notiek p", "es ser", "&Diegti", "te sa do Windowsu prihl", " USB-stasjonen slettes. Hvis du vil beholde disse filene, sikkerhetskopierer du dem til en annen plassering n", "0L0B}", "(%1!c!:) - %2!s! disponibile", "Instalacija izdanja Windows 10", "lo je do problema pa ne mo", "l, mus", "emti; sist", "skite, kai b", "Station selecteren{hhe", "tirme yapabilmeniz i", "dFEdeh", "ru-RU", "n de precommit.cmd3Ejecutando scripts de implementaci", "jeblikke at kontrollere, om det, du gerne vil beholde, er kompatibelt med Windows 10.wDenne produktn", ">9s0t", "k ki Windows Server 2019'un bilgisayar", "; ;4;D;T;X;\\;t;", " merevlemez haszn", "tter vi d", "ifru proizvoda za Windows 10 ili licencu za aktiviranje operativnog sistema Windows 10 nakon a", "s instalando una edici", " syst", ".?AV?$CZeroInit@VCSetupDlpResponseFactory@@$00@@", "cutez manuellement %1!s! pour ouvrir Nettoyage de disque.", "9&9I9U9", "tartova", "m spusti", "lhetnek fel. Kattintson a Tov", "Invalid parameter passed to C runtime function.", " friss", "Tee valimine", "BitLocker-nyckel", "Versies komen niet overeen", "8\"8>8M8\\8k8z8", "unalniku dovolj prostora za nadaljevanje name", "Error reporting telemetry for bOpenDownloadsClicked: [0x%X]", "n alman", "cie4In", "kkelen for IDen: %Windows trenger plass for ", "n etapa %1!s!, cu o eroare ", "chargements.h", "elite namestiti Windows.", "essayez d", "ivitysvaihtoehtoja on?", "kkulcsot kell v", "ckt att du har gamla installationsfiler f", "i %1!s!.", "Open&I want to use external storage instead$I don't want to use external storage", "CSetupResponseTemplate::GetResultsRoutine", "gu vai ieg", "quz-EC", ".TTento k", "veskite t", "ket matchar inte", " uudelleen.4Windows Server", "?Q?X?b?g?s?", " kalb", "&Wstecz", "a. Wprowad", " e lingue facoltative.", "%2!c!: ", "es ou supprim", "Lo&obu", "n a ciertas cosas.", "e datoteke biti zadr", "ni muu draiv.", "lp af en administratorkonto.+Du skal br", " i spr", "n oldu", "ovat v instalaci syst", "s a conclus", ". Aktualizaci dokon", "sben seg", "st, hogy tiszt", "d.8Tento k", "n prezent pe PC nu este acceptat", "surea argumendid", "bernommen Es sind keine Updates verf", "USB fle", "Lugege altpoolt, miks seda teha.", "tFtv||~", "2019 a ", "enje S re", "394G4P4Y4o4}4", "Aktualizacja systemu Windows 10pNie mo", "in 350 MB de spa", "l neprisijungsite.", "tenje pohraneVRu", "RtlUnsubscribeWnfNotificationWaitForCompletion", " jour pour Windows 10", "d Product Key se d", " problem podczas pobierania niekt", "nda n", "Pogledajte dolenavedene informacije ako vas zanima razlog.", "This tool can", "tietoja", "sl-SI", "i je in", "CSetupLangIniLoader::Initialize: LANG.INI Directory = %s", " tamamlan", "MediaSetupUIMgr.DLL", "Kasutatava kandja valimine", "Mitte praegu", "utujeme, m", "nik a Windows aktiv", "Hvis du vil installere Windows 10 p", " en DVD med %1!s!.", "%1!ld!%% complete", "Verificar a Compatibilidade", "initi jo", ".EWindows ", "Se o Windows 10 j", "CSetupResponseTemplate::OnCancel", "unu, ki ste ga dobili po e-po", ".?AVCSetupDialogBase@@", "n.(No se pudo instalar Windows Server 2019.lHemos vuelto a configurar el PC a como estaba justo antes de comenzar la instalaci", "isel dosyalar", "re funkcje systemu Windows 10 wymagaj", " saklayamazs", "in mevcut de", " %d%%", "2019 doit red", "_a0O0`0U0D0#", "l paleisti s", "oSe vuoi installare Windows 10 in un'altra partizione, devi creare il supporto per l'installazione ed eseguirlo.\"Puoi continuare a usare il tuo PC.XL'installazione non ", "%1!s!", "m dosyalar", "terse, dar fi", "ycie magazynuPR", "Savjeti za otklanjanje pote", "installation et la conservation de vos param", ")Download den nyeste version af Windows 10", "m bud", "e elementy.*Wybierz zewn", "li smo na problem prilikom poku", "tane s", "e potrajati nekoliko minuta.mNismo uspeli da preuzmemo sve potrebne datoteke. Uverite se da ste povezani sa internetom i poku", "Bezplatn", "Start p", "The bit locker looks similar to this: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX9", "n y se reanudar", "ilerleme durumu", "5)5V5k5", " installationsmediet. Om du inte installerar uppdateringarna nu kanske datorn inte fungerar korrekt efter installationen och du kan beh", "sma-SE", "838O8e8", "Biztosan kil", "-P3}G", "O\\U^.", "diegta nepalaikomame kataloge, arba bandote ", "Windows har inte aktiverats p", ". Uporaba prostora za shranjevanjeoV nastavitvah ro", "inizden emin misiniz?", "e nisu potrebne ili se poslu", "VorbereitensDarum haben Sie sich bereits gek", " z Internetem, system Windows zostanie aktywowany automatycznie.", "Det gick inte att hitta den installationsinfo som vi beh", "k, hogy minden k", "s toliau pateiktomis instrukcijomis, kad u", "delmi nyilatkozat", " a obter os arquivos mais recentes para ter certeza de que instalar", ">,?T?", " possibile determinare se il tuo PC ", "Esta chave de produto (Product Key) s", "Les dette, slik at du vet hva du g", "Actuali&zar", " du angi en gyldig produktn", "ou obsahovat d", "got h", "Taal komt niet overeen", "sek keres", "Media voor Windows 10 maken&U kunt de pc gewoon blijven gebruiken.", "CSetupResponsePageDiskSpaceReq::RefreshDriveList", "CSetupResponseTemplate::OnNext", "%d caract", "A transfer", " to bude hotov", "3F4L4^5d5y5", "a__\\\\\\\\\\R0}", "<'<;Instala", " online.", "i aplica", "e to trva", "9~ltbSWW", "tu papildinform", "a zainstalowana i aktywowana kopia systemu Windows 7 lub Windows 8.1. Aktywuj aktualn", "boryEOdstr", "lgende ting kr", "irin ve Kurulumu yeniden ", "inka Stiahnut", "o suficiente. Selecione uma unidade diferente e tente novamente.8Em seguida, ajudamos a libertar %1!s! da unidade %2!c!:.", "pnie uruchom polecenie ", " alebo nebud", " fortsette installasjonen av Windows fra der du avsluttet sist. Du m", "ivitamiseks ja Windowsi installimise l", " variare in base al dispositivo.", "Auf dem Laufwerk, das Sie verwenden m", "gBitLocker ", "zdnite K", "Q\\XBgg", "stup ke zdrojov", "Dowiedz si", ", aby usun", " pode ser usada para adicionar funcionalidades ao Windows. N", " la reprise de l", "Non ora", "inome, ar j", "ivitada.2Kontrollimine, kas teie arvutis on piisavalt ruumi,Kas soovite selle valiku kasutamist j", "kleme bilgisini kaydedemedik. ", "SgqW0f0O0`0U0D0", "nda bulunmayan ek dosyalar", "Za kaj morate poskrbeti", "jiet tos cit", "Unidades remov", "SelectedDUChoiceVisible", "&Skjermtastatur", "leri ve iste", "u proizvoda nije dostupno na trenutno odabranom jeziku ni arhitekturi.", "Y2{#z", " kullanmaya devam edebilirsiniz.JY", " para executar o Windows 10 no seu PC. Feche a Configura", " systemu Windows.qDysk, kt", "a proizvoda pa odaberite Osvje", ": (Norint naujinti, ", "i apoi selecta", "nk let", "i meilikviitungis. Kui loote Interneti-", "ritet", "%2!s!>Va", "Bitlocker atsl", "n si quieres averiguar por qu", "ber 4 GB enthalten (Abweichungen m", "Valmiina asennusta varten", "i sa v", "#Installation de Windows Server", "urada: (%2!s!)tArt", "- Windows. ", "Hvis du skal installere Windows 10 p", "USER32.dll", " Windows 10P", "chargement en arri", "Windows 10 downloaden", "QSVWj", "p: %1!d!%%2Wybierz jedn", "tta m", "ber jazyka, architekt", " belirlemede sorun ya", "CSetupUIManager::OnSetupFail", "Teisin", ".?AVCSetupResponsePageActivation@@", "tani, hogy a Windows Server 2019 telep", "nyoznak Windows telep", "unalnika", "&Close%Your PC will restart in a few moments", "inde Windows 10", "o pode determinar a vers", "te zadat platn", "sa>A precommit.cmd k", "6!7i8p8", "dition de Windows diff", "[[6oi\\", "0.1<1R1", " installere enkelte valgfrie funksjoner og spr", " aplikace %1!s!.", "rcat resursele lingvistice/Instalarea nu a ini", "e posodobiti va", "Destek", "2Jos hylk", "smj-NO", "GetDeviceCaps", "iu verziurK dispoz", "s dydis turi b", "sit fi", "aja rje", "e obavijesti i licencne odredbe", "s licencfelt", "en0_j", "e zainstalowano najnowsz", "dajov by ste po", "ka versija. Lai turpin", "k9U)d", "lectionnez le support ", "nia s", "Izjava o zasebnosti", "Microsoft JhengHei UI", "CSetupResponsePageBitLockerKeyValidate: OnBitLockerKeyEditUpdated", ":K:V:m:x:", "k olmal", "; ;E;q;", "SiteLink$L", "Thales TSS ESN:FC41-4BD4-D2201%0#", " reiniciado dentro de momentos", "anju namestitve sistema Windows", "ties, jo Windows nevar restart", "1#1;1J1S1j1", "lido0N", "Sto verificando il codiceWIl codice immesso non funziona con questa edizione di Windows. Immetti un altro codice.RQuesto codice Product Key non funziona. Immetti di nuovo quello acquistato online.", "lja a Windowst, majd ind", "das ir citas atjaunin", "ime.1Windows Server 2019 pole selles arvutis kasutatavbDisks, kuru m", "i. Joudut valitettavasti antamaan tietosi my", "es-CR", "s volviendo a instalar, puedes omitir este paso. Se activar", "iere de instalare.", "sr-Latn-RS", "t szeretne haszn", "dium a pak z n", "h(hch", "gikast", "a la Papelera de reciclaje para quitar los archivos eliminados de la unidad del sistema.", "Ha kor", "tytty", "nstalleerd, maar werken pas nadat Windows Server 2019 Setup opnieuw is opgestart. Hierna wordt de installatie van de updates voltooid.9Windows Server 2019 kan niet op deze pc worden uitgevoerd_Stasjonen du pr", "CSimpleWizard", "Algo pas", " Pomi", "1$1(1,1@1D1H1L1P1T1X1\\1`1d1h1p1", "Preparando el programa de instalaci", "s rendszer:", "lise m", "tkame sealt, kus pooleli j", "emo da sa", "1 tecken kvar'Produktnyckeln ska inneh", "se el", " proizvoda sustava Windows 10", "riista v", "Abrir la papelera de reciclaje", "me toki", "CompatDownloadReq", "nejte po", "os atjaunin", "}>87;", "my objevovat i d", " deve saber antes de come", "da ne", "est produit lors de la cr", "n de Windows 10_No se pudo abrir el uso de almacenamiento. Abre manualmente tu Almacenamiento en Configuraci", "nchide instalarea,Aceast", " gastos adicionales.3", "ite: %1!s!", "enu vezu, proverite da li ", "in alana ihtiyac", "i instalarea.sNe pare r", "laties patur", "sureaargumente. Lisateabe saamiseks lugege installispikrit v", "===p=", "CInstallUI::OnActionChanged: Cancel is requested. Returning ERROR_REQUEST_ABORTED", "Jazyk:", "de kullan", "SetupDiEnumDeviceInterfaces", " funkce Windows 10 a vylep", "374D4R4Y4_4d4o4", "W0f0zzM0", "rja om fr", "3?9\"\"\"! ", "s administrar tu configuraci", "ie naujinimai pad", ".?AV?$CUnknownImpl@VIDiskSpaceActionResponse@@@@", "re valide", "2\"2(222B2R2b2r2", "Chave do produto (Product Key)", "s par gatav", " architektura.", "ite ISO datoteku na DVD koriste", "https://go.microsoft.com/fwlink/?linkid=2041981", "State", " da biste uklonili stavku sa liste.ZNai", "U redu", "elite da instalirate Windows.", "^7b{vU_0R ", "Dette kan ta noen minutter.lVi kunne ikke laste ned alle de n", "nnen nicht beibehalten werden, weil Sie eine andere als die gerade verwendete Windows-Edition installieren.", "Promenite izbor onoga ", "pe en produktn", " na internet, a sk", "s reciente.:Descargar la Herramienta de creaci", " demorar algum tempo.bA configurar a atualiza", "Qa6R0", ".?AVCGdiObject@@", "N&on accettoTSe non accetti le condizioni di licenza, il programma di installazione verr", " uudelleen tai kokeile toista avainta.9Annoit oikean tuoteavaimen. Voit jatkaa, kun olet valmis.", "hren oder Windows 10 erneut installieren, m", ", mus", "nceput", "It looks similar to this: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXRThe following things need your attention before you can continue the installation.", "kai(S", "ste pou", "puleviimiseks j", "Jei t", "Selecione o idioma, a arquitetura e a edi", " odpor", "Arvuti kontrollimine'Uurime, kas olete installimiseks valmis", "t-il?", "Diegiama ", "Potrzebujemy wi", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "O@7Cm", "Izgleda ovako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXWDa biste mogli nastaviti instalaciju, najprije se morate pozabaviti sljede", "Windows isn", "anas iesp", "ret v", "Clave de producto", "jumu p", "pen m", "espace5%1!d!Go d", " de produit, puis s", "sselt. W", "r redan Windows 10", ", jest zaszyfrowany przy u", "r redo", " zgodne", " arba licencij", "end ausf", "%systemdrive%", "iu verziu Windowsu.aNa jednotke, ktor", "AtsisiuntimaiFPa", "kolikr", "uJ0}f", "ti pateiktas su DVD pakuote arba gautame el. lai", "hemmin uudelleen.'Asennus ei voinut asentaa siirtotietoja-Asennus ei voinut puhdistaa asennustiedostoja8Asennus ei voinut selvitt", "PREPARE_SAFE_OS", "lg instruktionerne nedenfor for at fuldf", "pnie pomo", "Premje", "bory. Skontrolujte, ", "te.2Windows Server 2019 se n", " uudelleen.:Windows 10 ei ole viel", "Drive Selection", "Vi kan ikke installere de nyeste Windows 10-funksjonene og -sikkerhetsforbedringene p", "r ein Upgrade von Windows Server finden Sie unter: https://aka.ms/windowsserverupgrade", " nytt flere ganger. Dette kan ta litt tid.", "Als u Windows 10 op een andere partitie wilt installeren, moet u eerst de media maken en deze vervolgens uitvoeren om het systeem te installeren.&U kunt de pc gewoon blijven gebruiken.RDe installatie is mislukt in de fase %1!s! met een fout tijdens de %2!s!-bewerking", "%s GB.", "LagerforbrugZGennemse dit lagerforbrug manuelt under indstillinger for at fjerne andre store elementer.", "ren!Kies welk medium u wilt gebruiken", "i manual spa", "tenja pohrane nije uspjelo. Ru", ";0;L;[;j;", "cessitent du mat", "i din nou.5Se execut", "inyne arba paleid", "zellikler al", " nytt, eller pr", "v5uP[", "iu liber de cel pu", "mn-Mong-CN", "Tiedostojasi, sovelluksiasi ja asetuksiasi ei voi s", "n continuare PC-ul.NInstalarea nu a reu", "Naujausios ", "%3!s! We bereiden een paar dingen voor*Dit hulpprogramma kan uw pc niet bijwerken", "Tietokoneen tarkistus", "w, aplikacji i ustawie", "GB. Si usas una conexi", "installation de cette ", ".?AVIPageHost@@", "n de Windows 10. Podemos ayudarte a obtener los archivos m", "ngen (eller installera en annan utg", " szolg", "CSetupResponsePageBitLockerKeyValidate::InitializeResponsePageRoutine", "0n0zzM0", "li instalujesz system Windows 10 na tym komputerze po raz pierwszy, musisz wprowadzi", " varten", "To mo", "my problem. Od", "tres Windows.TVos applications et param", "jumus", " saugykl", " %2!c!:.", " hente oppdateringer, drivere og valgfrie funksjoner p", " il PC per l'esecuzione in modalit", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatActionResponse@@@@@@", "Mantieni solo i file personali", "mk-MK", " for at forts", "liwia tylko dodawanie funkcji do systemu Windows. Nie mo", "se a g", ", da znova za", ".?AV?$CZeroInit@VCSetupResponsePageEula@@$00@@", ".CRT$XLA", "rxmV6", "tottuk a k", "mi-NZ", "sit Acordul de licen", " tai asennat Windows 10:n uudelleen, et tarvitse tuoteavainta.", "unar.KOvo instaliranje je otkazano u fazi %1!s! sa gre", "ljaande jaoks. Proovige m", " girin", "ranka nepaiso komand", ".?AV?$CZeroInit@VCSetupResponsePageDiskSpaceReq@@$00@@", "lo-LA", " PC spreman za nastavak instalacije sustava Windows 10. Poku", "mas Windows instal", "n de precommit.cmd5Ejecuci", "GB (puede variar) y es posible que se apliquen tarifas de acceso a Internet. Haz clic en Siguiente para descargar los archivos de instalaci", "GetDeviceNumberFromPath: Drive %s CreateFile returned Error: 0x%X", "sokat lehet hozz", "bb %1!d! GB-osnak kell lennie.", "s de Windows", "darym", "PREPARE_ROLLBACK", ">,>;>Q>b>s>", "Uurime, kas olete installimiseks valmis", "SetThreadPreferredUILanguages", "ma Windows ", "Fertig &stellen", "No estamos seguros de qu", " atrodo pana", "cii iba v pr", " installere Windows.", "Pripravljanje nekaterih stvari5S tem orodjem ni mogo", "Zauwa", "ho disku b", "9\"9B9b9", "nlott be", "&Refuz9Dac", "ngua6A configura", "Z\"<,!", "tt nyckel+Ange BitLocker-nyckeln f", "pen van-e el", "o atual do Windows utilizando uma chave de produto e selecione Atualizar.", "nstalleerd vanwege onvoldoende schijfruimte. Maak hieronder ruimte vrij en selecteer vervolgens Vernieuwen.", "u. Lorsque vous vous connectez ", " podpory aktualizuje automaticky. Podpora se m", " %1!s! na va", "962:Z", "fr-CA", "icooNa voljo je nova razli", "8B8b8", "ul USB-kulcs, SD-k", "r. Tarifeli ba", "0U0q0", "OF0S0h0L0g0M0~0Y0", "CSetupResponsePageProductKeyValidate", "1\"121B1R1b1r1", "e namestitvene datoteke, kliknite ", "d Product Key obsahuje len 25 znakov.", "%c:FDe pc wordt verschillende keren opnieuw opgestart. Dit kan even duren.", "D$ VP", " det drev, du fors", "1#131L1_1h1x1", " flash USB, DVD o file ISO) per un altro PC", "Archivo ISO Seleccionar una unidad flash USB", " toliau t", "m na s", "ko vec", "saugoti.AViskas bus panaikinta, ", "bb, meg kell v", "#########", "imiz bitti", "e, ce t", " %s@Windows ", "ebuji si koupit k", "jraind", "e pokrenuti ovu alatku na ra", " de acest instrument.", "i un dispozitiv extern, precum o unitate USB, un card SD sau o unitate de hard disk extern", " nie s", " zgodne z systemem Windows 10, mo", "s reciente de Windows", "galement d'importants correctifs et des pilotes de p", "s az OK gombra kattintva ", "6/6X6k6~6", "n..Programa de instalaci", "anja slu", "As seguintes a", " fazendo a limpeza antes de fechar!Isso pode demorar alguns minutos.[Conecte seu computador para ter certeza de que n", "aty za dost", "Valoda:", "ytetty. Valitse Jatka)Valitse jokin muu ulkoinen tallennuslaite", " bruke, er kryptert med BitLocker. Velg en annen stasjon, og pr", "imalustega riistvara. M", "La protection BitLocker sera interrompue pendant cette mise ", "nnen, muss Windows 10 Setup jedoch neu gestartet werden. Nach dem Neustart wird die Aktion an der Stelle fortgesetzt, an der sie unterbrochen wurde.6Windows 10 kann auf diesem PC nicht ausgef", " precommit.cmd2", "bX0Cu0L", "adnik", "MS UI Gothic", "r mer", "Operacijski sistem:", "nde aufgef", "OImpossibile aprire la cartella Download. Apri la cartella Download manualmente.iImpossibile aprire il masterizzatore DVD. Masterizza manualmente il file ISO su un DVD utilizzando %1!s!.", "Cambia elementi da mantenere", " w katalogu g", " nodal", " Windows.C", "Avisos e termos de licen", "Updates zoeken: %1!d!%%", "WaitForSingleObjectEx", "o desligue o computador", "sik kulccsal.EA BitLocker-kulcs m", "Windows 10-friss", " podczas operacji wyst", "o para que se possa prosseguir com a instala", "&Oppdater", "ujte pros", "CInstallUI::CInstallUIMessageWindow::SwitchToResponsePage", " quieres hacer?", " belirleyemiyor.#Windows 10 y", " BitLocker ne deluje. Preverite ga in poskusite znova ali pa poskusite z drugim klju", "s mer", "Preden se program za namestitev zapre, izvaja ", "ration peut prendre un certain temps.lConfiguration de la mise ", ".?AVICompatActionResponse@@", "installez, vous pouvez sauter cette ", "Oc0f0", "ilitatavate ", "LoadImageW", "re agreeing to.", "nosti instalacijeFInstalacijski program nije uspio provjeriti valjanost klju", "ia kompiuter", "z denetleniyor", "chargement de la plus r", "Rechtshinweise", "n de actualizaciones.", ", kuriame b", "i pou", "CheckHotPluggableDrive: Drive %c SetupDiGetClassDevs Error: 0x%X", "kleme bilgisini bulamad", "installation par le programme d", "DOWNLOAD_UPDATES", "lle sisse logite.!Olete valinud j", "nainte de a continua instalarea, acorda", "lreiz vai izmantojiet citu atsl", "laik lietot", "uvanje.", " (%2!s!)pFjern filer, du ikke l", "Sajnos nem tudjuk meg", "saugoti ", "9%9*959@9E9Y9v9", "ci informacji", "i o cheie de produs Windows 10 valid", "GB. Atlasiet citu disku.", "re. Dette vindue lukkes automatisk om %1!d! minutter. Det skal du vide, f", "tta med installationen.`BitLocker-nyckeln ser ut ungef", " opravy, aktualizovan", "CloudE", "Atsipra", " napa", "%1!ld!%% termin", "t.gA telep", " Windows 10 este gata pentru acest PC. ", "=6=C=O=h=m=", "Za chwil", ", czy komputer jest gotowy do dalszej instalacji systemu Windows 10. Spr", " jour par le programme d'installation de Windows", "Du kan ikke angive kommandolinjeargumenter til installationsprogrammet. Du kan finde flere oplysninger i Hj", "i Ajutor instalare sau executa", "@@@ ", "n, tienes que crear y luego ejecutar los medios para instalarlo.$Sigue usando tu PC con tranquilidad.PError en la instalaci", "Es konnte nicht ermittelt werden, ob Windows 10 auf Ihrem Computer ausgef", "tter installationen av Windows 10 i Windows Update.UKonfigurerar uppdatering f", "r lite diskutrymme. Frig", "im datoram ieteicam", "n no pudo aplicar los datos de migraci", "wBNie mo", " utvide harddisken midlertidig mens oppdateringene installeres. Windows vil ikke formatere den eksterne lagringsenheten p", "&Zapri&Ra", "G@9_ t\\", "r derefter ", "2]2r2}2", "unar ", "ionale.&", "|l|||", "10 aktivovat.", "L$@WQ", " pronto per l'installazione", "040804B0", "Quer mesmo sair?", "hez m", " versij", "dzia na Twoim komputerze. Je", "cter restante1La clave de producto solo contiene 48 caracteres.JEl valor de la clave %d del grupo no es v", "czymy, powiadomimy Ci", "ta je potrebno da znate pre po", "Se pretende atualizar do Windows 7 ou Windows 8.1. ou se estiver a reinstalar o Windows 10, n", "ne pogoje, se bo namestitveni program zaprl.tZa zagon namestitvenega programa potrebujemo vsaj 350 MB prostora. Sprostite nekaj prostora in nato poskusite znova.7Windows Server 2019 pole veel selle arvuti jaoks valmis", "Provjera ovog klju", "ajte sa drugim klju", "Priprema nekoliko stvari%Ova alatka ne mo", "gle eller -licens for at aktivere Windows 10 efter opdateringen.", "Grabar el archivo ISO en un DVD", "i prov", "o quero usar armazenamento externo", "m papirkurven for ", " kompiuteris nutrukus bus paleistas i", "GetDC", ".&Precommit.cmd ", "nosti za ta ra", " palikti", "RDet gick inte att ", "= =$=<=X=h=p=t=x=|=", "><>p>", "lida. Experimente uma chave diferente ou compre uma nova.", "i da oslobodite %1!s! na disk jedinici %2!c!:.a", ".BHodnota kl", "izgiler otomatik olarak eklenir$Kurulum dil kaynaklar", "t aspo", "o podem ser mantidos porque sua vers", " znak.", "sti nezin", " PC pokrenuti Windows 10. Zatvorite program za instalaciju i poku", "jeleket nem kell be", ".?AV?$CUnknownImpl@VIDlpResponse@@@@", "mpa migreringsdata0Det gick inte att rensa upp installationsfilerna7Det gick inte att fastst", "e morate unijeti klju", "SelectUsbDrive", "7+7>7b7i7t7", "Odstranite spodnji zunanji pogon in kliknite ", "Le edizioni non corrispondono", "eW0D0", " Fortsett#Velg en annen ekstern lagringsenhet", " proizvoda nije ispravan. Ponovno unesite onaj koji ste kupili putem interneta.", "Las ediciones no coinciden", "charger l'outil de cr", "tzm-Latn", "installation ne peut d", "3Cette cl", "g0o0 ", "ke programe ure", ", uygulamalar", ",Estoy reinstalando Windows 10 en este equipo5Tengo que comprar una clave de producto de Windows 10", "in na koji Windows instalacioni program preuzima ispravke", "n att forts", "202;2K2`2r2|2", "Nichts0Sie k", " se, a", " conserver avec Windows 10 peut prendre un certain temps.", "n en la fase %1!s! con un error durante la operaci", "site naudotis kompiuteriu. Prie", "1C2P2y2", " informac", "Tas ilgs da", "ekivane pogre", "Windows Server 2019 y", "InstallNowOrLater", "Przenoszenie ustawie", "ja. A folytat", "in Windows", ".?AVCMoReserveManager@@", "WakeAllConditionVariable", "su PC datoru iepriek", "rkekood.", "ifrovania BitLocker", " dodane automatycznie'Klucz produktu zawiera tylko 25 znak", "rskendused, draiverid ja valikulised funktsioonid (soovitatav)", "Odabir slike", "rskenduste installimise ajal. Windows ei vorminda teie v", "Cambiar lo que se debe conservar", "s l'installation et que vous deviez r", "w: %d", "Error reporting telemetry for bHasSysSpace: [0x%X]", "&Terminer", " im Stammverzeichnis des Installationsmediums.", "ati kod sebe do ponovne prijave.-Nismo uspjeli instalirati Windows Server 2019NPC smo vratili na na", "Valg af drev1Installationsprogrammet rydder op, f", "5(5L5T5\\5d5l5t5|5", "Schalten Sie den Computer nicht aus", "Are you sure you want to quit?", "unar. Instalacija operativnog sistema Windows automatski ", "_XcptFilter", " Microsoft Corporation. Toate drepturile rezervate.", "CInstallUI::CInstallUIMessageWindow::ForceQuit", "c instal", "vHr,g)", "$Se creeaz", "rlaFBunu zaten dikkate ald", " poprv", "Les deux[Cette cl", " &I want to help make the installation of Windows better", "teptat", "|k\" > > >::UpdateState", "%s er ikke et gyldig tegn", "adni a Windowshoz, a Windows telep", "Nothing1You will be able to manage your Windows settings.DYour settings and apps will be deleted, but your files will be kept.@Everything will be deleted, including files, apps, and settings.", "zca S modunda ", "Choose which media to use", "Seuraavat seikat kaipaavat huomiotasi, jotta voit jatkaa asennusta ja s", ";?;K;", "&Tastiera su schermo", "Kieli ei t", " palaikymo tarnyba ir nurodykite klaidos kod", "nak let", "^?42B`^GE@)q", "rez de l'espace ci-dessous, puis s", "glicherweise einige optionale Features und Sprachen neu installieren.&", "Checking this keyHThis key doesn", "n. Windows, harici depolama cihaz", "o preinstall.cmd1A executar scripts de implementa", "e se automatski zatvoriti za %1!d! min.$", "DDVD ", "\\!p@'2", "060O0", " rimovibili", "te nie", " rankiniu b", "0CQk0", "ver du en Windows 10-produktnyckel.", "MBitlocker ", "%3!s!4", ": A Windows 10 bizonyos funkci", "Windows privacy statement", "es para remover outros itens grandes./Selecionar Dispositivo de Armazenamento Externo", "cter restante1La clave de producto solo contiene 48 caracteres.LEl valor de la clave %d de grupo no es v", "\" )S6636i", " nei dabar naudojate ", "Vi beh", "InvalidateRect", "installation. Sinon, ex", "dzu, izlasiet ", "tIDATX", "dition de la version de Windows install", ".?AV?$CSetupResponseTemplate@VICompatActionResponse@@@@", "&Loobu", "uriranja: %1!d!%%&To bi moglo potrajati nekoliko minuta.", "- ", "etka instalacije.(Postavljanje sustava Windows Server 2019:Ponovno pokrenite postavljanje sustava Windows Server 2019", "d nefunguje s t", "n timpul acestei actualiz", "Spremno za instalaciju", "lida com esta edi", "hrend des Vorgangs %2!s! ein Fehler aufgetreten.", "Tietokone k", "Odpowiednie uwagi i postanowienia licencyjne", "Server Workstation", "talujete Windows 10, zadanie k", "CSetupLangIniLoader::Initialize: Failed to get the language name: index = %d.", "bL'unit", "Client Workstation", "terminer si votre ordinateur est pr", ",Bindestriche werden automatisch hinzugef", "e koristiti samo za dodavanje funkcija u Windows. Ne mo", "klemesi beklenmeyen bir hatayla kar", "No pueden conservarse tus archivos, las aplicaciones y configuraci", "em PC-ju. Ako ", "re connected to the internet and try running the tool again.%There was a problem running this tool", "041804B0", "tor syst", "ete da presko", " ir maz vietas. Lai pabeigtu atjaunin", "202l2", "esar ne ohrani", "tt i Windows-installationsmediet och k", "henduse v", "N!k(W5u", ".?AVIDiskSpaceActionResponse@@", "sticas a Windows. No se puede usar para instalar Windows.", "gikast, et eemaldada kustutatud failid oma s", "ra; da", "Izberite pot", "re not sure what happened, but we", "lido. Introduza a chave correta6Introduza a chave do bit locker para o identificador: ,O Windows necessita de espa", "eEsta chave de produto (Product key) n", "e nekaj stvari. Ko bomo kon", "n Windows 10 -p", "s reinicia a instalaci", "enje failure.cmd+Ovaj postupak mo", "Impossible de continuer pour l'une des raisons suivantes :", "%\"rww'", "RtlDisownModuleHeapAllocation", "4 4$4,40484<4D4H4P4T4\\4`4", "dia d", "Mamy problemy z ustaleniem, czy system Windows Server 2019 jest ju", "lj extern lagringsenhet", "QQQQQj", "$`2X`F", "0g0Y0:", "313@3Z3h3", " arba nusipirkite nauj", "imo. Osve", "tja a licencszerz", "eQW0_0", "%1!s! %2!s!$Tietov", "ncias. Abra manualmente a pasta de transfer", "CDlpResponseImpl > > >::GetError", "A transferir o Windows 10", "kos Windows 10 l", "n care era chiar ", "Please wait", "n de Windows. Prueba con una clave distinta.VEsta clave de producto no funciona. Vuelve a escribir la clave que compraste en l", "Den m", "@<88x", "lja a jelenlegi Windows-verzi", "%,,-N", "Ihr PC startet einige Male neu, was eine Weile dauern kann.", "n y vuelve a intentarlo.'Windows no est", "t able to download all of the necessary files. Make sure you", "unalnik, ki je zasnovan za delovanje v na", "k a g", "installation pourra reprendre.%Ce PC ne peut pas ex", "Kahjuks ei saa me kindlaks teha, kas teie arvuti sobib Windows Server 2019 k", " %2!c!:-drevet.", "o na m", "343P3T3X3\\3`3d3h3l3p3t3x3|3", "r en annan dator", "Architettura", "sokat.", ";J)>8>G>V>e>t>", "rifier la compatibilit", "Preden lahko izvedete posodobitev, moramo opraviti ", "rer.&Installasjonen av Windows 10 mislyktes", "ruotas veikti S re", "%2!s!0G", "daug 3 GB. Jei naudojate apskai", "NNeizdev", "yg{{k", "cznie polecenie %1!s!, aby otworzy", "6&6W6", "Instalar o Windows Server 2019", "sta na disku nem", " Opdater for at fjerne det fra listen.YDer opstod et problem, da vi fors", "kite ", "Kompatibilit", "r grupp %d ", "0~0g0", "i mai jos.", "%2!s!/Your organization manages your update settings.", "OWindows ", " bilgisayar", "emt.*Pras", ": %1!d! ", " (nebo si nainstalovat jinou edici), budete pot", " conecta", "Vonatkoz", "ker anv", "Operativni sistem Microsoft", " program se ukon", "Intet navn", "_c0f0", "Algo impide que contin", "_R=u_", "ivitykset on otettu k", "PW0f0D0~0Y0", "Windows 10-uppdateringTDet gick inte att visa lagringsanv", "me est survenu lors du t", "O(uW0f0D0j0D0", " naujinim", "i aktivovan", "DrawTextW", "Finn ut mer", "imli sme si, ", "ilitada, sest installite Windowsi v", "Unstaged Image", "o Windows 10 izdevumu, j", " bir DVD'ye manuel olarak yaz", "`_U(u ", "0g0W0_06", "4$4@4\\4`4d4p4t4|4", "r dileriz, bilgilerinizi daha sonra yeniden girmeniz gerekecek..Kurulum program", " list", "in %1!s! ", " &Quero ajudar a tornar a instala", " disk. Syst", "&Telep", "@@@000@@@", "t lis", "CDlpResponseImpl > > >::InitializeRoutine", " de unde am r", "vojiet vietu zem", "e obustavljena tijekom ovog a", "jak mer", "cessaire pour ex", "O(udkx", "Windows 10 installerenFDe pc wordt verschillende keren opnieuw opgestart. Dit kan even duren.+Setup wordt afgesloten, een ogenblik geduld", "Kontrollerer PCen", " tika p", "Mit dem Product Key stimmt etwas nicht. Bitte ", "diegus kompiuteris gali neveikti tinkamai, o jums gali reik", "Lo sentimos, tenemos problemas para determinar si Windows Server 2019 est", "mu Windows 10.", "uNon ", "=I=N=f=", "ny percig is eltarthat.lA Windows telep", ",p,..", "eoMD8_!", " moment", "CDlpResponseImpl > > >::GetResults", "en aktiviran izvod sistema Windows 7 ali Windows 8.1. S klju", "SleepConditionVariableSRW", "ane mogu", " \"setup.exe\", ", "909@9P9T9l9p9t9x9|9", "%1!s! %2!s!,", "Actualise&r", "nchide instalarea.oAvem nevoie de cel pu", "jra kell indulnia. Az ", "r.)Installationen av Windows 10 misslyckades", "vat. Ne", "t, jo radusies k", "ynnist", "anu. Lai m", "FM&3ll", "aja za pohranu", "ar-SY", "sti ne", "ssen Sie die Infos sp", ".?AV?$CZeroInit@VCSetupResponsePageSysReq@@$00@@", "na kontynuowa", "me est survenu lors de la tentative de r", "Windows 10 wird heruntergeladen", "imu. Odaberite ovo izdanje samo ako Windows instalirate na ra", " le re", "ene postavke koje su bile pode", "&Recusar:Se voc", "PPP@@@", "g_U(u", "Prehl", "Ogiltigt dialogrute-ID&Det gick inte att hitta licensavtalet.", "Nezabudnite na nasledovn", "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp", "ajte ponovno pokrenuti alat.,Pojavio se problem prilikom kori", "n (unidad flash USB, DVD o archivo ISO) para otro equipo", "Als Administrator anmeldenaUm dieses Tool zu verwenden, m", "8M8]8i8", "ke programe i opcionalne funkcije. Ove ispravke ", "#Tn! {[", "re, f", "Niets'U kunt uw Windows-instellingen beheren.NUw instellingen en apps worden verwijderd, maar uw bestanden blijven behouden.BAlles wordt verwijderd, inclusief bestanden, apps en instellingen.", "CDlpResponseImpl > > >::GetResponseId", "iska. Ak chcete otvori", "en-AU", "&Dalej", "te instalarea Windows Server 2019", "tlZ^+", "&Sulje.Tietokone k", "0MRk0", ">:>]>", "unuz y", "hnout aktualizace, ovlada", "5?6j6", "Si vous installez pour la premi", "teva lucruri)Acest instrument nu poate actualiza PC-ulqLimba sau edi", "r i gang.", " Windows.S", "ifra proizvoda", "ak za", "o.cPrecisamos de pelo menos 350 MB de espa", "uriranu alatku za kreiranje medija", "tsa el a nagym", "o utilizados da pasta Transfer", "ni od za", "\"Microsoft szoftverlicenc-szerz", "@@@@@@@@@@@@@@@@@@@@@", "r Windows 10 m", "edldGDlVwg", "kkel.HDenne produktn", "kat m", "ste znova.1Windows Server 2019 ", "Valami baj t", " ponad 4 GB danych (ilo", "9++++++++++0", "NW0_0", "est produit lors de la tentative de r", "ppp@@@@@@@@@@@@@@@", "l a Windows Server 2019 telep", "lectionnez ou connectez un p", "Nastavi tamo gdje sam stao", " Windows Server", "au moins 350 Mo est n", ".?AVCDialog@@", ";/Wyst", " crittografata con BitLocker. Scegli un'altra unit", "rsler manuelt.VDvd-br", "Aktualizacje s", "%%%d tamamland", "?\"?1?@?V?", "70o0}0", "o do Windows 10 configurar", "N!k(W", " un autre emplacement.", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8|8", " Windows 10H", ">s?x?", "%c:@PC ", "%c: > > >::GetState", "az-Latn-AZ", "rile. Windows nu va reformata dispozitivul de stocare extern ", " Graver le fichier ISO sur un DVD", "\\D~bx", "&Kabul Et", " skriptov preinstall.cmd sa vyskytol probl", "iuo metu j", "ri acum, este posibil ca PC-ul s", "installation de Windows 10 dans Windows Update.aConfiguration de la mise ", "Aktualizace jsou aplikovan", "r datorn nu", "CStaticEx", "Windows Server 2019:n asennus7Windows Server 2019:n asennusta k", "a pas fonctionn", "ntat fel uppstod under installationen av Windows.", ";%;V;", "Deja, kyla problem", ".(PC ", "jumi tiek lietoti\"Nav pieejams neviens atjaunin", " izdelka za Windows 10", "999s9", " BitLockerrel van titkos", " jour maintenant, il se peut que votre PC ne fonctionne pas correctement apr", "nnnjL", "vTTTJJ", "Buscando actualizaciones!Buscando actualizaciones: %1!d!%%!Esto puede tardar varios minutos.", "t have enough space available. Choose a different drive and try again.9Next, we will help you free up %1!s! on the %2!c!: drive.", "yla e", "tiski; atbalsts da", "t, jo j", "r du ", "rieurement.", "Ne asigur", "O0S0h0L0g0M0~0[0", " jau parengta j", "installer.*Vous pouvez continuer ", "rification de votre PC:V", "ykite ir u", "u sa ", "lnit o eroare nea", "Aby uzyska", "angios aparat", " svoje nastavenia Windowsu.BVa", "sek, illeszt", "hnout a spustit nejnov", "\"'DaX", "nt lemezk", "CSetupResponsePageGated::OnInitDialog", "setup.exe", "ye yaz", "%1!d!%% terminatdAceast", "Nenhuma atualiza", "CDlpResponseImpl > > >::GetError", "jEVh(", "Nagraj plik ISO na dysk DVD", "(%1!c!:) - %2!s! gratuit", " aktualizace na Windows", "Ladda ned den senaste versionen av Windows", "s(Wn0 ", "tartuje", "ija, pievienojiet datoru ener", "ppp@@@@@@@@@@@@@@@@@@", "<5 >&>+>6>A>U>", "``\\\\\\R", "installation (cl", "pet.SA telep", "pertoire non pris en charge ou vous tentez d", "iile despre instalare de care avem nevoie pentru a continua instalarea Windows. Reporni", "n.+Requisitos completados. Presiona Continuar.0Elige otro dispositivo de almacenamiento externo", " cont", "8(8S8c8p8}8", "Wybierz elementy do zachowania", "istenie", "CDlpResponseImpl > > >::Serialize", "tor neakceptuje argumenty pr", "Source OS: Host SKU Info: Edition = '%s', Edition Type = '%s', Installation Type = '%s', Product Name = '%s', Arch = %s, StationType = %s, Stage type = %s", "495a5", "dia para instal", "3O3{3", "%2!s!7Nastaven", "%hs: Generating compat report.", "uk-UA", "talujete in", "r inte att hitta installationsfilerna f", "Dyski wymienne", "t tell if your PC has enough space to continue installing Windows Server 2019. Try restarting Setup.", "%s: Leaving Response Execute Method", "%s\\%s\\%s.mui", "e la instalaci", "s conectado a Internet e intenta ejecutar la herramienta de nuevo.-Hubo un problema al ejecutar esta herramienta", "At&naujinti", " nepot", "{LAbPkk", "pna edycja systemu Windows zgodna z wprowadzonym kluczem produktu.", "lastage: %1!s!", " kodas veikia! T", "avanje problema", "vel encontrar os ficheiros de instala", "i osobne datoteke i aplikacije", "k. Ind", "nnen Ihren PC weiterhin verwenden.qDie Installation war nicht erfolgreich. In der Phase %1!s! ist w", "*=@-\" \"", "042204B0", "ation de supports mis ", " tohto n", "cy format: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX.Klucz funkcji BitLocker zawiera tylko 48 cyfr.", "PREPARE_SECOND_BOOT", "n de Windows actual usando una clave de producto y despu", ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@", "eQKN\"u", "o determinou as op", "kkelen inneholder bare 25 tegn.", "Ne oldu", "&Uppdatera", "rymmy", "T3^6b{veQ ", "mto n", "Consulta: %1!s!", ": %1!d!%%(", "&Kontynuuj%Zainstaluj system Windows Server 2019", ". Znamen", "lg billede", "Ohrani le osebne datoteke", "re fois (ou si vous installez une ", "iu-CA-Latn", "nEEl programa de instalaci", "9@==??<42", ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXXTL", "ili a", "Si vas a instalar Windows 10 en tu equipo por primera vez (o si vas a instalar una versi", "ppp@@@@@@ppp", "A Windows 10 ezen kiad", "+++qP", "n aktiv", "un &daha iyi y", "szymi instrukcjami, aby zako", "8 8%818x8", "%1!s! %2!s!-", "rtve a f", "lja. Amikor legk", "ties tie", "ilor%Trebuie s", "map/set too long", "Mimari e", "z gerekir.0G", "lj den avbildning som du vill installera.", "smn-FI", "6!7^7f7l7", "7T8o8{8", "@Qm6t", "Tenemos que hacer algunas cosas m", "uriranja odmah, va", "0J0Kb", "ie inform", "tLVVVW", "ena v va", "zda Windows Server 2019", "istenie disku, manu", " cuidou disso. Clique em Atualizar para remov", "505E5J5c5y5", " proizvoda sustava Windows 10.", "&Sluiten(Windows 10 kan niet worden ge", " megjegyz", "me se, ale neda", " jour. Nous vous aviserons lorsque ce sera termin", "ge lesz megadni a Windows be", "cio da instala", "t activated on this PC. This means you", "Vi vet ikke om PCen har nok ledig plass til at installasjonen av Windows 10 kan fortsette. Pr", "ati kompatibilno sa sustavom Windows 10.", ".?AVCSetupResponsSelectWebDownloadImage@@", " Bitlocker pour l", "n de %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para solucionar el problema y ejecuta el programa de instalaci", "marrage effectu", "$Dispositivo di archiviazione esterno", "&Acceptera", "Radusies probl", ":O:Z:", "ll need to enter the Windows 10 product key below or exit setup, activate Windows, and then start setup again.", "Licentievoorwaarden", ">k?r?", "no z datotekami, aplikacijami in nastavitvami.", "Presque termin", ":N:l:>;S;p;", "pt online igen.", "k ihtiyac", "ts&Tiek p", " girmeniz gerekir.", "6 6(60686@6H6P6X6`6h6", "Install Windows 10*Get updates, drivers and optional features", "es em %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para resolver o problema e execute novamente a Configura", "%c:4PC sa nieko", "o antigos", "marrer le programme d", ".?AVIDlpResponse@@", "Utgave", "bnes. K", "unom.+Datoteko ISO boste na DVD zapisali pozneje.", "(Pers", "kalu ei pysty p", " asennat Windows 10:n uusimman version.", "inde Windows Server 2019", "re version de Windows", "lista friss", " Windows ", "hlen Sie die Partition aus, auf der Sie Windows installieren m", "Disk alan", ";&;<;S;c;w;", "m sa ukon", "Esto puede tardar unos minutos.", "z denetleniyor&Y", ".2Uvoln", "ierul ISO pe un DVD", "ndirmeler klas", "Need v", "ine doar 48 de caractere.BValoarea cheii de grup %d este nevalid", "<0Windows ponovo pokre", " na no", "|||R|RSQ|QSM\\", "initi?", " Windows Server 2019.J", " nejnov", "Zas&lonska tipkovnica", "b lehet", "n tanto la configuraci", "r att forts", ".)Tikrinama, ar kompiuteryje u", "e koristiti za instalaciju sustava Windows.", "riques mis ", "iRYO ", "t be able to use your PC while Windows installs. Save and close your files before you begin.0Please wait while the app finishes uninstalling.", "C&lose", "Something is preventing the installation to continue. Review the information in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml to resolve the problem and run Setup again.\\For more information on upgrading Windows Server, visit: https://aka.ms/windowsserverupgradezSorry, we", "u ilk kez y", "leg nem t", "0~0Y0L0", "e ponovno pokrenuti ra", "System Windows nie zosta", "kejte pros", " reikia pa", "1K1d1y1", ".?AVCSetupResponsePageSysReq@@", "initialisation du r", ", czy ", " la versione corrente di Windows potrebbe essere installata in una directory non supportata o stai tentando di installare una versione precedente di Windows.cLo spazio nell'unit", "En savoir plus", "~!IN ", "lassza a Friss", "tu atjaunin", "ena v nepodprtem imeniku ali pa posku", "sbNem siker", "Draivi valimine(Installiprogramm puhastab enne sulgemist", "CSetupResponseTemplate::ExecuteRoutine: Cancel button clicked.", "ivitada. Kui probleemid j", "ste in", " PC-ul dvs. are suficient spa", "te moment", "te treba vykona", "&Peruuta", "c pierakst", "V8_^j", "cution9Scripts de d", "&Fullf", ".(De oudere installatiebestanden gebruiken", "VNem siker", ", DVD-", "s de iniciar sesi", "a do Windows 10 para ativar o Windows 10 depois da atualiza", "jmm}yy", "ti taikomi duomen", "Angiv, hvad du vil beholde", " mevcut. Devam etmek i", "n nem siker", "CSetupResponseTemplate::InitializeRoutine", "CSetupUIManager::OnSetupPostReboot", " &Doresc s", "Lea atentamente esta informaci", "nda muud tootev", "o de privacidade do Windows", "KN9m(i", " tvarkykles ir papildomus failus, kuri", "unalnik do ponovnega vpisa pri sebi.", "ane.ASve ", "lreiz, restart", "im ste se strinjali.", "Zunanja naprava za shranjevanje", "8@9N9W9`9i9", "o pretendo utilizar armazenamento externo", "Progreso: %1!d!%%:Selecciona una de las opciones disponibles para continuar.", "4Licen", "ra om datorn kan forts", "my.BAk chcete pokra", "kalua, sinun on oltava kirjautuneena Windowsin j", "dOJJ@=%\"\"\" \"! *", "re connected to the Internet and try again.)Running preinstall.cmd deployment scripts(Running precommit.cmd deployment scripts&Running failure.cmd deployment scripts", "&Manter ficheiros e aplica", "Nieko,Gal", "ll let you know when we", "kkulcs", "te si st", "Nekas-Var", " se skripty nasazen", "Ovo preuzimanje u pozadini mo", "te a zatvorte.-Po", "aPTa klju", "n y prueba otra vez.uEl programa de instalaci", "kkel'Skriv inn Bitlocker-n", "bory Windowsu. Na pokra", " disponible si tienes una copia activada de Windows 7 o Windows 8.1 instalada en tu equipo. Activa tu versi", "rizhesse Windows-be", "in yeterli alan olup olmad", "berom niektorej z dostupn", "!{(g%k", "jumus nevar saglab", "j til medieoprettelse", "tinkite ", "zben. Friss", " BitLocker deluje. Nadaljujte, ko boste pripravljeni.", "Als Windows 10 ooit eerder is ge", "t pro", "ts ar BitLocker. Izv", "BNie mo", " installasjonsmediet. Hvis du ikke installerer disse oppdateringene n", ", pero no pudimos ejecutar esta herramienta en el equipo. Si sigues teniendo problemas, ponte en contacto con el soporte t", "cej informacji", "anas skriptu failure.cmd izpilde", "Pokud jste Windows 10 na tomto po", "rwwokk", "Palaukite2I", "CDlpResponseImpl > > >::DeserializeRoutine", "ana-Windows Server 2019 iestat", "sok megtart", "EnableWindow", "818@8", " nous nous sommes arr", "kkelen virker ikke med denne Windows-utgaven. Pr", "ValmisteleZOlet jo ratkaissut t", ", tada bandykite dar kart", "Betriebssystem:", "__RTDynamicCast", "Saklamak istediklerinizi se", "Eine neuere Version dieses Tools ist verf", "Pre toto PC pou", " v slu", " nu instala", ", turime atlikti dar kelet", "%MB=:4", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX2", ". Nor", "rskenda.", "!kx0(", "es importantes, controladores de dispositivo atualizados e ficheiros adicionais que n", " dabartin", " jednotky", " lehet.", "tu turpin", "Se continuar sem ativar sua vers", "es do Windows e ficheiros pessoais", "1J2o2", "Tikrinama, ar esate pasireng", "This may take a few minutes.", "i popis pogona", " limpiando antes de que se cierre", "o do Windows baixa atualiza", "mentaires qui ne sont pas pr", "onnistui. Avaa levyn uudelleenj", " jour&Se connecter en tant qu'administrateur]Afin d'utiliser cet outil, vous devez vous connecter ", "Du beh", "eW0_0h0S0", "alinti.*Reikalavimai patenkinti! Paspauskite T", "ier ISO", "CSetupResponseTemplate::OnSuspend", "ja-JP", "cie n", "i samo li", "WmsgPostNotifyMessage", "kerhetsf", "kam si je zaz", "XBu arac", "gra minuter.", " Bitlocker", "CB[[5", ", poniewa", "&I want to help make the installation of Windows better", "dik. Adjon meg m", "s aktiviz", "Introduzir Chave de Produto", "=5>Q>s>", ">->F>^>", "Niente5Potrai gestire le impostazioni di Windows in seguito.JLe impostazioni e le app verranno eliminate, ma i file verranno mantenuti.8Verr", " atmintin", ", reikia i", "Log p", "uW0~0W0_07", " flash USB.", "&Suivant", "tk-TM", "De Windows-installatiebestanden zijn niet gevonden. Plaats het Windows-installatiemedium en voer setup.exe uit om de installatie te hervatten.", "CDlpResponseImpl > > >::ExecuteRoutine", "sO?599y", "va) beh", "CSetupLangIniLoader::Initialize: Adding language: index: %d", "ce, na kt", "yeSSS", "Espace insuffisant/%1!d! Go d", "iniz resmi se", "Izbiranje pogona9Namestitveni program izvaja ", "9;:B:H:M:Y:e:y:", "rification que vous ", "n directorul r", "Ay,SO", "akovane napake. Preverite, ali je mogo", " Internet et r", "uW0_0_0", "1dbbB", "sek telep", "ter v", " di Windows 10 ", "j kan ikke opdatere din pc", " skriptov precommit.cmd sa vyskytol probl", "Ett ok", "zda bulundurman", "sticas e idiomas opcionales.,Utiliser les anciens fichiers d", "borov, aplik", "1 character left,The product key only contains 48 characters.7Group %d key value is invalid, please input correct key0Please input bit locker key for the identifier: ", "jams, ir instal", "elite odstraniti izbrisane datoteke s sistemskega pogona, izpraznite ko", "nom m", "Windows Server 2019 installeren", "l kell gondoskodnia ahhoz, hogy a telep", "u trva", "[V[[MVMMMOJO>O", "UNKNOWN", "Asenna Windows 108Hanki p", "kledi", "tier du DVD ou dans votre courrier ", " OK, ", "to se dogodiloMDa biste instalirali Windows 10, kliknite Setup.exe na instalacijskom mediju.", ".EVotre cl", "r du g", "INSTALLATIONSOPLYSNINGER: Visse Windows 10-funktioner kr", " vos fichiers.JTout va ", "Takoj nadgraditi ta ra", "#Vi kan ikke finde et USB-flashdrev.", " za BitLocker ime le 48 digitalnih znakov.", "y zalogowa", "u zna", "nnare", "in Yenile", "i %1!s! pe unitatea %2!c!:.d", "Anscheinend verwenden Sie ", "got USB-flashminne.", "Accedi come amministratorebPer usare questo strumento, devi avere eseguito l'accesso a Windows con un account amministratore.=Sar", "Versjonene samsvarer ikke", "est pass", "tirmelerini y", "na zaktualizowa", "Draivi valimine", "%Programa de instalaci", "iului de stocare. Deschide", "ne faili allalaadimisel ilmnes probleem", "Najnovej", "os failus, tagad dubl", "vel instalar o Windows Server 2019_O computador foi definido com o estado anterior ao in", "A preparar %d%%", "Aguarde7Ocorreu um problema ao executar scripts preinstall.cmd.6Ocorreu um problema ao executar scripts precommit.cmd.", "anas viet", " Umowy licencyjnej.", "Musimy zrobi", "CreateCompatibleDC", "Informacje prawne", " stato interrotto.9Non ", " nytt for at de skal fungere. N", "o guarde nada", "e biti obustavljena tokom ovog a", "uriranja, ali nastavit ", "stra set", "What needs your attention", "om aktu", "0P1`1m1z1", "uSorry, but we're having trouble determining if Windows 10 is ready for your PC yet. Please close Setup and try again.&Windows 10 isn't ready for this PC yet*Making sure that the installation is ready", "Mais informa", "rstu probl", "%d%% completado", "Ye&nile", " tutmak i", "Ako je", "a poate varia ", "vel continuar devido a uma das seguintes situa", "sst8{{|", "Sto preparando %d%%(Sto trasferendo le tue impostazioni %d%%", "nd Diskrensning f", ": %d ", " Microsoft Corporation. Todos los derechos reservados.", "tre r", "aj kao ", "tirmeler, y", " gotowy dla Twojego komputera. Zamknij Instalatora i spr", "Rozpocznij od pocz", "pne Lagring manuelt i Innstillinger.4Kan ikke ", ".~*N,", "%2!s!2", "Ho applicato gli aggiornamenti\"Non sono disponibili aggiornamenti", "}}#^80", "bs-Latn", "ne poprawki, zaktualizowane sterowniki urz", "Windows 10. Pokud chcete m", "o de problemas", "va vyhraden", "n PC-j", "Configurazione completataAVerr", "jums ir pieejams tikai tad, ja j", "to niste aktivirali trenutnu verziju operativnog sistema Windows, mora", "j komputer ma wystarczaj", "$).:z", "0j0D0g0O0`0U0D06", "gend Speicherplatz vorhanden. W", "Niet nu", " Windows uzst", " valod", "Ne najdemo klju", "sitsi.YSalvestusruumi kasutuse avamine nurjus. Kettapuhastuse avamiseks k", "o estar conclu", "Der Key wird ", "iatku", "Install %s&>6>d>}>", "#Feilkode: 0x%1!lX! ", "D$(f;", "rberedelser g", "Wijzigen hoe updates worden gedownload met Windows Setup", "rolt kulcsot.", "QFailed to open your Downloads folder. Please manually open your Downloads folder.RFailed to open DVD burner. Please manually burn the ISO file to a DVD using %1!s!.", ">H>\\>i>p>}>", "< <$<(<,<0<4<8<<<@ > > >::Serialize", "emtu papildinform", " PC-ul este gata pentru a continua instalarea Windows 10. ", "pne lagringsinnstillinger", "Henter oppdateringer", "tGVWj", "EtwEventEnabled", "j-Xf;", "1G2R2", " od komputera do czasu ponownego zalogowania.5Nie mogli", "Professional", "??1exception@@UAE@XZ", " installere programvaren.", "lineen luontity", "4*43484@4F4K4S4Y4^4f4l4q4w4", "nnen, muss Windows Server 2019-Setup jedoch neu gestartet werden. Nach dem Neustart wird die Aktion an der Stelle fortgesetzt, an der sie unterbrochen wurde.?Windows Server 2019 kann auf diesem PC nicht ausgef", "se*Ez a kulcs nem m", "CSetupResponseTemplate::ExecuteRoutine: Back button clicked.", "4$4,444<4D4P4p4x4", " %c#Er du sikker p", " sa m", "erreur lorsque vous communiquerez avec le soutien ", "n.}Necesitamos al menos 350 MB de espacio para ejecutar el programa de instalaci", "t work. Try a different key, or buy a new one.", "lni tudja a Windows 10-et.", "Windows 10 installimine", "lkeen prosessia jatketaan siit", "vel localizar uma unidade flash USB.", "tenje i mo", "k nor", "&Programme d", "93:D:`:h:s:", "Recomendaciones de soluci", "ce znaky: %d", "Windows ei saa installimist j", "niai bus ", "r setup.exe f", "o pode reiniciar o computador. Feche todos os programas e reinicie o computador. A instala", "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp", " de aproximadamente 3 GB. Se est", "bn mappen Overf", "rt.$Kravene er fuldf", " uudelleen.oAsennusohjelma ei voinut aloittaa Windowsin asentamista. K", "%1!ld!%% voltooid", "elo Vy", "zh-CHS", "tkamist on vaja teha veel m", "n0S0n0", " ei voitu asentaa_Tietokone on palautettu tilaan, jossa se oli juuri ennen Windows 10:n asentamisen aloittamista.", "e oder nicht verwendete Dateien aus dem Ordner \"Downloads\".", "ajte ponovno ili poku", "041904B0", "%1!d!%% effectu", "los izmantot ", "QQSj,", "psake nuppu V", "CSetupResponsePageBitLockerKeyValidate::OnSetActive", "tamiseks tuleb Windows 10 installiprogramm taask", "2SVhX", ";&;2;8;U;l;", "}W0f0D0", "bor Setup.exe na in", "Priprava %d%%", "iOipi", " da biste preuzeli najnovije instalacione datoteke.", "tuves lielumam ir j", "1f1p1", " Available Drive [ %c ]", "em.?Va", " %2!s! slobodno", "%c:5Din pc genstartes flere gange. Det kan tage lidt tid.", "CInstallUI::InitInstance", "Tijek: %1!d!%%7Za nastavak odaberite jednu od raspolo", "Seu PC ser", " chcete pou", "jlt. Ellen", "ve igjen.bKan ikke starte installasjonen av Windows. Start installasjonsprogrammet p", "iant kai kuriuos failus kilo problema", "ber jednotky", "505x5", "<$<,<4<< > > >::CheckInitialized", "Error selecting %c drive: [0x%X]", "ievada v", "rat. Nyissa meg a Lomt", " datorn f", "Windows Serveru 2019. Pokud chcete m", "ti bent %1!d! GB.", "0j0i0n0", "L'architettura non corrisponde", "n en Windows", "cnico", "Non riesco a trovare i file di installazione di Windows. Inserisci il supporto di installazione di Windows e avvia il file 'setup.exe' per riprendere l'installazione.", "ver br", "SkipUpdateMediaSelected", "Windows er ikke aktiveret p", " a instalar uma edi", "Provera kompatibilnosti", "Une erreur bloque l'installation. Passez en revue les renseignements fournis dans %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml pour r", "ta zadr", " ratkaista ongelma tarkistamalla tiedot seuraavasta sijainnista: %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ja suorita sitten asennusohjelma uudelleen._Lis", "IDD_WIZPAGE_RESUME", "Dieses Tool konnte aus irgendeinem Grund nicht auf Ihrem PC ausgef", ".?AVCTreeCtrl@@", "re Windows Server 2019. Luk Installation, og pr", "su iestat", "LoadBitmapW", "A pen USB est", "uz-Latn-UZ", "*Windows 10 ", ">$>,>4><>D>L>T>\\>d>l>t>|>", "fg0Y0L0", "0~0Y0:", "SelectImage", " v nastaven", " versijos, tur", "s especificar la clave de producto.", "r inte tillg", "La instalaci", "r. Klicka p", "n de Windows instalada actualmente en el equipo.", ".PNaudojamame diske tr", "j-Xf9E", "Comprobando la descarga", "es do Windows, seus arquivos pessoais e seus aplicativos, preste aten", "040104B0", " muutaman minuutin.", "ra precommit.cmd-skript.", ".?AV?$CZeroInit@VCSetupResponsePageSummary@@$00@@", " %2!c!:./", " ne deluje s to izdajo sistema Windows, zato poskusite z drugim klju", "kDet gick inte att ladda ned alla n", "&Installeren", "h0puj0", "ie de dispozitiv.", "ck(W-", "vne inform", "Ongi valmis!7J", "installationa", " Microsoft Corporation. K", "i clic pe OK pentru a reporni sistemul ", "o mais recente do Windows", "Si Windows 10 se instal", "lamaz.", "ifrovan", "mFjern f", "pabeigt", "us un dro", "Il download ", "Vytvori", "Updates toegepast", "1@I5jQ7N", ".?AV?$CZeroInit@VCSetupDlpResponse@@$00@@", "t valodas resursus?Uzst", " klucza produktu systemu Windows 10.", " jazyk, ne", "diegti naujausi", " BitLocker atsl", ":Preparando para baixar a vers", "cuter cet outil sur votre PC. Si ce probl", "lper vi dig frig", "an klju", "r lite diskutrymme. F", "l nav gatava ", "mpinat o problem", "s una clave de producto de Windows 10.", "dacBitLocker-nyckeln fungerade inte. Kontrollera den och f", "r du opretter forbindelse til internettet, aktiverer vi Windows for dig. ", "re preinstall.cmd-scripts.7Der opstod problemer med at k", " inscrip", "&Atgal", "La lingua non corrisponde", "elles fonctionnent. Une fois que l", "o do Windows continuar", "1%2@2[2v2", "SysTreeView32", " S. Scegli questa edizione solo se stai installando Windows su un PC progettato per l'esecuzione in modalit", "%c:OO seu PC vai ser reiniciado v", "!kn0D0Z0", "llningar och personliga filer", "t extern", "rio criar e, em seguida, executar o suporte de dados para o instalar.", "anas turpin", "Si vous continuez sans activer votre version actuelle de Windows, vous devrez acheter une cl", "a je u toku7Ovaj klju", "v en anden n", "emo zaklju", "Program za instalaciju sustava Windows pristupat ", "ynnistyy uudelleen monta kertaa. T", "en.,%1!s! auf dem PC freigeben (%2!c!:-Laufwerk)uW", "The installation cannot continue because Windows cannot restart the computer. Close any open programs, and then restart the computer. Windows installation will continue automatically.", "To bo morda trajalo nekaj ", "CDlpResponseImpl > > >::Restart", "p nem m", "INFORMATIONEN ZUR INSTALLATION: Einige Features von Windows 10 erfordern modernere Hardware; einige vorhandene Features wurden ge", "th-TH", "rios pelo menos %1!d! GB.", "t izmantot datoru.", "t, vagy l", "CreateFontIndirectW", "zellikleri indir (", "t Sta", " conserver", ".CRT$XCZ", "sz, de a m", "be-BY", "ano: %1!ld! %%", "n, activar Windows e iniciar la instalaci", " galima paleisti s", "s nedan om du vill veta varf", "nchidere'Computerul va reporni ", "ioneze corect dup", "4)7E7", "stroj se n", "e pripravljen za va", " reikia vietos", "Datenschutzbestimmungen", "ksuste Windows 10-ga ", " uudelleen.)Windows Server 2019:n asennus ep", "emo aktivirati Windows nakon dovr", "lhatja a sz", "ck(Wnx", "laties beigt darbu?", "Nu am putut instala Windows 10[Am setat PC-ul ", "me s'est produit lors de l'ex", "CInstallUI::ShowProgress: Posted MSG_INSTALLUI_SWITCH_TO_PROGRESS_PAGE", "installer une version ant", "ne takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "ndningen. K", ".CRT$XIAA", "o. Liberte algum espa", "'6>>DD`L||||SQSRRN\"", " uudelleen.6Suoritetaan preinstall.cmd-k", "Dit kan enige tijd duren.fDe update voor Windows 10 wordt geconfigureerd", " najnov", "j\\Zf;Ty", "lja meg ism", "nCzz:", "0@y$@0", "a, unesite ispravan klju", "idlo Obnovi", "i kaudu.\\Windows 10 v", ":1;I;S;q;", "list salvestusruumi", "Instalare Windows Server 2019,Se reporne", "d chyby: 0x%1!lX! ", "5%535", "unalnika. Zaprite vse odprte programe in znova za", "tter vi der, hvor vi kom til.*Denne pc kan ikke k", " necessario il tuo intervento per completare queste operazioni. Scegli gli elementi da mantenere", "lida1N", "Uso archiviazione}Esplora manualmente l'uso dello spazio di archiviazione nelle impostazioni per rimuovere altri elementi di grandi dimensioni..Seleziona dispositivo di archiviazione esterno", "eneklerini belirleyemedi.Kurulum program", "\"Nevar atrast USB zibatmi", "n de Windows 10 necesita reiniciarse para que funcionen. Despu", " Microsoft\"", "ttes!Kan ikke validere produktn", "REGISTER_ASYNC_PROCESS", "CInstallUI::OnProgressChanged: Exit is requested. Ignoring OnProgressChanged", "Segoe UI Light", "st. A telep", "r installationsprogrammet igen.oDu kan f", "pet, am", "t be used to install Windows.", "baigtum", "vY0K0", "ljande saker innan du kan forts", "ng inte av datorn", " nesuaktyvinta ", "9 :':-:2:=:G:L:`:", "Windows Server 2019 iestat", " kapatmay", "jdete na lokalite https://aka.ms/windowsserverupgrade", "Nemojte isklju", "Tai gali trukti kelias minutes.", "e ste na in", "1,171w1", "Midagi juhtusCWindows 10 installimiseks kl", "k sedan igen.'Det gick inte att ladda ned vissa filer", "oikeussopimusta ei l", "t, lai to iz", "CDlpResponseImpl > > >::Execute", "t take command line arguments. For more information, see Setup Help or run ", "Para continuar a instala", "Ulkoinen tallennuslaite", "de validar a chave do produto (Product Key)NA instala", "StringFromGUID2", "e se prozor automatski zatvoriti za %1!d! min.2Stvari koje biste trebali znati prije zapo", "cnica var", "i za instalacijski program ili pokrenite \"setup.exe /?\" u korijenskom direktoriju instalacijskog medija.", " veya lisans", "ti, ta", "es-US", "De gratis update naar Windows 10 is alleen beschikbaar als er een geactiveerd exemplaar van Windows 7 of Windows 8.1 op uw pc is ge", "0o0B0", " niektor", "n de almacenamiento.UNo se pudo abrir la papelera de reciclaje. Abre manualmente la papelera de reciclaje.qNo se pudo abrir el uso de almacenamiento. Ejecuta %1!s! manualmente para abrir el liberador de espacio en disco.", " raktas", " chiuso.]Sono necessari almeno 350 MB di spazio per eseguire l'installazione. Libera spazio e riprova.", "ifre proizvoda, a zatim izaberite opciju ", " Script ", " de produit ne contient que 48", "rw-RW", "rziu.)Instalarea nu a aplicat datele de migrare.Instalarea nu a cur", "%s Mt", "Uw download verifi", "The product key should be with the box the DVD came in or on your email receipt. When you connect to the Internet, we", "j, skal du v", "https://aka.ms/windowsserverupgrade ", "373T3k3", "noton komentosarjoja$T", "&Prekli", "Vybrat bitovou kopii", "fqFW5", "v466~", "kleyemedik.OBilgisayar", ")Usar los archivos de instalaci", ".?AVCBitmapDialog@UX@Common@ConX@@", " de produit ou une licence de Windows", "Abrir Transfer", "8$9<9h9", "em komandrindas argumentus. Lai sa", "hoz legal", "o suportadas;A configura", " facoltative (scelta consigliata)", "vS_MR", "ne muu arvuti jaoks", "iny, pozrite sa ni", "ajke i jezike. Pou", "r kan ta en stund.hEtt ov", "se-NO", " suspensa durante esta atualiza", "Premikanje nastavitev %d%%", "hren.(Sie k", "vcaQAk chcete pou", "Om du t", "ks-Deva-IN", "Edice", " kompiuter", " ulkoista tallennustilaa sen sijaan(En halua k", "lt megnyitni a Lomt", "d vyzer", "ku Sta", " a Windows ezen kiad", "pap-029", "buj ponownie uruchomi", "lineen p", "anas laik", "Oap`@3", "e zariaden", "tora syst", "vetkez", "Prullenbak\\Maak de Prullenbak leeg om verwijderde bestanden op het systeemstation definitief te wissen.", "Se nedenfor hvis du vil vite hvorfor.", "ene mogu", "20201008101141Z", "t run Windows Server 2019", "re valide.", "?\"?2?B?R?b?r?", "jo Windows versiju, jums b", "n.uWindows Server'", "Adding Drive Letter = %c", "te naujinim", "i clic pe Urm", "o do Windows. Insira o seu suporte de dados de instala", "dnek, de a f", "t aus.", "OriginalFilename", "Prena", "Notiek lejupiel", "f~0_0o0JRd", "ite PC u elektri", " necessario riavviare il programma di installazione di Windows Server 2019. Dopo il riavvio, il programma di installazione riprender", " jour de Windows Server, visitez https://aka.ms/windowsserverupgrade", "@.reloc", "Peaaegu valmis", "bb percig is tarthat.", "gte at ordne det for dig. Opdater listen, og pr", "G%b\"i", "LogHr", " estar na caixa do DVD ou no recibo de correio eletr", "Abrir grabadora de DVD", "Datentr", "Szabad hely keres", "CSetupResponsePageRecoveryReq", "ll-e a telep", "o do Windows que corresponde ", "ene datoteke iz fascikle ", "z friss verzi", "bn-IN", "rheten tills du loggar in igen.\"Sammanfattning av vad du har valt:", "i Windows Server 2019", "llningar, personliga filer och appar.KDu m", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", " programin", " a ser executado'Este processo vai levar alguns minutos.", "marriez l", "cie3Ponecha", " nytt./Installasjonen av Windows Server 2019 mislyktes", "kajte, k", "n Windows Update.", "lnom jazyku a architekt", "dik.WA Windows 10 friss", "i elementul de instalare Windows, apoi executa", "Microsoft Time-Stamp PCA 20100", "Bitte lesen Sie die Bedingungen, bevor Sie ihnen zustimmen.", " de fazer a seguir. Esta janela fecha-se automaticamente em %1!d! minutos.!O que deve saber antes de come", "Zadat kl", "@@@ @@@", "%2!s!=Tu organizaci", "li zamierzasz uaktualni", ":$:5:I:", "ka jaun", " szczeg", "gkALbi", "lectionnez un lecteur flash USB|Les fichiers enregistr", " nytt senere.", "rskenduss", ">0?c?v?", "ggs till automatiskt)Produktnyckeln inneh", " dar neparengta ", "SETUPAPI.dll", "(&R)]", "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageDiskSpaceReqImpl.h", "sts viss, tostarp faili, lietojumprogrammas un iestat", " izdelka ni deloval. Znova vnesite klju", "alinti.", "t, ne", "#Usar arquivos de instala", "ime S..USB k", "Nada/Podr", "465<5Z5s5", "ke; trajanje podr", "Preinstall.cmd ", "eho, co chcete zachovat, zkontroluje kompatibilita s Windows 10, m", "y tallennustilan k", "s reciente. > > >::GetState", "aj za pohranu i mo", "CInstallUI::WaitForInitUIEvent", "klenmesi, bilgisayar", ". Paleidus i", "VIDATh", "as disks", ";(;4;T;\\;h;", "Installer %s6Computeren genstartes for at forts", "CSetupResponsePageSelectImage", "ete pros", "n.UNo se pudo abrir la Papelera de reciclaje. Abre manualmente la Papelera de reciclaje.qNo se pudo abrir el uso de almacenamiento. Ejecuta manualmente %1!s! para abrir el Liberador de espacio en disco.", "e masz starsze pliki instalacyjne systemu Windows 10. Mo", "z, bu ad", "Nema dostupnih ispravki", "UWindows ", "8B8I8P8", "|Potrebbero essere necessari alcuni minuti per verificare se gli elementi che vuoi mantenere sono compatibili con Windows 10.rQuesto codice Product Key pu", "r ligge i den boks, som dvd", ".<>I(", "Instalace Windows 10", " diff", "ntdll.dll", "sokat a friss", "zisban meghi", "- Windows Update.", "}W0~0Y0", " jeszcze raz.", "site ", "~~v~v", "nytelen parancssori param", "Hemos detectado que tienes archivos antiguos de instalaci", "r redo att forts", "de inicializar o diret", "[__CU", "ku-Arab", "3\"333F3R3o3", "&Continuar", "t be kept because your current version of Windows might be installed in an unsupported directory, or you", "zden kald", "czono %1!ld!%%", "avons pas pu t", " et vous dirons ce que vous devez faire par la suite. Cette fen", "o do Windows que est", "e odpreti. Ro", "&Avsl", "charger la version la plus r", "1/161", "O que precisa de sua aten", "o iniciada no Windows utilizando uma conta de administrador.1Ter", "&Continuer", " %2!s! ingyenes", "e nije uspjelo. Ru", "hkkEoo7", " hacer a continuaci", "yet er tilgjengelig. Du m", " proteja datele, ar trebui s", "hez kattintson a Setup.exe f", "ado; algumas das funcionalidades existentes foram modificadas ou eliminadas; o Windows 10 ", "ttringarna p", "0!kn0", "a s utvr", "INSTALLATION INFORMATION: Some Windows 10 features require advanced hardware; some existing features have been modified or removed; Windows 10 is automatically updated during the support period; support may vary by device.", "Skoraj pripravljeno", "CSetupResponsePageBitLockerKeyValidate::SerializePage", "it deschiderea folderului Desc", "ico sistema Windows uporabljate.'Name", " nije spreman za ovaj PC'Provjeravamo je li instaliranje spremno", " (USB ", "lszolg", "n y despu", " %1!d!%%O", "s %1!s! f", ".::;?0_", "r for batteri under installationen.", "&Obnovi", ">::255", "Language Pack Location", " oldu", " ir vismaz %1!s! br", "o@A configura", "[[[[[V[ZVMVMMMO@>%\"", "ga izskat", "cWe can", "dami naudoti ", "rizze, ", "Hent%Pers", "Bitlocker-n", "e lorsque vous vous connecterez dans Windows Server", "esz pomin", "A Configura", ";NA instala", "m gerektirir; var olan baz", " recenti per essere certo di installare l'ultima versione di Windows 10.", "tigt Speicherplatz zum Aktualisieren.", "ranka valo prie", "Folytat", "aja i dodatne datoteke koje nisu na instalacijskim medijima.", " v nepodporovan", "Ava Allalaaditavad failid", "%2!s!;L'organizzazione gestisce le impostazioni di aggiornamento.", "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponseImpl.h", "avate da iskoristite ", "&Yenile", "^dlmmlba]", " %1!d!GB ", "? ?8?>", "lla filerna m", "CompareStringW", " PC spreman za nastavak instalacije sustava Windows Server 2019. Poku", "1Desc", "ppna Diskrensning.", "r redo.", "ci.cKl", "CSetupLangIniLoader::Initialize: Cannot save current directory", "se automatikusan folytat", "tre utilis", " nytt og fullf", "Klucz produktu ma posta", "Microsoft Time-Stamp Service", " 6%lff&", "7 707L7d7", "ie acestor aspecte.", "Vi kan inte installera de senaste Windows 10-funktionerna och s", "d alebo k", "r.7Dosyalar, uygulamalar ve ayarlar dahil her ", " de utilizar uma chave de produto do Windows 10.", "ste startas om f", "tson fel %1!s! helyet a sz", "rtraukta darb", "1 1$1<1@1X1\\1t1x1|1", " til: %1!s!", "cie a m", "nd de rekommenderade alternativen f", "iile despre instalare de care avem nevoie pentru a continua instalarea Windows de unde a", "%1!s!.%2!s!", "<)=C=]=w=", "te)Ne ", "oikeusehdot", "END_FIRST_BOOT", "Encontrar", "Nobena posodobitev ni na voljo", "jljai vannak a Windows 10-hez. Seg", "-l rula", "IsDebuggerPresent", "ra. Z", "nstalleerd. Het externe opslagapparaat wordt niet opnieuw geformatteerd en u kunt het weer verwijderen nadat de installatie is voltooid.'Voldaan aan vereisten! Klik op Doorgaan&Een ander extern opslagapparaat kiezen", "ber USB k", " a utilizar uma liga", "Det kan tage et par minutter.", "Clave de BitLocker", "/9**'", "Atnaujinimai ", "bas uzlabojumus, jo disk", "ar para baixar os arquivos de instala", "im se sla", " '%c'y", "[Hata Kodu: 0x%x]5Windows y", "ritysvihjeit", "senie o ochrane osobn", "8,8T8[8m8x8}8", "d Product Key pot", "Miski takistab installimise j", "ava ponavlja, pri stiku s podporo za stranke navedite kodo napake.", "r ezen a sz", "Selecione a imagem que pretende instalar.", "Si vous mettez ", "o failure.cmd!Isso pode demorar alguns minutos.", "VDet kan ta litt tid ", "&Fechar(O seu PC ", "tit saab kasutada ainult Windowsi funktsioonide lisamiseks. Windowsi installimiseks ei saa seda kasutada.", " de produit ou une licence Windows 10 pour activer Windows 10 ", " (Version) ", "606D6S6W6[6_6c6g6k6o6s6w6{6", "tre install", "CSetupResponseTemplate::InitializeRoutine", "ajte ponovo.3Do", " bir anahtar deneyin.9", "g hely. V", " USB, ", " megvizsg", "installation pour recommencer.", "&3,e=", "n %1!s!", "lg instruksjonene nedenfor for ", "dzu, ievietojiet Windows instal", "Inte just nu", "+8`^r", "r nyckeln fungerar inte med den h", "CSetupResponsePageBitLockerKeyValidate", "mas netiek nov", "040C04B0", "rki.2R", "Es konnte nicht festgestellt werden, ob Ihr PC bereit ist, um die Installation von Windows 10 fortzusetzen. Starten Sie Setup erneut.", "+`Cu_", "ko versijuaIr pieejama ", "Msg:[%ws] ", "Selezione unit", "GetDlgItem", ".?AV?$CZeroInit@VCSetupDialogSplash@@$00@@", "dium Windows 10.%Po", "uje se da li na ra", "D$p+D$h", "Avis et conditions du contrat de licence applicables", "nyelnek. Lehet, hogy egyes funkci", "Jazyk", "ndeplinite! Ap", " klucz funkcji BitLocker dla identyfikatora: ;System Windows potrzebuje miejsca do wykonania aktualizacji", "t is ig", "@@@@@@@@@@@@@@@@@@", "rta.rLai palaistu uzst", "kleme, Windows bilgisayar", "CreateSemaphoreExW", "Windows 10 atjaunin", "tfen kullan", "za en son Windows 10 ", "Vse je pripravljenoIName", "Arquitectura", "n porque es posible que la versi", "tter uden at aktivere din nuv", "9GUUr", "t iestat", "Sistema operativo Microsoft", "i un suport fizic de instalare (unitate flash USB, DVD sau fi", "tres de ligne de commande non valide", " %2!s! nemokamai", "mu %1!s! vybrali in", " Microsoft Corporation ", "unalnik pri sebi dokler se znova ne vpi", "r lisensvilk", "ds inte av det h", "o.+Libere %1!s! no computador (unidade %2!c!:)aSelecione ou conecte um dispositivo de armazenamento externo com pelo menos %1!s! de espa", "a sa)", "aja i dodatne datoteke koje se ne nalaze na instalacionom medijumu.", "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h", "ite. Po dokon", "e. Proverite je i poku", " bez aktiv", "r utg", "Los puntos siguientes requieren tu atenci", "lgende, f", "Seus arquivos, aplicativos e configura", "uriranja?", "g %d karakter maradt", "tiski(Produkta atsl", "teni k", "Edici", "to se desiloQDa biste instalirali Windows 10, kliknite na Setup.exe na instalacionom medijumu.", "cego i b", "bory. Otvorte ho manu", "cija, kas j", "ovat s t", "yoruz. L", "THr,g", "Telep", "Windows 7 ", "nete, shranite datoteke in zaprite programe..Po", "s que comprar una licencia o clave de producto de Windows 10 para activar Windows 10 despu", "kleme medyan", "r du startede installationen af Windows 10.", " olmak istiyorum", "stroje Vy", "nnen Geb", "e se ponovo pokrenuti za nekoliko trenutaka Proverava da li postoje ispravke,Proverava se da li postoje ispravke: %1!d!%%$Ovo mo", " namestili v ra", "3SG0}_", "ana turpin", "unaru", "su ievad", "Atbalsts", "r Sie.", "Ouvrir0Je pr", "es-HN", "inu S. To izdajo izberite le, ", "8Windows Server 2019 bu bilgisayar i", " verificato un problema durante l'esecuzione di questo strumento", "ite datoteke, aplikacije i postavke jer je trenutna verzija operativnog sistema Windows instalirana u nepodr", " ce que vous vous connectiez.*Impossible d", "mu Windows 10. Sk", "000@@@@@@@@@@@@", "n ve y", "marrer et terminer l", "ite kompatibilno sa izdanjem Windows 10.", "tLe lecteur que vous tentez d", "\"Precommit.cmd ", "CSetupResponsePageBitLockerKeyValidate: UpdateView", "ye yazman", "le vaatama j", "kkelen virker! Fortsett n", " kilka minut.SPod", " nagrywarki dysk", " en annan partition m", "e aktualizovat v", ".\\%s\\%s.mui", "Nismo uspjeli spremili podatke o instalaciji potrebne za nastavak instalacije sustava Windows od mjesta na kojem ste stali. Na", "rer distribusjonsskript for preinstall.cmd,Kj", "lido-No pudimos encontrar el contrato de licencia.", "Pred aktualiz", "unalnik*Preverjamo, ali je vse nared za namestitev", "si oleva versio.", "Neizsl", "dami laikinai i", "CSetupPageRollback", "ffnen Sie Ihren Speicher in den Einstellungen manuell.QIhr Papierkorb konnte nicht ge", "Attendi", " prize tak", ".!%d ", "Klar til ", " en uventet fejl.", "em po", "P}YBf|~", "lection ?", "msvcrt.dll", "mu Windows a osobn", "*0E0x0", "rez votre support d", "r deretter setup.exe for ", " ir bijusi instal", "Si Windows 10 a d", "ReturnHr", "au moins %1!d! Go.", "s megkezd", "ivitage installiprogramm.mInstalliprogramm ei saanud Windowsi installimist alustada. Taask", "\"Prisijunkite kaip administratorius_Nor", "<><`::OnBack", "li trvat.mTento k", "%s GB", "%d%% pabeigti", "O5u`l5u", "n.,En resumen, has decidido hacer lo siguiente:", "Velikost ke sta", "cute en mode S. Ne choisissez cette ", "installation*Param", "iame kompiuteryje(Noriu ", "n!Esto puede tardar varios minutos.dNo podr", "lj en annan extern lagringsenhet", "elite nadaljevati, morate prenesti in zagnati najnovej", "ifriran s funkcijo BitLocker. Izberite drug pogon in poskusite znova.", "rile de actualizare.", "Dette kan ta noen minutter.", " USB, karta SD lub zewn", ": 0x%x] Windows ", "szlelt", "ration peut prendre quelques minutes.sBranchez votre ordinateur pour vous assurer que la batterie ne se d", " de %1!d! Go ou plus. Veuillez choisir un autre lecteur.&T", "rku, et aku ei saaks installimise ajal t", "te panaikintus failus i", "_peo0", "&Siguiente", "ijte extern", "&Back", "Toepasselijke kennisgevingen en licentievoorwaarden", " jour'V", "De gegevens die nodig zijn om de installatie van Windows te voort te zetten, kunnen niet worden opgeslagen. U moet deze later nog een keer invoeren.-Het toepassen van migratiegegevens is mislukt4Het opschonen van de installatiebestanden is mislukt=Het vaststellen van ondersteunde installatieopties is mislukt+Het valideren van de productcode is mislukt?Er kan niet worden bepaald welke versie van Windows u uitvoert.(De installatie van Windows 10 is mislukt", "traukti automati", "o 3 GB. Je", "ez %1!d! min.,Stvari, ki jih morate vedeti, preden za", "daryti", "-painiketta.`Tapahtui virhe, kun yritimme ratkaista ongelman puolestasi. P", "n.cNo sabemos si tu PC est", " se p", "0A$$@0", "utilisation du stockage. Ex", "111WWWddd", "cijas inform", "i unele limbi ", " Windows'un kullanmakta oldu", " uzman", "tu, vai vienumi, ko v", "tte med at installere Windows fra det sted, du var n", "r du kan oppdatere. Du f", "est pas disponible dans la langue et l", "onnistui. Avaa roskakori manuaalisesti.qTallennustilan k", "bor setup.exe.", "talovan", "818D8Q8X8t8", "V6eR{", "unalniku ", "i gata6Vom continua s", "etky pr", " tietokoneessa. Sinun on annettava Windows 10:n tuoteavain alla tai poistuttava asennuksesta, aktivoitava Windows ja aloitettava asennus sitten uudelleen.", " de Windows ar putea fi instalat", " (%d%%)", "n.0Asegurarse de que tu PC tiene espacio suficiente(", " en unos segundos", "dsb-DE", "ObafTento kl", "tama S-re", "Pasteb", "onecore\\internal\\sdk\\inc\\wil\\Staging.h", "eform", "ber obr", "s oper", "|No sabemos si tu equipo est", "nosti namestitveBNamestitveni program ni uspel preveriti veljavnosti klju", "Keiner", "ete poslije snimiti ISO datoteku na DVD.", "dik.\"A Windows 10 telep", "e se dodati automatski8Instalacijski program nije uspio u", " naujinimas]Nepavyko atidaryti saugyklos naudojimo. Dalyje Parametrai atidarykite saugykl", " jau parengtas j", "tzten Verzeichnis installiert wurde oder Sie versuchen, eine ", "Ovaj se klju", "A friss", "''.66", "sit lietot datoru. Pirms instal", "EtwEventRegister", "Chave do BitLocker", "CInstallUI::SwitchToProgressPage", "s de 4 GB (puede variar) y es posible que se apliquen tarifas de acceso a Internet. Haz clic en Siguiente para descargar los archivos de instalaci", "digo de error: 0x%x]8La instalaci", "Instalacja: %sYTrwa ponowne uruchamianie komputera przez system Windows w celu kontynuowania instalacji.", "Dit kan enkele minuten duren.", "ili instalaciju operativnog sistema Windows.", "a, SD kartice ili spoljnog ", ": %1!d!%%3", "dzie konieczne ponowne wprowadzenie informacji..Instalator nie mo", "INDIAN", "pule j", " a odstr", "<*=n=", " nouveau, ou essayer une cl", "o da vers", "ivitykset", "V&olgende", "ivitamine", "su BitLocker atsl", "o BitLocker ser", "nek csomagol", "Das kostenlose Update auf Windows 10 ist nur verf", "enosti skladi", ".,Windows 10 ", "3#4+4", "ne datoteke", ".?AVCSyncObject@@", " na in", "es-ES_tradnl", "e poskrbeli. Kliknite ", "Tarkistetaan avaintaNT", "o para a instala", "pen nem futtathat", "es est", "du laiku.", "=6=Q=", "3 3$3<3@3X3h3l3t3|3", "k, ja j", "\"Ponecha", "U kunt uw bestanden, apps en instellingen niet behouden omdat u %1!s! wilt installeren in een andere taal dan de taal die u nu gebruikt.", "jumi pal", "kite Toliau, kad atsisi", "NW0f0O0`0U0D0", " norite ", ".?AV?$CZeroInit@VCSetupResponsePageUpdateMedia@@$00@@", ")Download the latest version of Windows 10", ">*>O>~>", "&Ekranin", " uv>$+PoW", "ll-e a Windows 10 telep", "kolik minut trvat.UZapojte po", "kkelen finner du i esken som DVDen kom i, eller i e-postkvitteringen. N", "Lataa Windows 10:n uusin versio", "glen indeholder kun 25 tegn.", "ni iz po", "e namestitvene datoteke", "ava jezik ili izdanje verzije sustava Windows trenutno instaliranog na PC-ju.", "$Dispositivo de Armazenamento Externo", "got av f", "Kis t", "8hQgZ", ".~Nepavyksta rasti ", "da:$xD", "CInstallUI", "darykite s", "/Descargar la versi", "Error reporting telemetry for bOnFreeUpSpaceButtonClicked: [0x%X]", " riuscito a inizializzare la directory di lavoro*Parametri della riga di comando non validi", ".?AUIOleClientSite@@", "ana@Dators tiks vair", "n porque has decidido instalar %1!s! con un idioma diferente al que estas usando ahora.", "Arvuti kontrollimine", "BitLockerKey", "nete.1Sa", "inu rada. Odaberite ovo izdanje samo ako instalirate Windows na PC-ju dizajniranom za izvo", "(%2!c!: ", "'Microsoft-ohjelmiston k", " uudelleen, voit ohittaa t", "Nismo mogli shraniti informacij o namestitvi, ki jih potrebujemo, da lahko nadaljujemo namestitev sistema Windows, kjer ste kon", "yj urz", "emo ugovor o licenciranju.", "t personiskos failus un lietojumprogrammas Patur", "RtlGetVersion", "g itt: (%2!s!)oT", "anas programmai neizdev", "m Windows 10 se b", "Ann&uleren", "avons pu enregistrer les informations d", "\"Het ISO-bestand branden op een dvd", "o, ale nie uda", " bulunam", "rpackningen som DVD:n levererades i eller i din e-postbekr", "Es konnte nicht festgestellt werden, ob Ihr PC bereit ist, die Installation von Windows Server 2019 fortzusetzen. Starten Sie Setup erneut.", "..Atsisiun", "?L?h?", "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X", ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationActionResponse@@@@@@", "Bijna klaar", "t work. Try a different key or buy a new one.", "charger et ex", " du ta en titt p", "solu. Cliquez sur Actualiser pour le supprimer de la liste.lUn probl", "5%5,5]5", " oppdateringer, drivere og valgfrie funksjoner", " toimet ovat valmiit. Saat my", " executando.!Falha na instala", "n le a telep", "Y__^[", ".:<@^", "041A04B0", "v at genstarte Installation.gVi har desv", "Stvori instalacijski medij (USB izbrisivi memorijski pogon, DVD ili ISO datoteku) za drugi PC", "Otvori ko", " po instalaci fungovat spr", "setav, ja taask", "Recycle BinFEmpty your Recycle Bin to remove deleted files from your system drive.", "lne si prezrite vyu", "espace pour ex", "u obsahova", " klju", "|hK,_", "Diskov", "re versionrUne nouvelle version de cet outil est disponible. Vous devez t", "uz-Latn", "r ogiltigt, ange r", "skaitant failus, programas ir parametrus.", "OH0~0[0", "rtoti instal", "Non conservare nulla", "A edi", ", preto", " comprou online.", "7=7|7", "ave pri izvajanju skriptov precommit.cmd.", "tajai produkta atsl", "n Set", " datoru, lai turpin", "Please select the partition on which you want to install Windows.", "4(484<4@4H4L4P4d4h4l4p4x4", "t find a USB flash drive.", "luseadme valimine", "0M1T1`1x1", "u anda y", " preinstall.cmd+", " verze Windows, budete si muset koupit Product Key nebo licenci pro Windows", "#Se reporne", "ime.=Selles arvutis ei saa operatsioonis", "dni fog.", "0K0L0", "t savus Windows iestat", "5 585H5X5\\5l5|5", "e u jednotliv", "sr-Cyrl", " hetken aikaa.VM", "CInstallUI::OnActionChanged", "Pripravljamo nekaj stvari", "u an kulland", "Provjera PC-ja", "ejde do re", " att du vet vad det ", "1$1,141<1D1P1p1|1", "accepter.", " Internet.!", "~h_^]", "t telep", "s del reinicio, continuaremos desde el punto en que est", ":(:4:@:L:X:d:p:|:", " fie pe cutia ", "im PC datoram)P", " Microsoft software licence terms", " instala", "tkub automaatselt.", ",Nieprawid", "su produkta atsl", "klad USB k", " reikia atkreipti d", "Start forfra", "al imamo te", "kite saugyklos naudojim", "ve set your PC back to the way it was just before you started installing Windows 10.", "advapi32.dll", "r preinstall.cmd-distributionsskript%K", "CSetupResponsePageBitLockerKeyValidate: DeserializePage", "tirme i", "val, majd pr", "Download den seneste versionuDer er en nyere version af dette v", "van som ", "Clavier &visuel", "ni z prie", "Veljavna obvestila in licen", "ete presko", "Pobierz aktualizacje, sterowniki i funkcje opcjonalne (zalecane)", "rskenduste allalaadimise viisi", "uW0~0W0_0PA", "~0_0o0", "CWizardPage", "bbi utas", "in Tamam", "r for Microsoft-software", "Non posso continuare per uno dei motivi seguenti:", "Muuda Windowsi installiprogrammi v", "MediaType", "ENeGGGlllAA", "ovanie v in", "ifrovania BitLocker pre identifik", "Modifica la modalit", "Sto verificando se il sistema ", "te diegti ", "3+4T4q4", ";*;8;\\;", " parametreleri", "Product Key", " eliminado, incluindo ficheiros, aplica", "rtoti un pabeigtu Windows instal", "ltig. Geben Sie den richtigen Schl", "l~||l||g", " Windows 10 vo svojom po", " listo", "mtade filer", "CoAllowSetForegroundWindow", " bus prad", "cente.5T", "s espacio para la actualizaci", "ynnistyy uudelleen hetken kuluttua", "gle, og v", " USB. Rafra", "Abu`J", "BitLocker za", "kkelen fungerer ikke. Pr", "unaru su vra", " funkcie", ". XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "NMRn0 ", ">A preparar para transferir a vers", " naudoti", "n Microsoft", "d Product Key nefunguje. Zadejte znovu ten, kter", "rification de votre t", "tFSWW", "mu Windows v mieste jej preru", " Windows 10. ", "HeapAlloc", "iu verziu.2Stiahnu", "charger la plus r", "Las siguientes acciones requieren tu atenci", "Von Setup wird vor dem Schlie", "Videti je tako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX:Preden nadaljujete z namestitvijo, poskrbite za te stvari.", ", czy nie spowoduje to naliczenia dodatkowych op", "ene mo", "0o0JRd", "Dit USB-flashdrev er klar", "o suficiente%Deseja continuar usando esta sele", "t vagy kiad", "activ", "kolik minut trvat.", "sjQPh", "em izdelka, ki ste ga navedli, ni na voljo v va", "Nepodarilo sa n", "lne.cNepodarilo sa otvori", "CInstallUI::LoadResourceString", "ekilde yap", "CSetupResponseTemplate::ExecuteRoutine: Back button clicked.", "Al instalar esta edici", "n Windows 10:een. Pid", "m pom", "AmbelegAceast", "Updates, Treiber und optionale Funktionen herunterladen (empfohlen)", "tor cu aceasta: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX7Cheia Bit Locker con", " soubory. Otev", "rsler", "SXYYXXIFB=:", "ana v", " ne funkcionira. Poku", "k ISO fails j", "APPLY_IMAGE", "Miks ma seda n", "#$5'?", "ra verktyget p", "Windowsin asennus siirtyy online-tilaan p", "*m@e~", "rskendused on installitud, kuid nende t", "jamo att", "jlt egy DVD-re a(z) %1!s! haszn", "une copie activ", "ma. L", "%s\\%s.mui", "Il nous est impossible de d", " la Windows 10 este disponibil", "o.eO bit locker tem um aspeto semelhante a este: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX;A chave do bit locker apenas cont", ": https://aka.ms/windowsserverupgraded", "%s MB", "+ _(X", " architekt", "_$@0", "m.WBitlocker izskat", " yeniden girin.", "k igen.(Windows 10 ", "lne spustite %1!s!.", "bory zo syst", "rification de la compatibilit", "j instalaci spustit.%Po", "``` ", "i alt", "ltima versi", "``````", "'Persoonlijke bestanden en apps behouden&Alleen persoonlijke bestanden behouden", "gung, um sicherzustellen, dass Sie die aktuelle Version von Windows 10 installieren.", "i urm", "Det kan tage et stykke tid.VKonfigurerer opdatering til Windows 10", "Opazili smo, da imate za sistem Windows 10 starej", "sult, a hiba egy %2!s! m", "du Product Key a potom vyberte polo", " tuvum", " ne d", "Er is ten minste 350 MB opslagruimte nodig om de installatie uit te voeren. Maak ruimte vrij en probeer het vervolgens opnieuw.5Windows Server 2019 er ikke klar for denne PC-en enn", " 2019 est pr", "FGG1==", "Selecta", "jeblik8Der opstod problemer med at k", "avanje skripti za primenu preinstall.cmd,Izvr", "PQQSVW", "ta Windows", "Comprobando esta clave1Esta clave no funciona. Prueba con una diferente.", " diegimo fail", "lj eller anslut en extern lagringsenhet med minst %1!s! ledigt utrymme", "eme pokra", "9$9,949<9D9L9T9\\9d9l9x9", "e vam klju", "nit zp", "jat Windows PC dator", "### q", " verilerini uygulayamad", "Essas atualiza", "JUw map Downloads kan niet worden geopend. Open de map Downloads handmatig.hDe dvd-brander kan niet worden geopend. Brand het ISO-bestand handmatig op een dvd met behulp van %1!s!.", "ivitysten saatavuus: %1!d!%%$T", "sto o velikosti minim", "unalniku ni mogo", "r kompatibelt med Windows 10.", "Windows ist auf diesem PC nicht aktiviert. Das bedeutet, dass Sie den Windows 10-Product Key unten eingeben oder Setup beenden, Windows aktivieren und Setup erneut starten m", " recenti. Puoi ottenere i file pi", "emo koristiti alat na va", " soubory ze slo", "n para saber qu", "klemek istedi", "Neatbilst arhitekt", "sit, neaktiviz", " DVD.", "Completamento operazione: %d%%", "o alguns itens a ter em considera", "lTento n", ".Preuzmite najnoviju verziju sustava Windows 10", ">\">@>X>v>", "0f0K0", "avons pas pu trouver les informations n", " tienes que hacer despu", "Notiek ", "kovi za pristup internetu. Kliknite na dugme ", "Dalje", "a za sme", ".rdata$r$brc", "rification de votre PC+Assurez-vous que vous ", " installationsmediet.", "?;?f?x?", "ne valikulise funktsiooni ja keele.", " naujinimo parametrus.", "041304B0", "duaaa", "0@w$A0", "Bevar personlige filer og apps", ". Verifica", "[g0Y0n0g0", "4&4P4p4", "niteln", "i o unitate flash USB", "&Zatvori\"Nije mogu", " soubory odebraly ze syst", "U kunt uw bestanden, apps en instellingen niet behouden omdat u een editie van Windows installeert die verschilt van de editie die u nu gebruikt.", " se restartuje, budeme pokra", "Den ser slik ut: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXFDu m", " ativado neste PC. Isto significa que ter", "No pudimos instalar Windows 10[Hemos revertido tu PC al estado en que estaba justo antes de empezar a instalar Windows 10.", "Installerer Windows 109PCen startes p", "nda det h", " produktu %1!s! w innej wersji j", "lna verzia Windowsu je pravdepodobne nain", "nily nebo odebraly. Syst", "ie de Windows. ", "logo Inv", "jlok haszn", " megnyit", "Odabir pogona", ". Viimeistele p", "t, nen", "o wykona", "Nous ne sommes pas certains de ce qui s", "Uppdateringarna ", "ments suivants requi", "i pot include remedieri importante, drivere de dispozitiv actualizate ", "cie0In", "636Q6q6~6", "%%%1!d! tamamland", "Nada+Poder", "Detta tar n", " (5~:", "Tilanne: %1!d!%%?Jatka valitsemalla jokin k", "n de Windows autom", "o.{Estamos com dificuldade para determinar se seu computador pode executar o Windows 10. Feche a Instala", "ne datoteke i aplikacije", "zden ge", ", abyste m", "vel determinar se o seu PC est", "lineen Setup.exe-tiedostoa.jEi ole varmaa, voiko tietokone jatkaa Windows 10:n asentamista. Yrit", "Arhitectura nu se potrive", "Kontrollera kompatibilitet", "10IObtenir des mises ", "e-No0\\PbkW0~0Y0L0", "en-TT", "i znak", "ISO File (*.iso)", "e skupiny %d je neplatn", "em izdelka aktivirajte trenutno razli", "cuter cet outil sur votre PC. Si vous rencontrez toujours des probl", "Entrez la cl", " Internet, ativaremos o Windows automaticamente.", "Palaukite", "anas datu nes", " %1!d! GB", " vai j", "vururken hata kodunu bildirin.", " przerwano.8Na tym komputerze nie mo", "tkake.", "I4P!I", "Otvorite DVD pisa", " DVD napa", " de produit doit se trouver dans le bo", "t fra det punkt, hvor jeg stoppede", "avons pas pu installer Windows 10", "Id. de di", " vydanie Windowsu, ne", "v/f&T", "\"Zadr", "000@@@@@@", ";1;7;<;Q;f;", "SECOND_BOOT", "If Windows 10 was previously installed and activated on this PC and you", ".?AVCSetupResponsePageMediaCreationSuccess@@", "s veicam sagatavo", "chir la liste des lecteurs", "l a sz", "Baixar a ", "en-IE", " sa skripty nasadenia failure.cmd", "es importantes, controladores de dispositivos atualizados e ficheiros adicionais que n", "ntOAz eszk", "Ne moremo ugotoviti, ali je va", "espace disponible sur votre PC", "Installing Windows 10::ExecuteRoutine: Back button clicked.", "los pal", "GetFileAttributesW", "0D0O0d0K0n0", "v at genstarte Installation.9Kontrollerer, om der er tilstr", " naujo, t", "tres.M", " preinstall.cmd./", "Voglio usare la memoria esterna#Non voglio usare la memoria esterna", "unalnik se bo vsak hip znova zagnal(Preverjanje, ali so na voljo posodobitve2Preverjanje, ali so na voljo posodobitve: %1!d! %%", "chargement peut occasionner des frais suppl", "lj sedan Uppdatera.", "o sem problemas e podem incluir corre", "Potrebujeme viac miesta4Vy", "hrend der Windows-Installation k", " sem bateria durante a instala", "9%9+9G9R9Y9", "le asukohas %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ja k", "jjk%xxy", " listo para este equipo(Comprobando si la instalaci", "CSetupResponsePageInstallNowOrLater", "n.|Se necesitan al menos 350 MB de espacio para ejecutar el programa de instalaci", "=%=2=G=[=", " %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml, ", "Tarkista yhteensopivuus", "(jAet", "Setup akzeptiert keine Befehlszeilenargumente. Weitere Informationen finden Sie in der Setup-Hilfe oder durch Ausf", "n tietokoneeseen ensimm", "Open Downloads", "0!kn0\\Omi", "niku instalacyjnym. Je", "8O Windows Server 2019 ainda n", "k ment", ":TUPNNL2", "Enne v", "gu-IN", " ponownie uruchomiony. Po ponownym uruchomieniu b", "mos que tem ficheiros de instala", "Opnieuw beginnen vanaf het begin", "4Q4z4", " S.[USB ", "BitBlt", "en Sie Setup, und wiederholen Sie den Vorgang.*Windows ist auf diesem PC nicht aktiviert.", "ljaji bodo dodani samodejno", "^YofSKKMcmY^", "r sedan installationen igen.aMer information om hur du uppgraderar Windows Server finns i: https://aka.ms/windowsserverupgraderVi kan inte avg", "[g0M0~0[0", "cia dial", "Seuraavat asiat on hyv", "(%1!c!:) - %2!s! libre", "w w celu zagwarantowania, ", "CDlpResponseImpl > > >::GetResponseName", "Obnovi", ")Windows 10 uusima versiooni allalaadimine", " aktywowany na tym komputerze", "ker efter uppdateringar: %1!d!%%", "ih razloga:", "chte helfen, die Installation von Windows zu verbessern", " de produit Windows 10 ci-dessous, ou quitter le programme d", "%s GBwVi kan ikke sige, om pc'en har nok plads til at forts", ", ja k", " a vers", ".?AVCSetupResponsePageBase@@", " versio vain silloin, jos asennat Windowsin S mode -tilaa tukevaan tietokoneeseen.NUSB-muistitikun koon on oltava v", ".?AVIDlpObject@@", "ste to znova alebo vysk", "PL0g0M0~0W0_0", "t save the installation information that we need to continue installing Windows from where you left off. Sorry, you", "tta aega.zWindowsi installimisel ilmnes ootamatu t", "i acum copii backup ale acestora pe o alt", "'Microsofti tarkvara litsentsitingimused", "le pri sebe a", "D$HSV", "(CD9I", "Potrajat ", " ir i", "Uppdatera enhetslistan Det beh", "rX\"dP4H", "o do Windows Server 2019 Instalando o Windows Server 2019", "stroj nepodporuje.", "s abajo si quiere averiguar por qu", "ili instalirati %1!s! uz jezik koji se razlikuje od onoga koji trenuta", "n las aplicaciones y la configuraci", "t able to download all of the necessary files. Check to make sure you", "7 8'8-828>8H8[8g8", "RPCRT4.dll", ".:Nepavyko diegimo etapas %1!s! d", "Na&zaj", "CSetupResponsePageInstallChoice", "dik. Pr", "Scegli il supporto da usare", "o de scripts precommit.cmd.", " vietas, kur t", " program Windows 10. A", "tit./See tootev", " USB, DVD ou fichier ISO) pour un autre PC", "es; Windows 10 est automatiquement mis ", "se problemet og kj", "installation ne peut continuer, car Windows ne peut red", "Selecci", "r du loggar in i Windows 10. Skydda dina data genom att ha datorn i n", "trzny i kliknij przycisk OK, aby ponownie uruchomi", "ycia magazynu. Uruchom r", "Om du installerar den h", "ra sa nezhoduje", "rer de l'espace. Puis, essayez de nouveau.CUn probl", " conectado ", "%h.vvZu", "lck8^", "in actualiz", "ma ar instal", "nPPPP", "Installiprogramm puhastab enne sulgemist", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "qps-ploca", "Namestitvenih datotek za Windows ni mogo", ": %d %%.", " vain henkil", " Windows med en administratorkonto.)Du m", "trukti, kol bus patikrinta, ar tai, k", "e nastavenia pre %d%%", "a. Je", "ir) olabilir ve internet eri", " rakt", "ga nedarbojas. V", "r od spolo", " jednotku a kliknite na tla", " ISO-", "m apenas 25 carateres.", "ga darbojas! Turpiniet, kad esat gatavs to dar", "=$=4=8=<=T=X=\\=`=h=", "i nu are suficient spa", "cia na Windows 10 je k dispoz", "s que comprar una clave de producto o una licencia de Windows 10 para activarlo tras la actualizaci", "klenmi", "gerbereinigung auszuf", "0@d$A0", "j-Yf;", "dzie ponownie formatowa", "rkeit", " Windows 10. For ", "s sa vyskytol probl", "Brenn ISO-filen til en DVD", "anas programmu.", "Usa le opzioni consigliate per questo PC", "pGetHostCSDBuildNumber", "040B04B0", "3Windows 10", " pronto para este PC", " Internet. Clique em transferir para obter os ficheiros de instala", "vi-VN", "r installasjonen er fullf", "iam kompiuteriui$", "Ako prvi put instalirate", " chyba. Overte, ", "[6b/e", "sti+Pasirinkite kit", "r produktnyckeln fungerade inte. Kontrollera att den st", " haluat s", "Transferir a vers", " jour appliqu", "Die Windows-Edition, die dem von Ihnen eingegebenen Product Key entspricht, ist in Ihrer aktuellen Sprache und Architektur nicht verf", "m apenas 48 carateres.BO valor da chave %d do grupo ", "ii despre upgrade-ul pentru Windows Server, vizita", "seket, lehet, hogy a sz", "r kopplad till produktnyckeln du angav ", " vontade para continuar usando seu computador.FA instala", " parametrus, asmeninius failus ir programas reikia atkreipti d", "elim koristiti vanjski ure", "Eemaldage j", "ta klaida.", "0(080H0L0\\0l0p0", "tartuje po", "i spustit. Pokud se budou probl", " datorn. Om problemen kvarst", "m vyrie", "re plads, og pr", "lgende:", "i un dispozitiv de stocare extern cu spa", "Dosyalar", "&Kontrollerer at installasjonen er klar", "CreateFontW", "Noudetaan p", ":8;P;", "ssel funktioniert nicht. ", "`1Xn0", "@ ;A u", " proizvoda.)USB izbrisivi memorijski pogon je spreman", "Vii see arvuti kohe uuemale versioonile ", "(WvQ-N", "rmtangentbordet", "Preverjamo va", "dia de instala", "iile mai t", "n 350 Mt tilaa. Vapauta tilaa ja yrit", "r kan ta en stund.", "n ve yeniden deneyin.", "chec de l", "ciem.3Poczekaj na zako", "ie de salvare.", "sti su ", "rcarea are aproximativ 3 GB. Dac", "nak l", "Instalar o Windows 10=Obter atualiza", "t available in your current language and architecture.", "itada#Teie arvutis juba t", "rk on veel j", "0#070H0q0", "SendMessageW", "Stato: %1!d!%%7Seleziona una delle opzioni disponibili per continuare.", " problem podczas uruchamiania tego narz", "dzu, uzgaidiet", "p ard", "gbar.", "ionarea instal", "n de unidad9El programa de instalaci", ", nie ma wystarczaj", "vce./Budete muset vyp", "\\\\\\\\[", "|||v|xp", "CDlpResponseImpl > > >::ExecuteRoutine", "Valitse n", "j0\\Omi", "p alkalmas-e a Windows 10 futtat", " systemu Windows 10 na Twoim komputerze, poniewa", "iek tiek vietos ir pasirinkite Atnaujinti.", "o preinstall.cmd/Executando scripts de implanta", " fail", "Vymenite", "Instal", "Kurulum komut sat", "Ja turpin", ".*%2!s! ", "De nieuwste onderdelen en beveiligingsverbeteringen voor Windows 10 kunnen niet op uw pc worden ge", "P(bnvN0", "kite Setup.exe.cNe", " possibile installare Windows Server 2019Y", "nceki haline geri getirdik.", " C&hci pomoct s vylep", "puj zgodnie z poni", "Pred zavret", "N`OS_MR", " Microsoft Corporation. Minden jog fenntartva.", "cz komputer do zasilania, aby bateria nie wyczerpa", "CDlpResponseImpl > > >::Cancel", "rel k", "ch soubor", "bb 350 MB szabad helyre van sz", "3 3<3T3l3", ".?AVCBitLockerKeyEdit@UX@Common@ConX@@", "Weitere Informationen", "yt48<<", ", joka ei ole sama kuin t", "eme na v", "==E===?5", "CSetupResponseTemplate::OnNext", "rer distribusjonsskript for failure.cmd", "Na pozad", "CreateThread", "\\\\\\[[RRRBB/(", "CInstallUI::ConfirmEulaDecline: Eula decline aborted", "Windows 10 Setup", "CInstallUI::OnProgressChanged: Cancel is requested. Returning ERROR_REQUEST_ABORTED", "Atidaryti ", "Provera ra", " (%2!c!: ", "ed zav", "kkelen3Denne n", "Pasirinkite atvaizd", "t(,,,,", "tu, lejupiel", "velgiant ", "iu3%1!d! GB de spa", "RtlNtStatusToDosError", "Listo para instalar", "Tai gali u", "ncercat s", "bMMMw\\y", "ice sistema Windows, ki je trenutno name", " setup.exe ", "iA haszn", "aja i dodatne datoteke koje se ne nalaze na instalacionom medijumu. Ako ne instalirate ove ispravke sada, ra", " jsou pot", "&Neste", "(d(e`", "No sabemos si el equipo tiene espacio suficiente para seguir con la instalaci", "%d tegn igjen", "n den du anv", "jiet uzst", "bory ponecha", "Neodpov", "mmern Sie sich bitte um die folgenden Punkte, um die Installation fortsetzen zu k", "Jos olet asentamassa Windows 10:n t", "Me ei saa kindlaks teha, kas teie arvutis on Windows 10 installimisega j", "Imposibil de g", "Les fichiers de votre disque USB vont ", "ppna papperskorgen manuellt.RDet gick inte att visa lagringsanv", "Nevar atrast Windows instal", "-|L\"ht", "0k0o0", "tzten Installationsoptionen konnten nicht ermittelt werden..Der Product Key konnte nicht ", "GetSystemTime", "to sledi.PDa biste nastavili instalaciju, potrebno je da obratite pa", "i datoteke, aplikacije i postavke.", "7!8(8/8f8", " avgj", "tor: 1Windows potrebuje na aktualiz", "5:6c6", "Det oppstod en uventet feil under installasjonen av Windows. Kontroller at installasjonskildene er tilgjengelige, og start installasjonen p", "Sisestage Bitlockeri v", "Q!k{veQ", "stas, bet j", "~P7\"HUUHHHHH7%", ", Windows ", "4Windows Update ", "sek, az illeszt", "e naprej uporabljati ta izbor?", "nda datorn som vanligt.", "@@@000", "tenka vietos+Ar tikrai norite t", "n de Windows. Inserta tu medio de instalaci", "N DE INSTALACI", "aj za pohranu,Ne ", " program a sk", "o.1Seleccionar dispositivo de almacenamiento externo", "m Kutunuzu bo", "installation pour recommencer.}Le programme d", "aj za preuzimanje ima oko 3 GB. Ako koristite ograni", "o do Windows. Tente uma chave diferente.dEsta chave do produto (Product Key) n", "sten klar", "kkelen inneholder bare 48 tegn.?N", "o suficiente para continuar a instalar o Windows Server 2019. Tente reiniciar a Instala", "alost, poslije ", "CInstallUI::ShowMessageBox: Showing MessageBox", "anas programma. P", " versiune de Windows 10", "{IDATx", "p do Internetu. Kliknij przycisk Dalej, aby pobra", "ments volumineux..S", " ayarlar b", "n.iKurulum program", "i eso", "Za&vrie", "bW0f0D0~0Y0", "tirmeden devam ederseniz, g", "uriranja moramo u", "(&R)E", "Kontrollerar nyckeln9Den h", "2.2H2O2h2", "ite u pomo", "Windows Kurulumu'nun g", "High Contrast White", "t svar", "%1!d!%% ", "installe Windows", "v[wwgK:", "PL0g0M0_0", "N0L0J", "i fejlett hardvert ig", "llningar och appar tas bort, men dina filer beh", "EtwEventWrite", "lida. Escribe la clave correcta.5Escribe la clave de Bitlocker para el identificador: *Windows necesita espacio para actualizarse", "b&TY0", " i uruchomi", "rbaude", "CSetupResponseTemplate::ExecuteRoutine: Next button clicked.", "A verificar o seu PC", "Kontroluje se v", ";RU_:g", "toru sa nepodarilo ur", "iamieji diskai", "m soubor", " jour et reprendra lorsque vous vous connecterez ", "?!?F?h?u?", "rjade installera Windows 10.", "cej ilo", "seTEz a term", "L$t_^[3", "gikast k", "lectionner une image", "rer scripts til udrulning af preinstall.cmd,K", "313Y3g3", "Dodatne informacije", "installation sont accessibles, puis relancez l", " retomada quando voc", "i este criptat", ": 0x%x]A", "m toate fi", "rre problemer med at fastsl", "%hs: Failed to read 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber'. Error = %d", "kleme tamamland", "lemini yeniden ba", "Jos asennat Windows 10:n tietokoneeseen ensimm", "re mediet for ", "o pudemos salvar as informa", "7$7(787<7T7X7\\7`7d7h7l7p7t7x7|7", "Deseas continuar usando esta selecci", "Die Editionen stimmen nicht ", "jjk@uuv", "2-2?2g2t2", " dokon", "luseadet ", "sst*wwx", "(Windows", "%KzQ*U0<|", "bg-BG", "unalo. Instalacija sustava Windows automatski ", " leidimu. Bandykite kit", "HZo6m|", "e informacija", "memmove", "inu S.EPogon USB mora biti velik vsaj %1!d! GB ali ve", "ete zadr", "rste gang, m", "eri ge", "outil ", "nda v", "u. Lorsque vous vous connecterez ", "Asjad, mis vajavad teie sekkumist", "scht. Wenn Sie die Dateien beibehalten m", "es estiverem sendo instaladas. O Windows n", "N4h_N", "ivitage arvuti. Windowsi install j", "chec du nettoyage des fichiers d", "2F5g5", "ll have to re-enter your information later.(Setup has failed to apply migration data,Setup has failed to clean up the setup files7Setup has failed to determine supported install choices,Setup has failed to validate the product key9Setup can", "I&nstaller", "latarak Windows y", "s ellen", "7]9d9z9", "ceho prihl", "pulej", "4Z4d4", "fr-CD", "teni az ", "r installationen er fuldf", "jeblikket er installeret p", "ntalo de nuevo.-Windows 10 a", "ra uppdateringen.%Frig", "lreiz.+Lejupiel", " do elektrickej siete, aby sa bat", "ate v ra", "AllalaadimisedDEemaldage mahukad v", "yet kan ikke oppdatere PC-enxSpr", "\"***d", "e oczy", "te computerul pentru a continua instalarea.", "ny dolgot m", "Informativa sulla privacy", "tte.3Download det opdaterede v", "Sugest", "iame kompiuteryje. Tai rei", "tenje pohrane u postavkama da biste uklonili druge velike stavke.\"Odabir vanjskog ure", "o mais recente do Windows 10", "hemalt %1!d! GB.", "sait, mert a Windows jelenlegi verzi", "riode de soutien; le soutien peut varier selon les appareils.", "o com tr", " Internet et essayez d", " program.", "dakilerden biri nedeniyle devam edilemiyor:", "nnj:}", " de introduzir uma chave de produto.", "ring om beskyttelse af personlige oplysninger", "INFORMAZIONI SULL'INSTALLAZIONE: per alcune funzionalit", "hlt haben, dass %1!s! mit einer anderen als der gerade verwendeten Sprache installiert werden soll.", "Cambia la forma en que el programa de instalaci", "Nous ne pouvons pas installer les derni", "ste skriva in den igen senare.)Det gick inte att till", "ga nedarboj", " tietokoneessa ja asennat sit", "Do not turn off your computer", "CSetupResponsePageBitLockerKeyValidate::OnSetCursor", "_U2QX[", "Prullenbak openen", ". Windows", "ppp@@@@@@@@@ppp", "tsa el a sz", "ha-Latn-NG", "ciju par jaunin", "bbiakr", "N0RvQ", "sst]sst*", ". Jos et asenna n", "Atlasiet ", "cz zewn", "rbeli let", "hRemova a seguinte unidade externa e clique em OK para reiniciar e concluir a instala", "enite ", "6!6-6c6", " pietiek vietas)Vai v", "NY0P0", ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceActionResponse@@@@@@@@@@", "ierele personale Windows%P", "%s is geen geldig teken", " Windows Update.VNotiek Windows 10 atjaunin", "A Instala", ".?AVCSetupPageMessage@@", ".?AVCBitmap@@", "HotovoJV in", "Leidimas", "I jedno i drugocOvaj Bitlocker klju", "10. Afin de prot", "nik do u", "kc0f0D0~0Y0", "k och den arkitektur du anv", " listo para este equipo-Asegur", "ionale", "t supported by this tool.", "til do stavu, v akom bol pred spusten", "Esta chave do produto (Product Key) s", "das kods: 0x%x]-Rad", "Translation", "This will take a few minutes.", "Descargar1Conserver les fichiers personnels et applications;Conserver les param", " %s n", "Preuzmi ispravke, upravlja", "te nastaven", " jau darbojas sist", "al ne moremo ugotoviti, ali je Windows Server 2019 ", "CSetupResponsePageUpdateMedia", "8+828Q8", " a in", "r Windows 10", "ania preinstall.cmd-Uruchamianie skrypt", " muita p", "ch pozn", "cie$Vyh", "Stahov", "lisan.}Nem siker", " parametrus ir asmeninius failus", "Kontrollerer din pc-Kontrollerer, om du er klar til at installere", "est pas disponible dans votre langue et votre architecture actuelles.", "kojiet kr", "2J2g2", "dzie nie obs", "V:N`OS_MR", "innUSB s", ".&Paleid", ".?AVCSetupResponsePageSummary@@", "al ne moremo ugotoviti, ali je Windows 10 ", " wersj", "Atuali&zar", "bory ve", "ali Windows postavke, li", "lla viktiga korrigeringar, uppdaterade enhetsdrivrutiner samt ytterligare filer som inte finns p", "ania instalatora", ": :$:*:.:4:8:A:Q:b:f:l:p:v:z:", "ProfessionalN", "BeggedDenne BitLocker-n", "GetModuleHandleExW", "0>q5m", "0A$$?0", "chten Sie die Aktion wirklich beenden?", "m souhlas", "t pour l", "Se eliminar", " program a zkuste ho spustit znova..Windows Server 2019 se nepovedlo nainstalovat. Instaluje se Windows Server 2019", "Windows 10 UpdateVOtvaranje iskori", "ljaande installimisel konfigureeritakse teie arvuti t", "asti sa upravili alebo odstr", "rjest", " parink", "c>o1o;", "BODY {background-color:rgb(%d,%d,%d);}", "? ?$?(?,?0?8?P?T?l?p?t?", "Comprobando PC", "dzu, atlasiet vienu no pieejamaj", "$#bnVf", " go i spr", "Przygotowywanie sk", "Zie hieronder voor meer informatie.", ". Zav", "Pripravljanje namestitve ", "gga till funktioner i Windows. Den kan inte anv", "kleme kaynaklar", "installationiLe programme d", " uruchomiony ponownie. Po ponownym uruchomieniu b", "jlokat, k", "Zachovat jenom osobn", "5c5~5", "Ouvrir la corbeille", "vesnice na obrazovce", "Windows Server", "os ser", "sti tilaa Windows Server 2019:n asentamisen jatkamiseksi. Yrit", "Vyzer", "li nie zaakceptujesz warunk", "t Windows 10_M", "A Windows 10 leg", "m yerden devam et", "0:FDI8IIIIOIIIFIcu", "est pas valide, saisissez la bonne cl", "t&hh{", "is produkto kodas neveikia. I", "siamas diegimas.", " za bitlocker sadr", "m Windows 10 p", "yor! Haz", "n tus archivos.PSe eliminar", "`Ock(W", "ciou tohto vydania Windowsu 10 nakonfigurujete po", " daryti toliau. ", " %1!s! na jednotke %2!c!:.}Om du vill installera Windows 10 p", "i amovibile", "saca ", "5OHHHHHG9$", "zda olmal", "xBf|v", " tuoteavaimella voi vain lis", "Flyttbara enheter", "espace libre sur le lecteur que vous tentez d", "%2!s!7Va", "0f0D0~0Y0", " tudo pronto;Continuaremos a instala", "chto vybrat", "nda olemasolevat funktsiooni on muudetud ja m", "ar-SA", "e uporabljati Windows 10. Zaprite namestitveni program in poskusite znova.", "mi helyet, majd v", " izdelka", "~bvvv", "tse ki a Lomt", "a zariadenia.", ", lai ieg", "ri.UNu s-a reu", "sim, kad t", "pjen ki a telep", " Windows Server ", " precommit.cmd", "n eri", "n autom", "ta aktiviz", "Provjeravanje PC-ja,Provjeravamo jeste li spremni za instalaciju", "tirmek i", " proizvoda je ispravan! Nastavite kada budete spremni.", "tg-Cyrl", "(sf*SHU0", "lacak medyay", "dakilere dikkat etmeniz gerekir.QBit kilidi ", "Brez&(%1!c!:) ", "Izaberite sliku koju ", " a formatear el dispositivo de almacenamiento externo, y podr", "lo k chyb", " jako administratorjAby skorzysta", "pa-Arab-PK", "yor!Birka", "r uppdateringen", "040504B0", " jis tur", "ka bir b", "dos, assim como do que ter", "L'unit", "We weren", "hnout aktualizovan", "%1!s! %2!s!\"Houve um problema ao criar a m", "%3!s!'", "Burn the ISO file to a DVD", "ra installationsprogrammet. Frig", " se mi to tu objevilo?", "yor %%%d", "QQSVW3", "Vi kan ikke fortsette av ", "emo procijeniti ima li na va", "3,3<3T3l3", "ndning i inst", "ete da kupite ", " %1!s! (disks %2!c!)RAtlasiet vai pievienojiet ", "LP.CAB", "bbfejleszt", "Pildi valimine", "ndan yeniden deneyin.", " da chave do produto.!Sua unidade flash USB est", "Activation", "e lub nieu", "rskenda draiviloendit*Sellel peab olema ruumi v", "CInstallUI::ShowCompatResolvedMessage: Ignoring since error page is shown", "ke programe i opcionalne funkcije (preporu", "o do Windows 10 no Windows Update.WConfigurando a atualiza", "TargetUsbDrive", " pronto para este computador'Verificando se a instala", ", produkto kodo ", "G,PSWhp", "10.Cette op", "ka se mo", "Windows 10 ", "chec de la validation de la cl", "{6?>1", " gjenoppta installasjonen.", "CDlpResponseImpl > > >::GetResults", "CInstallUI::OnProgressChanged", "i nain", "t %1!s!, izmantojot valodu, kas at", "CorbeillePVidez la Corbeille pour effacer les fichiers supprim", "ivitage %1!s! k", "Download wird ", "s egy kis id", " Internet e tente executar a ferramenta novamente.7Ocorreu um problema durante a execu", "liorations de la s", " parametrai ir programos bus panaikinti, bet failai i", "Atualizar a lista de unidades$S", "r det spr", "t, ir sader", "CInstallUI::ShowRollbackPage", "lemadbSee BitLockeri v", "e informacija o nadogradnji poslu", "n gratuita a Windows 10 solo est", " estiver instalando o Windows 10 no PC pela primeira vez (ou instalando outra edi", " 4GB+ (", " ne fonctionne pas avec cette ", "USB-flashdrev", "rer avinstallasjonen.", "/?$$@0", "zda Windows 10", "1'1-13191B1R1b1r1", "&Nainstalovat", "3N3,4y5", " la rularea acestui instrument", "D$Tfff", "o gere as suas defini", "anas programmu.+Noskaidroju, vai j", "Nie mogli", "hren von Setup. Geben Sie Speicherplatz frei, und wiederholen Sie den Vorgang.", " Windows 10%", "rios. Verifique se voc", "RedrawWindow", "ssel umfasst nur 48 digitale Zeichen.", "nnen Ihre Windows-Einstellungen verwalten.RIhre Einstellungen und Apps werden gel", ". Windows v", "o podemos determinar se seu computador est", "sikraus.", "o de Unidade7A configura", "Bunu neden g", " Windows.%", "bamos.(Este equipo no puede ejecutar Windows 10", "rskenduste, draiverite ja valikuliste funktsioonide hankimiseks. Need v", "hlen Sie ein anderes Laufwerk aus, und versuchen Sie es erneut.", "a. Spr", "nso-ZA", "unar i dovr", "emy Ci zwolni", ".?AVCButtonEx@UX@Common@ConX@@", " Windows-versiotasi, sinun on ostettava Windows 10 -tuoteavain tai -k", "0C0C04B0", "ekneme v", " korjauksia, laiteohjainten p", "w+Wymagany jest rozmiar co najmniej %1!d! GB.", "nchide automat peste %1!d! minute./Lucruri care trebuie ", "DOWNLEVEL", " instalada actualmente en tu PC no es compatible con esta herramienta.", "Pripravuje sa %d%%", " mindst %1!d! GB.", "lectionnez la langue, l'architecture et l'", "liorer l'installation. Elles incluent ", "2019>Red", "0Y0y0f0L0JRd", " klucza grupy %d jest nieprawid", "yet, m", " ca administratorcPentru a utiliza acest instrument, trebuie s", "Nemokamai atnaujinti ", " adres", "3$3,343<3D3L3T3\\3d3l3t3|3", "v igen.-K", "s, ke", "[o0!kn0h0J0", "anu!Tas var aiz", "ko versiju.1Lejupiel", "echny otev", "< <$<(<,<0<4<<", ":*;4;R;v;", "Entrer une cl", "9~ltN9", "installer certaines fonctionnalit", "Ekranin", "sa problemet. K", "I file presenti nell'unit", "kohtaiset tiedostosi ja sovelluksesi.CSeuraavat seikat kaipaavat huomiotasi, jotta voit jatkaa asennusta.\\BitLocker-avain n", "U kunt uw bestanden, apps en instellingen niet behouden omdat uw huidige versie van Windows mogelijk in een niet-ondersteunde map is ge", "1$14181H1L1P1T1X1\\1p1t1x1|1", "9)9<9U9j9", "x+>~u;\\", "du Windows versiju j", "es de migration par le programme d", " possibile eseguire Windows Server 2019 in questo PC", "NdkHr,g", "nka p", "nde ISO-filen til en dvd senere.", "%2!s!.Uw organisatie beheert de update-instellingen.", ";T;Z;j;z;", "2!3D3g3", " parou. Voc", "pt-BR", "to pristajete.", "sok el", "Co je t", "CDlpResponseImpl > > >::Serialize", "ne-IN", "cessaires ", "i (jednotka %2!c!:)dVyberte nebo p", " din pc (%2!c!:-drev)?V", "ajke (preporu", "Tyto aktualizace p", "Aucun", " reporneasc", "@@@@@@@@@@@@@@@@@@PPP", "Ha most fogja el", "aUTaj klju", "=FB~G", "cents.", "rankos.lReikia bent 350 MB, kad b", " lub spr", "AuthUsesFlags", " pode ignorar esta etapa. Vamos ativar o Windows automaticamente depois que a instala", "Pabeigti %1!ld!%%", "f94Au", "unalnik po namestitvi morda ne bo deloval pravilno, in morda boste morali znova namestiti nekatere izbirne funkcije in jezike.", "CSetupUIManager::OnSetupExiting", " od miejsca, w kt", " sistemos disko.", "Things to know before you startqThe download is about 3 GB. If you", ".?AVCListCtrl@@", "hrt6Precommit.cmd-Bereitstellungsskripts werden ausgef", "te disko valym", "CSetupLangIniLoader::Initialize: Language Pack Root = %s", "tter automatisk.", "z haszn", "QCette cl", "CDlpResponseImpl > > >::GetResultsRoutine", " conna", "GetTraceEnableFlags", "&Cerrar$Tu PC se reiniciar", "s gombra kattintva nyugodtan elt", " Windows.I", "evrimi", "turulurken bir sorun olu", ", nous reprendrons o", "Espera", "rtoti, produkta atsl", "FveGetAuthMethodGuids", "ssen Sie eine(n) Windows 10-Produkt Key oder -Lizenz erwerben, um Windows 10 nach dem Update zu aktivieren.", ". Izv", "%hs: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0", "Diegimo t", "Mindj", "ticamente.", "nda bir hatayla ba", "ci.PAby se dalo v instalaci pokra", "Juriidika", "Laster ned Windows 10", "&Accept", " sakl", "Zmeni", " sammuta tietokonetta", "GetSystemDefaultUILanguage", "Soporte t", "Installera %s6Datorn startas om s", ".CRT$XCU", "eme v po", "ave pri ugotavljanju, ali va", "FveApi is not present/installed", "- (%2!s!)V", "z olmayan dosyalar", " simile all'esempio seguente: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXdPrima di continuare l'installazione ", "SIDATh", "toru sa nepodarilo overi", "Sto eseguendo alcune operazioni", "stroj, mus", "3Asennan Windows 10:n uudelleen t", "solu. Cliquez sur Actualiser pour le supprimer de la liste.nUn probl", "m instalace Windows Serveru 2019.JV instalaci Windows Serveru 2019 budeme pokra", "es recomendadas para este computador", "te de dialogue non valide2Nous n", "n tietokoneeseen", " um caractere inv", "Znak %s nie je platn", "szen ", "Uygulanabilir bildirimler ve lisans ko", "Windows y", "a organizacija upravlja postavkama a", " reikiam", "Windows 10 G", "line draiv lahti ja kl", "t, amelyre telep", "Warum wird mir das angezeigt?", "#9~pt", "no odprite v nastavitvah./Ko", "installation et conserver vos param", ".!USB-", "tanje postavki za %d%%", " un error inesperado. Comprueba si se tienes acceso a los or", "j@Xf;A", ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX/A Bitlocker-kulcs 48 digit", "e. Odaberite drugi pogon.", "&Instal", "Stai gi", "titili podatke, trebalo bi da budete blizu ra", "o for conclu", "tte p", "te.2Nesivar", "string too long", "steem Microsoft", "xMMO@O>%\"\"\"\"$ $!", "ges a folytat", " programot, ", "PPP@@@```", "J@J=E=D42", "elite da instalirate.", "%1!d! ", "i predt", "riode de prise en charge", "> >.>8>P>l>", "hren der precommit.cmd-Skripts ist ein Problem aufgetreten.", "W0f0OUL", "#Kreski zostan", " znova./Pri sp", "#Je r", ": 0x%x]GUne erreur inattendue s", "tg-Cyrl-TJ", "gek k", "sim Windows.", "ya al", "av in funkcij sistema Windows 10 ne moremo namestiti v ra", ": %1!d!%%7", "trznego urz", "ny percig is eltarthat.eCsatlakoztassa a g", "n mappen H", "&Windows Server 2019 ", "RW0f0D0~0Y0V", "m sa aplik", "CSetupResponsSelectWebDownloadImage", "lv-LV", "Status", "je esantys failai bus panaikinti. Jei norite palikti ", "e ponovo da pokrene ra", ";(;4;@;L;X;d;p;|;", "Operazioni preliminari in corso", "n de Windows 10_No se pudo abrir el uso de almacenamiento. Abre manualmente tu configuraci", " GB 3. ", "Estamos a fazer alguns preparativos", "m Kutusu'nu manuel olarak a", "===Z=", " sistema:", "riel avanc", "&Fermer)Nous n", "_gov{~~Q", "m zjistit, jestli Windows 10 na va", "rente), vous aurez besoin d", "Transfer", "U[KMA", "&Annulla", "perny", "chr-Cher", "dt til at g", "to, ale budete muset svoje informace pozd", ".2USB ", "n distinta), necesitar", "ite vanjski ure", "rskenduse l", "Lemezk", "Ava pr", " tiks aiztur", ".rdata", "tte installationen af Windows. Genstart installationsprogrammet for at pr", " online para baixar atualiza", "N2QX[MOn", " do nasleduj", "]\\*!_\\D:", "[~ss3_X", "Applicable notices and licence terms", "Yu Gothic UI", "eHomeEdition", "lem biraz zaman alabilir./Kurulum program", "sim no iepriek", "Licensbetingelser", "rios %1!d! GB de espa", "cie vlo", "Not at the moment", "ppp@@@000", "Hvis Windows 10 allerede er installert og aktivert p", "R`f<<<@)", "dik! Folytassa a telep", "Continu", "De nieuwste versie van Windows downloaden", "e nastavenia aktualiz", "01SF&", " versiune pentru a continua.BDesc", "ujete Windows 7 ili Windows 8.1. ili ponovo instalirate Windows 10, nije vam potrebna ", "ywasz po", "Kreni ispo", "pet k", "Przygotowywanie %d%%", "cuter l", "RtlFreeHeap", "erli bir karakter de", "ouverture du graveur de DVD. Gravez manuellement le fichier ISO sur un DVD ", "CInstallUI::ShowPage: Cancel is requested. Returning ERROR_REQUEST_ABORTED", "Gata de instalare", "ite da biste uklonili tu stavku s popisa.iNai", "Das Laufwerk, das Sie verwenden m", "1D1d1|1", "+***,", "s ativaremos o Windows.", " diegimas nepavyko", "#Elementele care v", "5'6.64696E6V6j6", "paration de l'installation ", "eW[g0Y0", "0L0B0", "ievada.", "es, drivers e recursos opcionais. Essas atualiza", ", da nadaljujete namestitev.", " BitLocker fonctionne! Continuez lorsque vous serez pr", "fr-BE", "site v", ", paleiskite s", "mmer och f", " tietokone uudelleen valitsemalla OK.", "ga nedarbojas ", "Crea supporti di installazione (unit", "\\j0D0_0", "hren Sie ", "Sprog", " da biste ponovo pokrenuli ra", "s(Wn0", " USB, kartica SD ali zunanji trdi disk, da za", "l, a t", "my zainstalowa", "kta p", "n actual de Windows, tendr", "%d%% er fuldf", "en Sie alle ge", "3\"4z4", "ct, jestli je v", "Selecciona la partici", ": %1!d!%%>", "-N Rd", "Unesite klju", "digo de Erro: 0x%x]5A instala", "rer scripts til udrulning af failure.cmd", "jak takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXGNe", "pne DVD-brenneren. Du kan brenne ISO-filen til en DVD manuelt ved ", "ratlemine2Installiprogrammil nurjus tootev", " lista", "rskendamist ostma Windows 10 aktiveerimiseks Windows 10 tootev", "o conseguimos localizar as informa", "ciu dokon", "za Windows 10", "uriranje, moramo da uradimo jo", "s nem folytathat", "S&torno", " za Bitlocker", "kkelverdien for gruppe %d er ugyldig. Skriv inn riktig n", "%c:[Votre PC va red", "CDlpResponseImpl > > >::CheckUserInterrupt", ", mit", "r du have pc'en hos dig, indtil du logger p", "izdanja se ne podudaraju", "o mais antigos do Windows 10. Podemos ajudar voc", "727O7l7", "o aplicou os dados de migra", "Selecciona la imagen que quieres instalar.", "Installazione di Windows 10", "buj inny klucz.=Klucz produktu dzia", "nD\"a;", "v2QX[@SAm", " v e-mailovom potvrden", "i licencni ugovor.", ";0;k;r;x;", "344p4", "%1!ld!%%", "i Continuare,Alege", ", a d", "Wird vorbereitet (%d%%)", "sta,Pot", "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp(", "ra %1!s! p", "re having trouble determining if Windows 10 is ready for your PC yet. Please close Setup and try again.&Windows 10 isn", "ation d", "Cheia de produs ar trebui s", "yor/precommit.cmd da", "zk", "\"A'Y0", "Tai gali trukti kelias minutes.QPrijungdami kompiuter", "10J0b0", "<1 > > >::Cancel", "Vanjski ure", "rulay", ".?AVCSetupResponsePageDU@@", "l.ZProbl", ". Compru", "ko versiju.", " nytt.1Det oppsto et problem med ", "t install the latest Windows 10 features and security improvements on your PC due to low disk space. Follow the instructions below to complete the update.'Free up %1!s! on your PC (%2!c!: drive)ESelect or connect an external storage device with at least %1!s! free%Dispositivo de almacenamiento externo", "nda datorn som vanligt.JInstallationen misslyckades i fasen %1!s! med ett fel under ", "8&9<9C9L9V9f9q9", "M5%Cy", "de-LI", "nstalleerd en geactiveerd op deze pc, en u voert de installatie opnieuw uit, dan kunt u deze stap overslaan. Windows zal automatisch worden geactiveerd nadat de installatie is voltooid.", "emo instalacione datoteke za Windows. Ubacite medijum sa instalacijom operativnog sistema Windows i pokrenite datoteku ", "Za&mknij'Komputer zostanie za chwil", "A telep", "hma %d v", "t dit Windows-installationsmedie, og k", "installation de Windows Server 2019. - Better accuracy or clarityLNous poursuivrons l", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@@@", "%1!s! %2!s!4Un probl", " %2!c!:.pIf you want to install Windows 10 on another partition, you need to create and then run the media to install it. Feel free to keep using your PC.OThe installation failed in the %1!s! phase with an error during %2!s! operation", "Nezachov", "ChhH\"", "imu online, aby mohl na", "rm-CH", ";cq1od-K3", "Finner ikke Windows-installasjonsfiler. Sett inn Windows-installasjonsmediet og kj", " katkaise virtaa tietokoneesta", "u adresi ziyaret edin: %1!s!", "%1!ld! %% fullf", "elim da koristim spolja", "lem biraz zaman alabilir.gWindows 10 i", "uga automat.Instalarea nu a ", "KERNEL32.dll", "li naj", ".!0*Y", "o de privacidade", "ili.&Na tomto po", "i Cur", " komputera.", "t (alebo in", " possibile installare i miglioramenti di sicurezza e le funzionalit", "i toate programele deschise, apoi reporni", ":#:,:5:K:g:v:", "Provjera kompatibilnosti", "klemeniz gerekebilir.&", "Estas atualiza", "N;RU_0R ", "s grabar el archivo ISO en un DVD m", " remov", " jour et des fichiers suppl", "m Windows nen", "Il codice Product Key ", "sents sur le support d'installation. Si vous n'installez pas ces mises ", "s argument", "hrung im S Modus ausgelegt ist.^Der USB-Speicherstick muss mindestens %1!d! GB aufweisen. W", "t Windows Server 2019 vietn", "b, w zale", "ra Windows Server 2019", "5$5e5o5", "m aktivujeme automaticky po dokon", "sstZsst", " aj na", "renginys", "CDlpResponseImpl > > >::SetResponseName", "Valmistellaan asennusta ", "ili. Osvje", "o sabemos o que aconteceu, mas n", "te instalarea Windows 10", "M>B~1", "9A9H9O9", "o. Se voc", "Privacy statement", "ynnistyy uudelleen useita kertoja. T", "hendust luua. Veenduge, et teil on ", "Ta operacja pobierania w tle mo", " Microsoft Corporation. Med enerett.", "mu Windows 10 instal", " dysk", "_ck(WP}_g", "o no Windows Server 2019. Para ajudar a proteger os seus dados, deve manter o PC consigo at", "n.2Seuraavassa on kertaus siit", "sv-SE", "Vent, indtil app", "CreateReportFromFile", "unaru, potrebno je da unesete va", "s different from the one you", ". Ustvarjanje medija za Windows 10'", "*g(Wdk5u", "i papildu l", "FveDetectTelemetry", "Vol&tooien", "s la clave de producto en la caja en la que ven", "szXEz a term", "t find the Licence Agreement.", "'`L0B0", "pen. Adja meg al", "rbereder %d%%", "r de senaste filerna och kan installera den senaste versionen av Windows 10.", "hi{m!w", "T$(+T$ +D$", "Actualizar la lista de unidades", "Preuzimanje izdanja Windows 10", "3g4n4", "cie v", "-besturingssysteem", "tte med dette valg?", "ipravuje se %d%%.", " vite f", "IsValidLocale", "Instalarea Windows va trece online pentru a ob", "tJa v", "k igen.", "diet k", "Extern opslagapparaat", "eno %1!ld!%%", "installation et activer Windows, puis red", "FFdlVFV", "- DVD", "lne s", "vel encontrar o Contrato de Licen", "anas programmas restart", "z, ge", "a, sair", "ifriran je pomo", "teni a Windows 10-et, el", "lD!(Jw", "Architectuur", "chargementsSSupprimez les fichiers volumineux ou inutilis", "Scegliere l'operazione da effettuare", "ci, co si", " riuscito ad applicare i dati della migrazioneK>W>_>w>", ". Windows 10", "LockResource", "0?Y$A0", "Exist", ">->V>o>{>", "jes automatisk:Installationsprogrammet kan ikke indl", "? ?$?No", "shoz v", "czysz si", "nyes Windows 10-term", "i upgrade acum acestui PC", " extern", "Odmah nadogradi ovaj PC", "CInstallUI::GetHelpResourcesLocation", "Depolama Ayarlar", "cijas k", "enje skripti za uvo", " automaticky\"K", "Manter s", "C0^0v0", "ng dina filer innan du b", "n para poder continuar con la instalaci", ", nes pasirinkote diegti ", " scripturile de implementare failure.cmd,Aceast", "Se stai installando per la prima volta Windows 10 in questo PC, devi immettere un codice Product Key valido di Windows 10.", "229879+4583620", "emo informacije o instalaciji potrebne za nastavak instalacije operativnog sistema Windows. Ponovo pokrenite instalaciju da biste probali ponovo.kInstalacioni program ne mo", "torom syst", " versijos naujinim", ".?AV?$CZeroInit@VCSetupResponsePageCompat@@$00@@", "yj zalecanych opcji dla tego komputera", "Endre hvordan installasjonsprogrammet for Windows laster ned oppdateringer", "Ennen p", "avate da instalirate stariju verziju operativnog sistema Windows.", "grehajt", "(Condizioni di Licenza software Microsoft$Informativa sulla privacy di Windows", "nden kendiniz ke", "&Annuller", "RhVPA", "cie %1!s!.", "ia BitLocker va fi suspendat", "]WY(u", "cie sa vykon", "ati.FVse bo izbrisano, vklju", ". Windows nepreform", "jo kr", ": %1!d!%%!Ceci peut durer quelques minutes.", "/Windows Server 2019 isn't ready for this PC yet", "Mimari", "Actualizaciones aplicadas\"No hay actualizaciones disponibles", "lne v Nastaveniach./Nepodarilo sa otvori", "4#454A4Q4h4", "o e manter as suas defini", "lieties citu disku un m", "rgmisena aitame teil vabastada %1!s! %2!c!: kettal.", "ojumi un licences nosac", " to nieko", "ppp@@@", "aide de %1!s!.", "nt az eszk", "mai Windows ir nepiecie", "Ak chcete pokra", "01080M0W0u0", "ksuste eemaldamiseks s", "nybe.", "Vi kan ikke finde de installationsoplysninger, der skal bruges for at forts", "r S-l", "kok-IN", " 4 GB eller mere (kan variere), og du skal muligvis betale gebyr for internetadgangen. Klik p", "CInstallUI::Quit: Posted MSG_INSTALLUI_FORCE_QUIT", "zdeki dosyalar silinecek. Bu dosyalar", " a nastaven", "$Baixar a ", "i Windows pe un PC proiectat pentru a se func", "Der gik noget galtVHvis du vil installere Windows 10, skal du klikke p", " igen.*Vi kan ikke installere Windows Server 2019qVi har tilbagef", "erli Windows s", "tfen Kurulum", " problem podczas uruchamiania skrypt", "1 1-161D1O1a1l1u1", "Cambiar los elementos que se van a conservar", "rskatiet inform", "r det ", "im kullanmaya devam etmek istiyor musunuz?", "nchid", "20201009101141Z0w0=", "kkelen virket ikke. Pr", "ru anahtar", "2)2H2g2", " systemu Windows.", "ned ettevalmistused,See t", " em cobran", "Utilisez les options recommand", "ver f", " od korisni", " e riprova.", "en-ZW", "sst]vvw", "i kui installite Windows 10 uuesti, pole teil vaja tootev", "Select a path", "CInstallUI::CreateWizardUI", "in, depolama alan", " bruke dette valget?", "SetupDiGetDeviceRegistryPropertyW", "CSetupResponsePageDiskSpaceReq::OnToggleViewLinkClicked", "rii spa", "Windows 10 installimine nurjus", "This may take a few minutes.VPlug in your PC to be sure that your battery doesn't run down during the installation.", "Las actualizaciones se instalaron, pero el programa de instalaci", "tkake, kui olete valmis.", "W0j0O0j0", " in grado di determinare la versione di Windows in uso.,L'installazione di Windows 10 non ", "sikat.", "t Windows Server 2019. M", "i sa v PC d", "t, z. B. einen USB-Stick, eine SD-Karte oder eine externe Festplatte, um die Festplatte vor", "?)?/?H?P?U?_?w?", "prava na sta", "tzm-Tfng-MA", "eHeW[&{", "9<:H:T:]:e:w:", "chten Sie vorgehen?", " %2!s! livre(s)", "Microsoft JhengHei", "mprosp", " modifikuota arba pa", "No apagues el equipo", "zP~UUUUUUUHUHHHHGHG%%$", "imu S. Tuto edici zvolte jen v p", "cs-CZ", "=G[QLKC", "O(u\"u", "&Otka", "ljivost", "kilo problema vykdant preinstall.cmd scenarijus.1I", "YRRRB/", "`f03b", "8Windows 10 uusima versiooni allalaadimiseks valmistumine", ".-Poczekaj na zako", "ekilde tasarlanm", "Otvori postavke pohrane", "4:5S5", "We noticed you have older installation files for Windows 10. We can help you get the latest files to make sure you install the most recent version of Windows 10.", "o desta edi", "F!NL=", " joitakin minuutteja.XKytke tietokone verkkovirtaan, jotta varmistat, ettei akun virta lopu asennuksen aikana.", "ll continue installing Windows 10 in Windows Update.SConfiguring update for Windows 10", "5DQty", "Lai turpin", "e najti. Vstavite namestitveni medij za Windows in za", ", miten Windowsin asennus lataa p", "rvalda j", "ovat tam, kde jsme skon", "tmele vastav Windowsi v", "Se continuar sem ativar a sua vers", "0S0h0L0", "Opdateringerne er installeret, men Windows 10 Installation skal genstartes, for at de virker. N", "Parti", "Upgrade this PC now", "taluje.", " zainstalowanej wersji systemu Windows..Instalacja systemu Windows 10 nie powiod", "ywany", "ria po", "o do Windows. Experimente outra chave.ZEsta chave de produto (Product Key) n", "Perkeliami parametrai %d%%", ";? > > >::GetResponseName", " administratorseLai izmantotu ", "D$d$N", "&RechazarBSi no aceptas los t", "rio n", "ci od urz", " pronto;Continuaremos a instala", "Buh_[S", "Deze code controlerenKDeze code werkt niet voor deze editie van Windows. Probeer een andere code.ODeze productcode werkt niet. Voer de code opnieuw in die u online hebt gekocht.", "5\\VJ;", "line geri getirdik.EWindows Update i", "@t VW", "GlobalLock", "Dispositif de stockage externe", "7*d(5", "`/f,{", "ration peut prendre plusieurs minutes.", "&Indietro", " ir saugos patobulinim", ", kuri", "re trying to install an older version of Windows.kThe drive you", "WPPPPj", " durante esta actualizaci", " du opprette og deretter kj", " recente di questo strumento. Devi scaricare ed eseguire la versione pi", "Arkkitehtuuri ei t", "Moving your settings (%d%%)", "le minna Windows 7 v", "Velg bildet du vil installere.", "o funcionou. Insira novamente a chave que voc", "j0^9u", "anje sistema Windows 10HRa", "s diegti skland", "ico sistema Windows 10", " folderu Pobrane. Otw", "sto pro aktualizaci.", "einstalaci Windows 10, nebudete k", "Preverjanje prenosa'Izberite, kateri medij ", "let. Szabad", "Nem egyezik az architekt", " tulee n", "! Continua", "Brak etykiety", "t asiat", "i la Windows Server 2019. Pentru a v", "Kurulum kapanmadan ", "R!s4Z", "ke za k", "SetCursor", "val ideiglenesen kib", "Nu putem continua din cauza unuia din urm", "USB-flash-enhet", "rias vezes. Este processo pode levar algum tempo.:Espere um pouco enquanto a configura", "hren f", "list k", "CLinkButton", "et-EE", "o desta ferramenta", "zykowej lub architektury nie jest dost", ".9Atlaisvinkite %1!s! kompiuteryje (%2!c!: loginiame diske)^Pasirinkite arba prijunkite i", "bo-CN", " ficheiros pessoais", "D$hSVW", " jour. Windows ne reformatera pas votre dispositif de stockage externe et vous pourrez le retirer une fois l'installation termin", "Aktualisie&ren", "i Windows 10 nepob", "s architekt", "GetWindowLongW", "re dette for deg. Oppdater listen og pr", "668888383#&", "ka bir kaydetme konumuna yedekleyin.", " ikkuna sulkeutuu automaattisesti %1!d! minuutin kuluttua.$Ennen aloittamista tiedett", "Otvori", "let-haszn", "n vannak. Ha most nem telep", "tevajte to:", "te v po", " possibile determinare ancora se Windows Server 2019 ", "Windows non ", "Tilaa tarvitaan lis", "%d characters left\"Dashes will be added automatically,The product key only contains 25 characters.", "PPPPV", "esouvaj", " demorar alguns minutos.", "Group %d key value is invalid, please input correct key2", "n o ejecuta ", "$Izmantot vec", "lj enhet", "oJazyk alebo vydanie verzie Windowsu, ktor", "0k0o0pe", "Taikomi prane", "pne nedlastinger", "N{vU_", "dPlease remove the following external drive, click OK to reboot and complete installing Windows.", "CInstallUI::ShowRollbackMsg", " continuata l'installazione di Windows Server 2019 in Windows Update.", "PL0g0M0f0D0", "r datorn och du installerar om det kan du hoppa ", "es pour ce PC", "slaic", "mu programu se nepovedlo ov", " nem tudta t", "Uso de Armazenamento`Explore manualmente seu uso de armazenamento em configura", "SgqW0f0O0`0U0D0:", "cuter Windows 10", "e Windows 10 v ta ra", "UuidToStringW", "o diferente), ter", "n ve yeniden ba", "dR)$\\", "CDlpResponseImpl > > >::CheckInitialized", "espace de stockage externe+Je ne veux pas utiliser le stockage externe", "Consulte m", "hemalt %1!s! vaba ruumi", "kkulcs t", "wwwwwwwwwwwwwwwwp", "RhV-N", " installer Windows Server", "La protection BitLocker va ", "r du ansluter till Internet aktiverar vi Windows ", "h2;Q/", "lja telep", "n de la versi", " soubory Windows. Vlo", "Dette kan ta en liten stund.", "es de atualiza", " parametry p", "torul", "Chci pou", " zariadenie", "bs-Cyrl-BA", " continue. Revizui", "o e retomada quando iniciar sess", "gs dialoga ID%M", "%s, DLPLOG: [0x%X] [%s] [%s]", "tzm-Latn-DZ", "da.!Instala", "En az %1!d! GB olmas", "kat, ", "e utvrditi da li je ra", "Nessuno", "j ikke underst", "Lue t", "uZSW3", "2019 est d", "p Windows", "iului de stocare`Explora", "Mer informasjon", "939N9g9}9", "Please read this so you know what you", " Windows Server 2019[", " nota, ma non ", "6(7d7", "YKNMR", "tovan", "emy kontynuowa", " sa re", "i mai multe", "o pode atualizar seu computadorjEsta ferramenta n", "ete s internetom, aktivirat ", "rii Windows", "RtlNtStatusToDosErrorNoTeb", "rio de raiz do seu suporte de dados de instala", "w~~xp", "No se puede continuar por uno de los motivos siguientes:", "Unesite Bitlocker klju", "Selecteer de installatiekopie die u wilt installeren.", "]Ihr Downloads-Ordner konnte nicht ge", "labilir. Bir ", " Windows Server 2019*", "0~0Y0", "`1XL0", "''63>DD6", "jlokat tartalmaznak, amelyek nem a telep", "klemesi otomatik olarak devam edecek.", "logo no v", "ra sa m", "nnen Sie Ihren PC nicht verwenden. Speichern und schlie", "st hj", " Microsoft Corporation. Tous droits r", " zariadenie a po dokon", "Nous n", "e potrwa", "elite u", "alintum", "%s GBiNe", " nefunguje. Vyzkou", " bitlocker klju", "s4A telep", "&Weiter Windows Server 2019 installieren'Dieser Vorgang kann einige Zeit dauern.oDas Update f", "@k\\\"E", "nt a f", "ar-TN", "nl-NL", "ttu ei saa teie arvutisse installida Windows 10 uusimaid funktsioone ja turbet", "enite namestitveni program in ", "ngelig, hvis du har aktiveret en kopi af Windows 7 eller Windows 8.1, der er installeret p", "u klju", "GetSysColorBrush", " Windows Server 20192", "i lista ", "ifru proizvoda za Windows 10 ili da napustite pode", "Dispozitiv de stocare extern", "3%3;3", "Az okokr", "ta diegti", "tiremezeBu ara", "Installerer Windows Server 2019", "o gratuita para o Windows 10 s", "Chave de produto (Product Key)", ",gS_k0B}", "essayer..L", "iniet uz Labi, lai palaistu atk", "5$505<5H5T5`5l5x5", "L$T_^[3", "te, jestli v", " jste si koupili DVD s Windows, nebo v e-mailu potvrzuj", " disponibile solo se nel tuo PC ", "-Nous n", " Microsoft2", "n fundal poate avea peste 4 GB (dimensiunea poate varia) ", "iu-Cans-CA", " Windows 10 pentru a activa Windows 10 dup", "Voorbereiden %d%% Uw instellingen verplaatsen %d%%", " omat tiedostot ja sovellukset-S", "rique de stockage externe avec au moins %1!s! libres", "dzu, ievadiet Bitlocker atsl", "rii.'Cerin", "gldelld", "o mais recente", "ovat v instalaci, budete se muset pod", "hteit", "rankio versija. Norint t", "ce Twojej uwagi", "stroje Bitlocker", "en til den tilstand, den havde, lige f", "o novamente.", " quer manter ", "na uruchomi", "SF)Cg", " iba na prid", "buj ponownie.6Wyst", "sk-SK", " program.'Kontrola dostato", "ilebilir oldu", "HPriprema za preuzimanje najnovije verzije operativnog sistema Windows 10#Ovo mo", ")X&2c", "Schakel de computer niet uit", " attivato automaticamente.", "iau mums nepavyko paleisti ", "es-CO", " va trebui s", "hrt werden kann. Schlie", "nda teise sektsiooni, tuleb selle installimiseks luua kandja ja siis see k", "io kompiuterio versij", "i a finaliza instalarea Windows.", "ren). Mogelijk brengt uw internetprovider kosten in rekening. Klik op Volgende om de nieuwste installatiebestanden te downloaden.", "5?5d5y5", "Miksi t", " %2!s! frei", "e enkrat poskusite.", "ate namestitev sistema Windows.", "n jelenlegi nyelv", "o, voc", "$Iprr", " parengta", "be en produktn", "Kontroller kompatibilitet", "N SOBRE LA INSTALACI", " Windows. Elle ne peut pas ", "7(7H7X7|7", "ltse le a leg", ".?AV?$CSetupObject@VCSetupUIManager@@VISetupUIManager@@@@", "ft Zu verwendendes Medium ausw", "unalnik, ker je na disku premalo prostora. Spodaj sprostite nekaj prostora in nato izberite ", " k dispozici pro v", "_vsnwprintf", "i manual fi", " nam uruchomi", "&Zako", ":.;>;N;^;p;", "vel determinar se o PC tem espa", "PostMessageW", " recente di Windows", "De updates worden ge", " tu %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml.d", "%Fehlercode: 0x%1!lX! - 0x%2!lX!", "Depolama Alan", "tica de privacidade", "n automaattisesti tukijakson aikana. Tuki saattaa vaihdella laitteittain.", "hem obdob", "s saugyklos", "mu programu se nepovedlo pou", " Windows, osobn", ",Microsoft programmat", "essayez.5Windows 10 n'est pas encore pr", "A=6S0J", "\"\"cLt", "en-029", "ste to znova.'In", "mplat cevaXPentru a instala Windows 10, face", " funkce (doporu", "kkal kell bejelentkeznie a Windowsba.%Az ISO-f", "m na polo", "CH_Uz", " preinstall.cmd0", " chave do produto (Product Key) que voc", "r olup olmad", " preinstall.cmd-", "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X", "ovom adres", "Aucune mise ", "Error reporting telemetry for bHasExtSpace: [0x%X]", "d Product Key funguje. Ke", "tilo do stavu, v akom bolo pred spusten", "Hr,g(W`O", "hrend dieses Updates angehalten und erst fortgesetzt, wenn Sie sich bei Windows Server 2019 anmelden. Zum Schutz Ihrer Daten sollten Sie den PC bis zur erneuten Anmeldung nicht unbeaufsichtigt lassen.4Windows Server 2019 konnte nicht installiert werden.", "nda datorn medan Windows installeras. Spara och st", "i samo osobne datoteke", "tkamiseks peate uusima versiooni alla laadima ja k", "nione. Naci", "Ezt a g", "quc-Latn-GT", "riist ei toeta teie praegusesse arvutisse installitud Windowsi versiooni keelt v", "%c: ku", "CRichEditCtrlEx", "CSetupResponsePageCompat::OnInitDialog", "f(Wdk", "Velg spr", "%2!s!8Organisasjonen administrerer oppdateringsinnstillingene.", "rile.", "Nadaljuj", "Lataa p", " na pokra", " tu PC para que se ejecute en modo S. Elige esta edici", "Este disponibil", " %2!c!:)X", "Kui installite Windows 10 sellesse arvutisse esimest korda, peate sisestama kehtiva Windows 10 tootev", "ej verzie Windowsu 10", " i zachowa", "0zzk0W0f0", "Nimic%Ve", "kite Gerai, kad paleistum", "ati datoteke, aplikacije i postavke jer ste odlu", " instalare ", "0MRn0", " preciso reiniciar a Configura", "mu programu se nepovedlo spustit instalaci Windows. Restartujte instala", "Ak budete pokra", "re nie znajduj", "ul de reciclare pentru a elimina fi", "hoz. Pr", "e mus", " &Ich m", "Ha most el", " Windows Server 2019$T", "d Product Key byste m", "lectionnez Actualiser.", "jas:Uzst", "ie de Windows diferit", "mas. Ne pare r", "to je potrebno sljede", "ana b", "bne programmer, og genstart derefter computeren. Installationen af Windows forts", "Siirret", "jWZa`", " na va", " grunn av for lite diskplass. Frigj", "t SSSj", "res restants", " ni bilo mogo", "af-ZA", "s inicializ", "paration : %d%%", "Windows Setup wird Updates, Treiber und optionale Features online abrufen. Diese Updates helfen bei der reibungslosen Installation und k", "t datoru. Aizveriet visas atv", " a spusti", "ssen m", "1Saglab", ";>;;;", "&ustu", " listesini yenile", " din dator p", "Diskpartisjon", " cihaz s", "ju un p", " je aktu", "jlokat, az alkalmaz", "Sans nom", "autres t", "Ng0B0", "nta3Det var problem med att k", "Besplatno a", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "n. Revisa la informaci", "49^pt", " program a zkuste to znovu.0Syst", "tes-vous certain?", " bez aktywowania aktualnej wersji systemu Windows, musisz kupi", "041404B0", "elim pridonijeti pobolj", "c.%Jak", "/@8$A0", "KLEME B", ">(>4>@>L>X>d>p>|>", "essayez ou tentez d", "Vyskytla sa chybaKWindows 10 nain", "espace et r", "K%tww!", "eX[n0_j", "Arquivo ISO", "s az al", "Lamentablemente, estamos teniendo problemas para determinar si el equipo puede ejecutar Windows 10. Cierra el programa de instalaci", ".rsrc$01", "dos! Pressione Continuar9Escolha um dispositivo de armazenamento externo diferente", "0,0I0P0V0[0i0s0x0", "Der Schl", "installer %1!s! qui utilise une langue diff", "emo utvrditi je li va", " o utiliza", "fr-CH", "bor treba nesk", " riuscito a caricare le risorse della linguaSIl programma di installazione non ", "Kahjuks ilmnes probleem Windows Server 2019 valmiduse kontrollimisel teie arvuti jaoks. Sulgege installiprogramm ja proovige uuesti.(Windows pole selles arvutis aktiveeritud", "Nenhum", "s autom", "Downloader Windows 10", "Ochrana ", "KV@=1d", "Nn0'YM0j0", "rki on j", "ATento k", "tirilecek; destek cihaza g", "m spr", "Invalid Dialogue ID'We couldn", "vaketast v", "cie by ste mali venova", "enje, nato pa se bo zaprl", "Act&ualiser", "(%1!c!:) - %2!s! liber", " noklik", "e biti dodate automatski'", "hedal, kuni j", "es-CU", ": %1!d!%%&", "mtade filer.", ".?AV_AFX_DLL_MODULE_STATE@@", "ta-IN", "uriranja, upravlja", "ti.%Kokios yra kitos naujinimo parinktys?", "i instruc", "Vyberte, co chcete zachovat", "Instalar %sDO Windows est", "anie instalatora, aktywowa", "marrer le programme d'installation.", "Comprobando el equipo", " ir paleiskite ", "DownloadsMEntfernen Sie gro", "#QR(+", ") a m", "una./Morat ", "Sprache:", "Tady je p", "ADD_PROVISIONING_PACKAGE", "sti d", "ng installationsprogrammet och f", "CDlpResponseImpl > > >::CheckUserInterrupt", "Productcode invoeren", "uz-Cyrl", " 2012 Microsoft Corporation. All Rights Reserved.SetupRegularVersion 1.06http://www.microsoft.com/typography/fonts/You may use this font as permitted by the EULA for the product in which this font is included to display and print content. You may only (i) embed this font in content as permitted by the embedding restrictions included in this font; and (ii) temporarily download this font to a printer or other output device to help print content.", "bbletk", "Installi %s5Installimise j", "ite popis i poku", "Oba`Ta klju", "Microsoft JhengHei Bold", " Windowsin asetukset ja omat tiedostot", "(&R)c", "050N0k0", "`ck(W", "ta BitLocker aiztur", "x1iYk", "101`1", "Preuzimanje", " PC-ul(Ne asigur", "Nu momentan", "tfen a", "Wir haben Ihren PC in den Zustand zur", "qLa comprobaci", "klemeye devam etmek ve Windows ayarlar", "o reformatar", "jumsXNeizdev", "%1!s! %2!s!\"There was a problem creating mediazThe edition of Windows that matches the product key you entered isn", "L$ ;C8", "69-=IImWImWHWh", "ttes ikke av dette verkt", "(Fpy_", ":F;y;", "z veya Windows 10", "n veya y", "sa DVD-re", "?:?S?o?", "0g0W0_0$", "ovat bez aktivace aktu", "klemesi ba", "rgmistest p", "Juridisk", "re done and what to do next. This window will automatically close in %1!d! minutes.", "patur", "Kurulum haz", "040604B0", "ntalo con otra clave distinta o compra una clave nueva.", "ili, da %1!s! namestite v jeziku, ki ni enak temu, ki ga uporabljate sedaj.", "o do Windows 10", "Verwijder het volgende externe station en klik op OK om de pc opnieuw op te starten en de installatie van Windows te voltooien.", "Codice Product Key", " actualizarea pentru Windows 10", "s, contrairement ", "l||||", "261019185142Z0", "Laufwerkauswahl", "o temos a certeza do que aconteceu, mas n", " ce se termin", "n solo si instalas Windows en un equipo dise", "PripremaQOvo ste ve", "#Tem certeza de que deseja encerrar?", "@Meiryo UI", "kai,Produkto kodas sudarytas tik i", "lisseadet (nt USB-m", "=E=U=", "CSetupResponsePageBitLockerKeyValidate::OnOSKBtnClicked", "ani direktorij ili poku", "l.?A preinstall.cmd k", "zykowych2Instalator nie mo", "i din nou.,Windows 10 nu este ", "o precisar", "n de privacidad", "W0j0D0", "nce bilinmesi gerekenlerr", " datorn", "ave pri izvajanju skriptov preinstall.cmd.9Pri", "t work. Try a different key.", "toarelor aspecte pentru a continua instalarea ", " zdroje in", "s pabeigta, m", "Ladda ned den senaste versionensDet finns en nyare version av verktyget. Du m", "to varira) i mogu", "zSi vous souhaitez installer Windows 10 sur une autre partition, vous devrez cr", "lpa dig s", "eCSetupResponsePageBitLockerKeyValidate::OnBitLockerKeyEditUpdated", "ige v", "Hvis du installerer denne utgaven av Windows 10, konfigureres PC-en din til ", ".rdata$zETW2", "iniz b", "nit, co se m", "liorer l", "Architektur", "Cambiar la forma en que el programa de instalaci", "jjk`jjk%", "RW0~0Y0", "l4a2M ", "lg, hvilket medie du vil bruge", ".?AV?$CZeroInit@VCSetupResponsePageDiskPartition@@$00@@", "Palun oodake4Preinstall.cmd skriptide k", ".6Pobierz zaktualizowane Narz", ".?AV?$CZeroInit@VCSetupResponsePageProductKeyValidate@@$00@@", "Diegimo laikmenos (USB ", "o pripravujeme", "s probl", "i Windows postavke i li", " disk je spreman", "idlo OK.", "tta.cWindows 10 v", "uga caracteristici la Windows. Nu se poate utiliza pentru a instala Windows.", " tietokone nyt", "Kontrollerar datorn+Kontrollerar om installationen kan p", "velkite informacij", "Installerar Windows 10CDatorn kommer att startas om flera g", " ir maz vietas. Atbr", "Saklanacaklar", "jot pa", "&Nepavyko rasti USB ", "Sto controllando il PC:Sto verificando se il sistema ", "Stvaranje medija za Windows 10'Slobodno nastavite s kori", "n instaladas, pero el programa de instalaci", " %c:JKomputer zostanie uruchomiony ponownie kilka razy. Mo", "Sljede", "ti peaks asuma DVD karbil v", " comprar uma chave do produto ou licen", "gekkel j", "yQ^?%?", "FDelf", "s conectado a Internet e int", "s programmas un p", "oK0D$\"<", "anjem sistema Windows Server 2019.TNadaljevali bomo z name", "2019. Fermez le programme d", " despu", "eGali ", " dans la phase %1!s! avec une erreur lors de l", "%1!ld!%% conclu", "n para continuar la instalaci", " nuo ten, kur sustojome. Deja, tur", "UpdateWindow", " ja yrit", "jYWh(", "cijas failus", "Anwendbare Rechtshinweise und Lizenzbedingungen", "MediaCreationSuccess", "Ouvrir/Je souhaite plut", "=!=1=>=s=", "ovat na webu Windows Update.UKonfiguruje se aktualizace pro Windows 10.", "o tem espa", "RK0K0", " naujo ir baigtum", ",De nieuwste versie van Windows 10 downloaden", "rebilir.kWindows y", "CSetupResponsePageBitLockerKeyValidate::UpdateView", "ps-AF", "> >4>8><>@>H>\\>`>d>|>", " spravova", "Odota", "ndirmelerF", " -NKb", "obH\\`", ", ohjaimia ja valinnaisia ominaisuuksia", "BitLocker", "j verzi", "i.!Instalarea Windows 10 nu a reu", " de gravar o ficheiro ISO num DVD mais tarde.", " sur ce PC. Cela signifie que vous allez devoir entrer la cl", "0g01YWeW0~0W0_0", "anjem ne izprazni.", "pne papirkurven manuelt.KKan ikke ", " recusar os termos de licen", "GetSystemTimeAsFileTime", "rskendamiseks veel?", "teri deste", "ite praegu oma arvutit edasi kasutada.HInstallimine nurjus etapis \"%1!s!\"; t", "tzliche Dateien enthalten, die sich nicht auf dem Installationsmedium befinden. Wenn Sie diese Updates jetzt nicht installieren, funktioniert Ihr PC nach der Installation m", "4IKXY\\+", "tve, vagy ", "les iesp", "&Aizv", "nstalleerd vanwege onvoldoende schijfruimte. Volg de onderstaande instructies om de update te voltooien.)Maak %1!s! vrij op uw pc (station %2!c!:)PSelecteer of verbind een extern opslagapparaat met ten minste %1!s! vrije ruimte", "lj en annan enhet.", "ringsdata(Kan ikke rydde opp i installasjonsfilene5Kan ikke fastsl", "k/nj_", "0D1g1u1", "Image ausw", "e da biste uklonili izbrisane datoteke iz operacijskog sustava.", "tirmeleri indirme bi", " %1!d! GB.", "ado para funcionar en modo S.OLa unidad flash USB debe tener al menos %1!d! GB o m", "lva ezen a g", "kkel.0Produktn", "vamos solucionar esta quest", "lj en s", "t vec", "rut o problem", " asennusl", "Nu sunt disponibile actualiz", " asennusohjelma uudelleen.", "aduje sa %1!d! GB vo", " tuoteavain ei toimi. Kokeile toista avainta tai osta uusi avain.", " cheie nu va func", "s)A sz", "Pfad ausw", " deneyin veya yeni bir anahtar sat", "Configura", "CDlpResponseImpl > > >::Initialize", "=,>D>`>d>h>x>", "3?3H3c3", "i din nou.", "1FL&S", "4 4$4(4,4044484<4@4H4L4P4T4X4\\4`4d4h4l4p4", "re Windows 10", " %s?Syst", "Personvernerkl", "tare pentru a-l elimina din list", "claration de confidentialit", "pannage", "6)606>6E6X6", "Spoljni ure", "Doorgaan vanaf waar ik ben opgehouden", "O: alguns recursos do Windows 10 requerem hardware avan", "rgmine v", "nIDATx", "rcare", " estiver usando uma conex", ". Ja probl", " installere en eldre versjon av Windows.iStasjonen du pr", "=B=S=", "Hvis du forts", "0W0f0D0~0Y0", "Disse oppdateringene hjelper installasjonsprogrammet med ", "Pripremamo nekoliko stvari", "1Prenesite najnovej", "zh-MO", "ite datoteko ISO na DVD z orodjem %1!s!.", "&Opdater", "'bitlocker ", "stra.?Totul va fi ", "Spusti", " Microsoft Corporation. Sva prava pridr", ". Patikrinkite, ar esate prisijung", "a izdelka ne bo treba vnesti.", "CSetupLangIniLoader::Initialize: Set default install language = %s.", "installation de Windows. Sauvegardez et fermez vos fichiers avant de commencer.APatientez pendant que l", "mom Windows 10 m", "GetDiskFreeSpaceExW", "rene, afslutter du installationen.yVi har brug for mindst 350 MB plads for at kunne k", "lido. Introduzca una clave correcta8Introduzca la clave de BitLocker para el identificador: 2Windows necesita m", "cznie z plikami, aplikacjami i ustawieniami.", "|cY(d", "teva lucruri", " diegti", "Chave do Bitlocker", " usando Windows 10%L'operazione richieder", "ifra proizvoda za Windows 10.", " un error inesperado. Comprueba si tienes acceso a los or", "lisan a(z) %1!s! alkalmaz", "en Sie den PC an, um sicherzustellen, dass die Akkuladung f", "Si Windows", "elda, kas teie arvutis on Windows Server 2019 installi j", "i da ni", "luseadme maht peab olema v", "i computerul", "llapotba.BA Windows Server 2019 telep", " USB, SD ", ".?AV?$CZeroInit@VCSetupResponsePageBitLockerKeyValidate@@$00@@", "ri\"Se verific", "Lg ;M@c", "Varat turpin", "u kapat", "rbaude, vai nav atjaunin", "er un support d", "xCSetupResponsePageCompat::UpdateView", "1$?/CCCCCDDDCDC81", "klemek i", "Bu, birka", "Prohl", "a organizacija.", "WW~~~VVU~UUUUUO7G", "CInstallUI::ConfirmCanceled: User cancel aborted", "Sistem de operare Microsoft", "r du kobler til Internett, aktiverer vi Windows for deg. ", ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@", " que vous avez achet", "Kullan", "Wanneer u deze Windows 10-editie installeert, wordt uw pc zodanig geconfigureerd dat deze wordt uitgevoerd in de S-modus. Kies deze editie alleen als u Windows installeert op een pc die is ontworpen om te worden uitgevoerd in de S-modus.NHet USB-flashstation moet minimaal %1!d! GB zijn. Selecteer een ander station.!Download de meeste recente versie", "gen von Features zu Windows, nicht zum Installieren von Windows.", "ycia magazynu. Otw", "4#5@5X5v5", "kerhetskopiera dem till en annan plats nu.", " prov", "%WINDIR%\\System32\\OSK.EXE", "u pour fonctionner en mode S.YLa cl", "iausiai %1!d! GB. Pasirinkite kit", "dzie Oczyszczanie dysku.", "re all set7We", "z9P$j", "nSEl programa de instalaci", "o by ste mali vedie", "eli name", "Diegiamas ", "SelectDownloadImage", "ar desde o in", "dzia. Aby kontynuowa", "z gerekir./Bilgisayar", "0F0j0b_", "Veuillez patienterIUn probl", "tja a sz", " asennusohjelma uudelleen.pEmme pysty selvitt", "rifiez que les sources d", "dami bandyti dar kart", "g hely a Windows 10 telep", "n de Windows est", "Valmistellaan paria asiaa1T", "Unable to add selection for system drive", "2,2D2\\2t2", "Instaluje se Windows 10.=Po", " k hladk", " innego klucza.FKlucz funkcji BitLocker dzia", " %2!c!:.HWindows 10 ", " USB flash meghajt", "jot da", "rqr rqr", "pen+Folytatja a m", "Versio", "Avisos y t", "b pobierania aktualizacji przez Instalatora systemu Windows", "%4!s!'Sie sind jetzt zur Installation bereit.BWir setzen die Installation von Windows 10 in Windows Update fort.jDas Update f", "vel encontrar arquivos de instala", "unalnik pripravljen na nadaljevanje name", "Crte ", "tigt.6%1!d! GB freier Speicherplatz auf (%2!s!) erforderlich", "nker uppgradera fr", "netebileceksiniz.DAyarlar", "i o copie activat", "dia sa vyskytol probl", "ar a instalar o Windows Server 2019.DContinuaremos a instala", "https://go.microsoft.com/fwlink/?LinkId=530046", "Use an external device such as a USB key, SD card or external hard drive to temporarily extend your hard drive while the updates are being installed. Windows will not reformat your external storage device and you can remove it after installation is complete.%Requirements Complete! Press Continue*Choose a different external storage device", "e se te", "lreiz.", "Nastavi od mesta gde sam stao", "o eliminados. Para manter estes ficheiros, fa", "CDlpResponseImpl > > >::Initialize", "nstalleerd, maar werken pas nadat Windows 10 Setup opnieuw is gestart. Hierna wordt de installatie van de updates voltooid.0Windows 10 kan niet worden uitgevoerd op deze pc", "%1!s! %2!s!/A ap", "de determinar op", "Av&bryt", "WRjUZ", "CSetupResponseTemplate::InitializeRoutine", "nd se termin", "7%777@7I7S7a7}7", "de iniciar a instala", "s tarde.", " a desinstala", "hy-AM", "n prezent.", "s7mB$A", "$Tworzenie no", " %2!s! nezasedenega prostora", "re restant", " Windows Server 2019+", "ykite ir toliau naudokite savo kompiuter", "s atjaunin", "as lietas. Aizveriet ", "ati nastavitve, osebne datoteke ter aplikacije sistema Windows, morate urediti spodnje stvari.@", ",RMq1P/LFRSmEa4/CmRWv27h3qZgyBg9RgXKRVUGhFmQ=0Z", "O&sve", " naujo paleid", ".xdata$x", "Nieko nepalikti", "tkamiseks peaksite t", "t asemat", "These updates will help the installation go smoothly, and can include important fixes, updated device drivers, and additional files which are not on the installation media. If you don't install these updates now, your PC might not function properly after the installation, and you might need to reinstall some optional features and languages.!K", "s antes de actualizar. Te avisaremos cuando finalicemos y te indicaremos qu", "du Product Key nebude nutn", "ne datoteke i aplikacije, potrebno je da obratite pa", "Nevieme zisti", "181@1H1P1X1d1", "Lugege see l", "%1!s! %2!s!.Ocorreu um problema ao criar suportes de dados}A edi", "- Windows ", "lat d", "Instalator systemu Windows 10", "USB-muistitikku", "tietoja Windows Serverin p", " je Windows Server 2019 p", "elite li nastaviti s tim odabirom?", " sakla", "La arquitectura no coincide", "t a valid character", " dit aktuelle sprog og i den aktuelle arkitektur.", "Operating System:", "Selle taustal toimuva allalaadimise maht on umbes 4 GB (v", "10 pour la premi", ": https://aka.ms/windowsserverupgrade", " entrar no Windows 10. Para ajudar a proteger seus dados, mantenha seu computador com voc", ")A Windows 10 adathordoz", "USB zibatmi", ".text$x", "elite ohraniti", "&Lisensvilk", "4*4:4?4Y4", "Preuzmi a", "PRE_OOBE", "eHr,g", "sti stand", "VarFileInfo", " de Windows 10 sur votre PC en raison d'un espace disque insuffisant. Suivez les instructions ci-dessous pour terminer la mise ", "RoskakoriXTyhjent", "(%1!c!:): %2!s! libres", "enje diska", "cy format: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "IDATx", "ilitamiseks peaksite t", "a je naplata naknada za internetski pristup. Kliknite dalje da biste preuzeli najnovije instalacijske datoteke.", "o mais recente desta ferramenta. Tem de transferir e executar a vers", "ca-ES-valencia", "CSetupResponsePageBitLockerKeyValidate: OnMaxLengthExceeded", "re installasjonsprogrammet. Frigj", "jHhPA", "owo, a ponadto mo", "tat qu", ";USB ", "z yerden devam edece", "Iz nepoznatog razloga nije mogu", "B~s>w", "lt meg", "jiet datoru. Windows instal", "8&8Z8d8", "https://go.microsoft.com/fwlink/p/?LinkId=827166", "l(W`O", "s noteikt atbalst", "A Windows leg", "Viskas nustatyta.9Toliau diegiame ", "n, tienes que prestar atenci", " elementy do zachowania", " 350 MB voln", "nda 25 karakter bulunur.", "etko potrebn", "nergeleri izleyin.1Bilgisayar", "ni pogoji", "The following things need your attention to continue the installation and keep your Windows settings, personal files, and apps.FThe following things need your attention to continue the installation.]The bit locker looks similar to this: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX7The bit locker key only contains 48 digital characters.", "ZIt may take a few moments to check if what you want to keep is compatible with Windows 10.bThis product key can only be used to add features to Windows. It can", "042604B0", "ati svoje postavke sustava Windows, osobne datoteke i aplikacije.\\Sljede", "cie, ovl", "<5555", ", Windows Server 2019", "Use the recommended options for this PC", "2#3?3", "ndeKInstallera Windows 10 genom att klicka p", "en-HK", "nda den h", "CSetupResponseTemplate::ExecuteRoutine: Next button clicked.", "pppppp", "ranka2I", "ri, drivere ", "##########", " ett problem n", "s informaci", " innego klucza.XTen klucz produktu nie dzia", "SelectedImageIndex", "lacak yeterli alan yok. Ba", "6-6=6M6]6m6}6", "CDlpResponseImpl > > >::Suspend", "jra az interneten v", "n.%Libera %1!s! en tu PC (unidad %2!c!:)fSelecciona o conecta un dispositivo de almacenamiento externo con al menos %1!s! de espacio disponible", ":':8:>:P:W:d:j:~:", "@;&pj", "Anna BitLocker-avain", "te diegim", "O(uW0", "mu Windows prejde do re", "Abrir Descargas%Abrir Configuraci", "tu, l", "e chv", "paration au t", "i da instalacija pro", "Drive Selection%Setup is cleaning up before it closes", "te. System Windows 10 jest aktualizowany automatycznie w okresie ", "riist uuesti k", "vesti informacij", " ingyenes friss", " %1!d! GB. Vyberte jin", "%Error code: 0x%1!lX! - 0x%2!lX!", "9~ltFSWW", "BitLocker-beveiliging wordt onderbroken tijdens deze update en wordt hervat als u zich aanmeldt bij Windows 10. Houd de pc bij u totdat u zich weer aanmeldt, als u uw gegevens beter wilt beveiligen.'Hier volgt een overzicht van uw keuzes:", " pomocou ", " de Windows, va trebui s", "Conecta", "anas failusSUzst", "tirmeyi tamamlamak i", "rt jelenik meg ez?", "A&ggiorna", "o nos itens a seguir.SO bitlocker ", "e nekoliko minuta.", "RaiseFailFastException", " utiliser votre PC.UL", "o, e talvez seja necess", "0g0O0`0U0D0;", " Windows Server 2019.3", " repornire, vom continua de unde am r", "GTen klucz produktu nie dzia", " duomen", "ste to znova.=V ", "vceWPokud chcete pou", "fr-HT", "dajov, skontrolujte, ", "Deze pc nu bijwerken", ",%1!d! Gt vapaata levytilaa tarvitaan (%2!s!)", "au moins 350 Mo d", "ssen.", "tted ja rakendused kustutatakse, kuid failid s", "Select External Storage Device", "Precommit.cmd ", "anas datus=Uzst", "Skoro smo spremni", "tsen r", "t dig. ", "nker installera Windows 10 p", "s nem ", "042504B0", "GetTraceLoggerHandle", " bruke %1!s!.", "ebujeme aspo", "VFFD|vh", "MediaSetupUIMgr.dll", "Crtice ", "Washington1", "o ficar sem energia na bateria durante a instala", "lva ezen a PC-n.", "Setup doesn", "n bejelentkezik a Windows Server 2019-be. Az adatai biztons", "ldende meddelelser og licensvilk", " najnowsze pliki instalacyjne.", " kilka minut.", "ra diegimo laikmenoje. Jei dabar ne", "ite svoj pevn", ". Bandykite i", "titi privatnosti", "r%llu", "unalnik2Preverjamo, ali je vse pripravljeno za namestitev.", "Ecco alcuni elementi da tenere presente:", "Flytter innstillingene %d %%", "NTaj klju", " z nasleduj", " (%2!s!)g", "tani %1!s! helyet a(z) %2!c!: meghajt", "ljaannet.", "ket i eller utg", "%c:WKi", "alinkite ", "ey silinir.", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", " Internet, n", "_Puede tardar unos minutos en comprobar si lo que quieres mantener es compatible con Windows 10.yEsta clave de producto solo se puede usar para agregar caracter", "e funkcije so bile spremenjene ali odstranjene; sistem Windows 10 se v obdobju podpore samodejno posodablja; podpora se lahko razlikuje glede na napravo.", "Sign in as an administratorRTo use this tool, you must be signed in to Windows using an administrator account.0You'll need to burn the ISO file to a DVD later.", "Priprema instalacije ", "rnia egy ", "Skapar Windows 10-media,Du kan forts", "RW0_0", "ouverture de votre corbeille. Veuillez ouvrir manuellement votre corbeille.x", "g el kell int", "Muuta s", " sospesa durante questo aggiornamento e sar", "ilita midagi", "nlott)", "We noticed that you have older installation files for Windows 10. We can help you to get the latest files to make sure that you install the most recent version of Windows 10.", "installation de Windows. Vous devrez entrer ", "System operacyjny Microsoft", "elite za", "czenie internetowe i spr", "pIf you want to install Windows 10 on another partition, you need to create and then run the media to install it. Feel free to keep using your PC.OThe installation failed in the %1!s! phase with an error during %2!s! operation", "Diskdzi", "SVWj?[j", ", SD kart veya harici sabit s", "0?k$A0", "e obdr", "Windows Installation g", "se problemet, og k", "Notiek %d%% sagatavo", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "5#5h5", "o estamos a conseguir determinar se d", "ra. Det h", "CInstallUI::CInstallUIMessageWindow::SwitchToErrorPage", "vebb inform", " izdelka za Windows 10 ali zapreti namestitveni program, aktivirati Windows, nato pa znova zagnati namestitveni program.", "Baixando Windows 10", "lLe lecteur que vous essayez d", "SearchPathW", "&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz", "]w=;11", "tfen listeyi yenileyin ve yeniden deneyin.", " kompatibilitu", "Atidaryti atsisiuntimus", "n timpul instal", " uudelleen tai anna toinen avain.5BitLocker-avain toimii! Voit jatkaa, kun olet valmis.", "121H1^1", "Ugyldig dialogboks-ID", " fortsette.:Last ned det oppdaterte verkt", "tada ning on v", "o (pen drive, DVD ou arquivo ISO) para outro computador", "m Microsoft", "Progreso: %1!d!%%:Seleccione una de las opciones disponibles para continuar.", "0&0-0E0g0", "Kontrollerer n", " i rodmappen p", "sa in spr", "0\\Omi-Nn0", "cia instalacji systemu Windows 10.", "ene ili uklonjene. Windows 10 automatski se a", "t%jZW", "%3!s!3Ponowne uruchamianie Instalatora systemu Windows 10", " instal", "unalnik.LName", " a aceitar.", "ama vieta, lai atjaunin", "Hvis det er f", "s internetel", "ar.6Aguarde enquanto o aplicativo termina a desinstala", "steemi Windows 10 v", "yj starszych plik", "Extern", "i din nou.B", "PC-ul va reporni de c", "Windows 10 ve", "jies instal", "d nen", " Windows. Salva", "Opprett installasjonsmedium (USB-flash-enhet, DVD eller ISO-fil) for en annen PC", "gle..Produktn", "ILLNadd", "kih programa ure", "sti naujausi", "l nevaram noteikt, vai j", "fKorumak istedi", "Bez oznake", "IsSecureBootBound", "2'272", "i dostatok miesta na pokra", "&Anuluj", "di: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.", "&alej", "a no funcionar correctamente despu", "m vyjadrujete s", "ges megtartani", "cessitent votre attention pour la poursuite de l", "v igen.0Installation af Windows Server 2019 er mislykket#Installation af Windows Server 2019", "aide d", "Locale", "=$=4=8=@=X=h=x=|=", ">(>.>?>W>j>~>", "ments ", "s och f", "mu savienojumu, p", "Ovo bi moglo potrajati.ZKonfiguriranje a", " installer", "Comprobando la clave\\La clave de producto no funciona con esta edici", "t instal", "10. Nous pouvons vous aider ", "%1!d!%% on l", "Ladda ned", " Media Creation Tool", " z systemu Windows 7 lub Windows 8.1 lub je", "3:f,f-", "it) a m", "CSetupLangIniLoader::Initialize: Set default UI language = %s.", "(USB ", "https://go.microsoft.com/fwlink/?LinkId=620074", ".?AVIDlpObjectInternal@@", "&Teclado en pantalla", "INFORMACIJE O INSTALACIJI: za neke zna", "re fois sur cet ordinateur, vous devez saisir une cl", " je me suis arr", "chargement de certains fichiers", "czenie z Internetem i spr", "te ko", "(Klaidos kodas: 0x%1!lX! - 0x%2!lX!", "Notiek Windows 10 lejupiel", " klucza produktuCInstalator nie mo", "Estamos com dificuldade para determinar se o Windows Server 2019 est", "te kitus didelius elementus.&Pasirinkite i", "2019. Pour prot", " volby instalace.:Instala", "tzt.$Es wird mehr Speicherplatz ben", "da biraz yer a", "Se descarc", "n antiguos de Windows 10. Podemos ayudarte a obtener los archivos m", "Wenn Sie den Vorgang fortsetzen, ohne Ihre aktuelle Windows-Version zu aktivieren, m", "Klargj", "htestamine", "iai. Spustel", " en el directorio ra", "te, in", "Odota>Preinstall.cmd-komentosarjojen suorittamisessa tapahtui virhe.=Precommit.cmd-komentosarjojen suorittamisessa tapahtui virhe.", "Oppretter medium for Windows 10", "Please visit: %1!s!", " unitate ", "irite trdi disk med name", "quz-BO", "Tarkistetaan latausta", "ts. Tas var ilgt k", "CSetupResponsePageMediaCreationSuccess", "lg eller tilslut en ekstern lagerenhed med mindst %1!s! ledig", "1&121>1U1^1q1", " kompiuteriui. U", "6F6X6m6", " zoznam jednotiek", "es!Estamos preparando algumas coisas", "k veya kullan", "REPLICATE_OC", "u etkinle", "Asennetaan Windows Server 2019", "%1!d! GB ", "&elim da pomognem da instalacija operativnog sistema Windows bude bolja", " tiek atjaunin", "%s GBbWe can", "Her ikisigBu bitlocker anahtar", "ene, vendar se mora za njihovo delovanje namestitveni program za Windows 10 znova zagnati. Po ponovnem zagonu bomo nadaljevali, kjer smo ostali.:V tem ra", "d#\"oyG", "no za", "Avaa roskakori", " temizleyemedi@Kurulum program", " nytt. Lukk eventuelle ", "nyzik a licencszerz", "Ha a Windows jelenlegi verzi", "ljaanne", "%3!s!6Notiek Windows 10 uzst", "Instaliranjem ovog izdanja sustava Windows 10 va", "n de Windows ha visto un error que no esperaba.", "ti sobib! Kui olete valmis, j", "Windows Server 2019-Setup,Windows Server 2019-Setup wird neu gestartet", "Nie wy", "ivitada.(V", "n det du anv", ". Prane", "installation et recommencez.", "nerilen se", "i dohvatiti najnovije datoteke da biste instalirali najnoviju verziju sustava Windows 10.", " aucun lecteur de cl", "Potreban je dodatan prostor8Potrebno je %1!d! GB slobodnog prostora na disku (%2!s!)~Uklonite datoteke koje vam vi", " aktywowany na tym komputerze. Oznacza to, ", "a cuando est", " suportul fizic Windows 10\"Pute", " la client", " ID dijalo", "ania failure.cmd", "Ath_[S", "es que se seguem.", "t pour votre PC. Quittez le programme d'installation, puis r", "se majdnem k", "n de su descarga", "kressursene#Kan ikke initialisere arbeidsmappen Ugyldige kommandolinjeparametere", " do Windows. Ned", ". Kad izveidosit savienojumu ar internetu, m", "Ne moremo nadaljevati zaradi enega od spodnjih razlogov:", "=#=,=E=c=", "ne datoteke. Provjerite jeste li povezani s internetom i poku", "__CxxFrameHandler3", "rete mintegy 3 GB. Forgalmi d", "&Tagasi", " a reiniciar o computador para continuar a instala", "jra.PA k", "diegti ", "gleKDenne n", " refuza", "SupportedInstallChoicesBeforeCheck", "CInstallUI::CInstallUIMessageWindow::ShowRollbackPage", "rulayamad", "FveCloseVolume", "1(0&0", "Non spegnere il computer", "FLdegx", "ete morati ponovno unijeti podatke.AInstalacijski program nije uspio primijeniti podatke za migraciju@Instalacijski program nije uspio o", " limb", "st telep", "cijas failus. L", "Downloads openen", "?$?0? > > >::GetResponseId", "altmaya yard", "NW0~0Y0K0?", " cargos adicionales.(", "r att starta om och slutf", "WNustat", "e besprijekorno i mogu uklju", "Instalaci", "ka USB.", "Installer %s=Windows red", "jumi(Windows pazi", "Impossible de d", "en Sie ein solches an", "10-be. Adatai biztons", "cie s", "Installiprogramm ei kasuta k", "stroja sa vyskytol probl", "s. Selecciona otra unidad.!Descargar la versi", ": 0x%1!lX! - 0x%2!lX!", "$Tuoteavain sis", "rqrFrqr", "s de votre lecteur syst", "nvalvojan tilill", "Poista tiedostot, joita et en", "juma e-pasta zi", "ks neatbalsta.", " preinstall.cmd'", "m Windows v tomto po", "qdbegs", " ir nustatym", " otras opciones hay para actualizar?", "nder.", "Support", " listo para este equipo", " 000", "%1!ld!%% har slutf", "nes muus keeles peale praegu kasutatava.wTeie faile, rakendusi ja s", "nili. Windows 10 sa aktualizuje automaticky po", "n %1!d! Gt.", "\"6:91AXTPNLKl", "vel instalar o Windows 10VO PC foi reposto para o estado em que estava antes de come", " velikost asi 3 GB. Pokud pou", "s. Esta ventana se cerrar", "ete v Windows Server 2019. ", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "rskenduste, draiverite ja valikuliste funktsioonide hankimine", "ierele mari sau neutilizate din folderul Desc", "hren Sie Setup erneut aus.nWeitere Informationen f", ")Termos de licen", ">->E>J>j>", "s neparedz", "est produite lors de l", ".>A Windows Server 2019 m", "Product Key eingeben", "s selecciona Actualizar.", "pet a k", "ssel funktioniert nicht. Verwenden Sie einen anderen Schl", "pierakst", "IsAppThemed", "ie zada", "re interested in finding out why.", "o se encontram no suporte de dados de instala", "00S0{0", "o.(Liberte %1!s! no seu PC (unidade %2!c!:)YSelecionar ou ligar um dispositivo de armazenamento externo com, pelo menos, %1!s! livres%Dispositivo de almacenamiento externo", "digo de error cuando te pongas en contacto con el soporte t", " asi takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXBPred pokra", " vagy nem haszn", " denetlemek birka", "e a potom vyberte Aktualizovat.", "tait avant le d", "sselwert f", "%RP[n0 ", "455>5J5", " modifi", "ite se kot skrbnik[", "o mais recentes.", "as trva", "lntdll.dll", "e se datoteke sa USB diska. Da biste zadr", "zellikleri ve g", "jlok let", " atualizado automaticamente durante o per", "ve set your PC back to the way it was right before you started installing Windows Server 2019.@We", "sr-Latn-ME", " installere den nyeste versjonen av Windows 10.", "889[9", " bulam", "r att installera Windows.", " viac ako 4 GB (m", "unalniku.", "```ppp", "}oH9E", " jour votre PC", " la crearea suportului fizic", "t izmantot, ir ", "rast v", "zt, amelyen legal", "Allt ", "ejte jin", "Kodas atrodo ma", "Windows 10 uzst", "Pri in", "ntastat", "??0exception@@QAE@XZ", "sti iri paleisti naujausi", "0g0o0)R(ug0M0~0[0", "o %2!s!", "te sa na oddelenie slu", ". Otvorte ho manu", "ntalo de nuevo, o prueba con una clave distinta.;La clave de producto funciona. Contin", "CSetupCompatDlpResponse::OnCompatResultsChanged", "ali, vam bomo to sporo", "Instalacija se ne mo", "SetBkMode", "This PC can", "Vi gj", "Diegiant ", " asennus uudelleen.", "e rozpocz", "emy zainstalowa", "Priprema se %d%%", "etko sa odstr", "n de Windows 10::OnSuspend", "D6}XA", "enite namestitev.", "espace disque n", "ych znak", "ii-CN", "2!242t2", "ro-RO", " nytt.,Windows 10 er ikke klar for denne PC-en enn", "lidos", "asz zgod", "Salvestusruumi kasutamine\\Muude suurte ", "ResetEvent", "na je usun", "qps-ploc", "Windows Server 2019 ", "cie aktualiz", "iunile recomandate pentru acest PC", "ReleaseSRWLockExclusive", "Software\\Microsoft\\Windows NT\\CurrentVersion", "nda ask", "lectionnez une des options suivantes pour continuer.", "bs-Latn-BA", "0-Nk0OUL", "v, amikor ", "Edenemine: %1!d!%%2J", "O(uW0f0O0`0U0D0", "e aktu", "(Les tirets sont ajout", "su PC dators ir gatavs turpin", "3%323?3L3Y3f3s3", "Vi har uppt", "Installasjonen kan ikke fortsette fordi datamaskinen ikke kan startes p", " 350 MB miesta. Uvo", "BSe preg", "Kan ikke bruke overf", "(Uslovi licenciranja za Microsoft softver0Izjava o privatnosti operativnog sistema Windows", "en Sie Ihre Dateien, bevor Sie starten.CBitte warten Sie, bis die Deinstallation der App abgeschlossen ist.", "9i;u;", "000@@@@@@@@@ ", "Ikke akkurat n", "Enter Product key", "Oppdater stasjonsliste", ">4>L>d>|>", "Vi vet ikke helt hva som skjedde, men vi kunne ikke kj", "Euh_YS", "o funcionou. Verifique-a e tente novamente, ou use outra chave.?A chave do bitlocker funcionou! Continue quando estiver pronto.", "ger at bruge, er krypteret med BitLocker. V", "klemeye ba", " klaviat", "CDlpResponseImpl > > >::Execute", "XX,abr", "Namestitve ni mogo", "en in aktiviran, lahko ta korak presko", "iliz ama bu arac", "Sc0_0", "U}U0'", ";\"<6<@2L2", "re den nyeste versjonen for ", "%s nen", "OOOrM&", "ADD_UNATTEND", ".?AV?$CZeroInit@VCSetupDiskSpaceDlpResponse@@$00@@", "o consegue atualizar o PCkO idioma ou edi", "Ako nastavite bez aktivacije trenuta", "tenjem PC-ja.", "ivitt", "%d tecken kvar", "i instalaci Windows do", ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX:", "Epn&}", "ks nevar atjaunin", "No se pueden instalar las caracter", "es, controladores e funcionalidades opcionais", "zben.", "sok let", "essayez.", "Vnesite klju", "terse de pe unitatea de sistem.", "%d karakter maradt", "Izberite particijo, na katero ", "%1!d!%%", " &Chc", "Controllo del PC", "emt k", "ar-BH", "kkulcsot a Windows DVD-j", "i de acord.", "lectronique de re", "%s GB~Nevaram noteikt, vai j", "ka utrymmet medan uppdateringarna installeras. Windows kommer inte att formatera om din externa lagringsenhet och du kan ta ut den n", "van av Windows 10 konfigureras din dator f", "hemmin.", "Izbor disk jedinice,Instalacija se bri", "3!303F3U3q3x3", "ISO datoteka(Odaberite USB izbrisivi memorijski pogonpDatoteke s USB pogona ", " program p", "stroj na vytv", "Palikti tik asmeninius failus", "Velg en bane", "|Pokud chcete nainstalovat Windows 10 na jin", "n de uso medido, comprueba si esto provocar", "\\*g(Wdk", "ra neatitinka", "Laajenna kiintolevy", " oldalt: %1!s!", "e da utvrdi koju verziju operativnog sistema Windows koristite.", "Se nedenfor, hvis du gerne vil vide hvorfor.", "ter restante.A chave de produto cont", "InitCommonControlsEx", "lasztott, mint amelyet jelenleg haszn", "GB, aproximadamente. Si usas una conexi", " pliki z dysku systemowego.", "CInstallUI::ShowErrorMessage: Posted MSG_INSTALLUI_SWITCH_TO_ERROR_PAGE", "{#S]]}yyYYY)+", "Cannot find Windows installation files. Please insert your Windows installation media and then run ", " precommit.cmd/", "~VWV~PPHn", "&Chiudi", "Invalid Dialog ID'We couldn", "0j0W0", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "JVypr", "lg det billede, du vil installere.", "shez a Windows Server 2019 telep", "Escolha o que voc", "Per continuare l'installazione e mantenere le impostazioni di Windows, i file personali e le app, ", "it-CH", "fr-LU", "sit pirmo reizi (vai instal", "lida! Continue quando estiver preparado.", "ytynyt.", "0!0(0C0w0", "*==}zz", "Forbereder installasjon ", "nda %2!s! i", "Edition", "n y mantener la configuraci", "es-ES", "on dont le programme d", "3 34383P3T3X3\\3`3d3h3l3p3", "n %1!d! Gt. Valitse toinen muistitikku.", "Vous ne pouvez pas conserver vos fichiers, applications et param", "o6A instala", "FindResourceExW", "tt mentse ", ".9Windows 10 ", "3\"323B3R3b3r3", "sait.@Be", "limo duomen", " asennuksen jatkamisen. Yrit", "::ExecuteRoutine", " a tentar utilizar est", " limpiando antes de cerrar", "in hen", "emo vas kada budemo gotovi i ", "3Windows Server 2019 er ikke klar til denne pc endnu", "s salir de la instalaci", "tim c", "Gauti", "ke mo", "495j5q5x5", "cessaires. Assurez-vous d", "ifru proizvoda", " flash USB, DVD, ", "e pokra", "nia, ale s", "re warto wiedzie", "3uW03", "tirildiyse ve yeniden y", "Veuillez patienter", "lg kun denne udgave, hvis du installerer Windows p", "rskendusi pole saadaval", "Tallennustilan k", "ka bir bilgisayar i", "anja na PC-ju zbog pomanjkanja prostora na disku. Slijedite upute u nastavku da biste dovr", "lat r", "&Pokra", "181C1", "cnica; es posible que la asistencia t", "ei, asisten", "r diesen PC noch nicht bereit.", "a pu d", "1 tegn tilbage%Produktn", "Usar as op", " de Windows 7 sau Windows 8.1 instalat", "<0=?=r=", "Las actualizaciones est", "lo je do problema u izvr", "ndirmeleri A", "ljande alternativ.", "Preuzmite najnoviju verzijujDostupna je i novija verzija tog alata. Da biste nastavili, morate preuzeti i pokrenuti najnoviju verziju.,Preuzmite a", "10 est automatiquement mis ", " Windows Server 20193", "Estas actualizaciones ayudar", " dysku flash USB.", "anas programma nepie", "Ugyldige kommandolinjeparametre", "mtade filer=Ta bort stora eller oanv", "o do Windows 10[Falha ao abrir o uso do armazenamento. Abra manualmente seu Armazenamento em Configura", "Installer Windows 10", "Instaliraj %s?Windows ponovno pokre", "0c0f0", "d chyby: 0x%x]=Pri in", "cie nenain", "nce temizleniyor", "rz Kosz r", " loca", "cznie folder Pobrane.iNie mo", "141B1T1", " Microsoft'", "Pasirinkite kalb", "#Installationsprogram f", "cii, ktor", "in bu konuyla ilgilenirken bir sorunla kar", "mden farkl", "in ve yeniden deneyin.JDaha sonra, %2!c!: s", "padne sa pok", "iadne aktualiz", "%d%% klart", "zda devam edecek. Bilgilerinizi korumak i", "- Windows 8.1. ", "rbaude'Izv", "oikeusehdot, asennus lopetetaan.]Asennuksen suorittamiseen tarvitaan v", " %1!d!%%H", "ServerEnterprise", "t. preostalih znakov: %d", " https://aka.ms/windowsserverupgrade", "o a efetuar uma instala", "ppp```PPP", "Kontrollerer PCen+Kontrollerer om du er klar for installasjon", "No estamos seguros de lo que sucedi", "invalid map/set iterator", "ZNustat", "ti sisaldab ainult 48 m", "8Klarg", "jraindul", "Wersja", "tGNous allons continuer l", " uudelleen.=Seuraavaksi autamme sinua vapauttamaan %1!s! %2!c!:-asemassa.~Si vous voulez installer Windows 10 dans une autre partition, vous devez cr", "ServerWeb", "rlopp", "i ceea ce vre", "mu programu se nepovedlo inicializovat pracovn", "Kontrollerer din overf", "dzu, aizveriet uzst", "a grupe %d nije va", "Asisten", " kaydedin ve kapat", "t tell which version of Windows you", "Kui Windows 10 on sellesse arvutisse varem juba installitud ja siin aktiveeritud ning te installite seda uuesti, v", " Windows Server 2019)", "ne-NP", "en&de", "L'aggiornamento gratuito a Windows 10 ", " w fazie %1!s! ", " hvilken versjon av Windows du kj", "=\\>c>", "nya van telep", "n no pudo borrar los archivos de instalaci", "Instalator przeprowadza oczyszczanie przed zamkni", "ciju.", "CSetupResponsePageDiskSpaceReq::OnOpenDownloadsClicked", " jedanput.", " z pomoc", "t ieg", "nky pro software spole", "A verificar esta chave3Esta chave n", "diu.zNevieme ur", "ProductName", ".?AVCSetupDiskSpaceDlpResponse@@", "k igen eller prova med en annan.1Produktnyckeln fungerar! Forts", "rbaude%", "Microsoft YaHei UI", "i poate fi necesar s", "ket for eller versjonen av Windows-operativsystemet som er installert p", "Ela se parece com: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX9Para continuar a instala", "fa-IR", " stai installando un'edizione di Windows diversa da quella in uso.", "Estamos fazendo alguns preparativos", "KPara instalar Windows 10, haz clic en Setup.exe en el medio de instalaci", "i iz postavljanja, aktivirati Windows i tada ponovno pokrenuti postavljanje. ", "CSetupResponsePageSysReq::UpdateView", "Turi b", "(&R)?", "vPogon koji poku", "ffnet werden. F", "WQuesto codice Product Key non funziona. Prova un codice diverso o acquistane uno nuovo.$Installazione di Windows 10 in corsoDDevo riavviare il PC pi", "identificateur : 7Windows a besoin d'espace pour effectuer la mise ", "s antes de que puedas actualizar. Te avisaremos cuando hayamos finalizado y te diremos qu", "re nale", "Estamos teniendo problemas para determinar si tu equipo puede ejecutar Windows Server 2019. Cierra el programa de instalaci", " %2!c!:)Q", "IDATX", "\"ZG{*oK", "installer certaines fonctions et langues facultatives.", "r klart5>D>T>a>n>{>", "De productcode staat op de verpakking van de dvd of in een ontvangstbevestiging per e-mail. Wanneer uw pc met internet is verbonden, wordt Windows voor u geactiveerd. ", "kW0f0J0O0k0o0", "10 suite ", " nytt.7Det oppsto et problem under nedlasting av enkelte filer", "rankis nepalaiko ", "ksy komentoriviargumentteja. Lis", "paration de l'installation", "sst/xxy", "es-DO", " Microsoft Corporation. Alle Rechte vorbehalten.", "~Es kann etwas dauern, bis festgestellt wurde, ob die Komponenten, die Sie beibehalten m", " pronto para este PC%Garantir que a instala", "Create installation media (USB flash drive, DVD or ISO file) for another PC", ", SD-", "lassza ezt a kiad", "nosti aktualizace?", "ujte v instalaci spu", "tu. Niekt", "charge pas compl", " Windows a osobn", "ba nav der", " jednotky.", "Ajuda", " Windows Server 2019#", "ava nastavak instalacije. Pregledajte informacije o tome u datoteci %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml i ponovo pokrenite instalacioni program.rZa vi", "tfMegjelent az eszk", "]:N`O", "0? $A0", " de produit (Product Key) entr", "cuter Windows 10. Veuillez fermer le programme d", "Angiv produktn", "veskite kit", "parationQCe point a d", "RvQ-N", "CDlpResponseImpl > > >::ExecuteRoutine", "i din spa", "Si vas a actualizar desde Windows 7 o Windows 8.1., o est", "gend Speicherplatz verf", "ms-settings:storagesense", "=R=c=", "dom Product Key, nie je k dispoz", " Microsoft Corporation. V", "k igen.5H", "letmek i", "Notiek gatavo", " S modunda ", "n.{No es posible determinar si el equipo est", "en-CA", "it podporovan", "- USB ", "cii a zachova", "o do Windows Server 2019 precisa ser reiniciada para que elas funcionem. Depois de reiniciar, vamos continuar de onde paramos.7Este computador n", "Windows nije aktiviran na ovome PC-ju. To zna", "lo je do problema pri kreiranju medija", "GFFF|x", "TerminateProcess", "tirme ayarlar", "Kontrolujeme, jestli je v", "2-2F2O2", "r installationsprogrammet. Du kan ocks", "gu.DJ", "ajte ponovo.", "teni a Windows 10-et (vagy a kor", "ros; dalis esam", "ltiges Zeichen.", "10 herunterladen", "isko!Nechcem pou", "To lahko traja nekaj minut.UPriklju", "dzu, ievadiet pareizo atsl", " se aplice tarife de acces internet. Face", "Produktnyckel", "Questo download in background pu", "r steget. Vi aktiverar i s", "9-:H:c:q:", "rjon, am", "CSetupResponseTemplate::ExecuteRoutine: Cancel button clicked.", "Il nous reste quelques t", "uriranja#Provjera ima li a", "Er sieht ungef", " aflarea motivului, vede", "Ochrona funkcj", " frigj", "uje se, jestli je na po", "Jis atrodo ma", "du: 0x%x]8Instalacja systemu Windows napotka", "RichEdit20W", "Het USB-flashstation is klaar", " galim", "chargement.", "n de Windows y ejecuta ", "terminer si l", "nik, aby przeprowadzi", "gn-PY", "ver k", "ntalo de nuevo.5Se produjo un problema al descargar algunos archivos.", " utiliser votre PC.P", "We need more space,%1!d!GB of free disk space needed on (%2!s!)YRemove files you no longer need or use Disk Cleanup to free up space, and then try again.*There was a problem downloading some files", ". Ja neinstal", "kleyemedi$Kurulum ", "9 9,989D9P9\\9h9t9", "Diegti ", "es.;Falha ao abrir a reciclagem. Abra manualmente a reciclagem.fFalha ao abrir a utiliza", "Przeczytaj ten tekst, aby wiedzie", "I file di installazione di Windows 10 che stai usando non sono i pi", "PPP@@@@@@@@@@@@@@@PPP", " pradedant naujinim", "Windows Kurulumu; g", "o para voltar a tentar.gA Configura", "m syst", "t jaun", " sincope ", ".Lang.ini", "Zakaj je to prikazano?", "r produktnyckeln fungerade inte. Skriv in nyckeln som du har k", "n continuare PC-ul.", "terminer si votre ordinateur peut ex", " recente per continuare.2d2", "i informa", "n de unidad", "installe Windows 10 sur ce PC..Je dois acheter une cl", "~/VVhG", "A chave do produto (Product Key) deve estar na caixa do DVD ou no email de recebimento. Quando voc", "Die Updates wurden installiert. Damit sie verwendet werden k", "ite ga u nastavku.", " kompiuteryje ", "o do Windows diferente da que est", "@'*'%#", "s instal", " tietokonettasi Windowsin asentamisen aikana. Tallenna ty", "0k0o0Bf", " login", " se aplikace ", " precommit.cmd)", "o do Windows. Insira a m", "emo vam Windows.", "m lisans s", "lanacak. Bu g", "n, iniciar el programa de instalaci", "ia verzia tohto n", "seinek m", "%d%% terminat", "Isso levar", "MapDialogRect", "anas programmu un m", "e syst", "emiau arba i", "&Cancel", "vat.FInstalace se nepovedla ve f", " grund av f", " izdelka ima le 48 znakov.>Vrednost klju", "%2!s!+", "tor cu aceasta: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXC", ".Transferir a vers", "ita s funkcijo BitLocker bo med posodabljanjem za", " bit locker ", "Ako je Windows 10 bio ranije instaliran i aktiviran na ovom PC-ju i ponovno ga instalirate, presko", "pet. A kezd", "irili tvrdi disk dok se a", "ljuda?", "rbDu m", "ra. Pr", "ciou a m", "a DVD diska. Ru", " aktualizacj", "###'#", "0S0h0L0g0M0~0[0", "%hs: Registry value 'CSDBuildNumber' is not the correct type (REG_SZ).", "im stavkama.", "rtrauc", "0F0h0W0f0D0", "Rien*Vous pourrez g", "NW0~0W0_0+", "jljait ", "ll automatically activate Windows after installation is complete.", " PC-en p", "ni v pokra", "uriranje na Windows 10 dostupno je samo ako na PC-ju imate instaliran aktiviran primjerak sustava Windows 7 ili Windows 8.1. Aktivirajte trenuta", "ISO-fail", " DVD naudodami %1!s! rankiniu b", "unalniku ni aktiviran. To pomeni, da morate spodaj vnesti klju", " du ved, hvad du accepterer.", "cie budete musie", "solatot egy mapp", "rskendatud versiooni allalaadimine", "nglig om du har en aktiverad version av Windows 7 eller Windows 8.1 installerad p", "Aanmelden als beheerderdAls u dit hulpprogramma wilt gebruiken, moet u zich aanmelden bij Windows met een beheerdersaccount.0U moet het ISO-bestand later op een dvd branden.", "I_RpcMapWin32Status", "nvalvojanagJotta voit k", "ie atjaunin", " olet yhteydess", "Het is niet duidelijk wat er is gebeurd, maar dit hulpprogramma kan niet op uw pc worden uitgevoerd. Als u problemen blijft ondervinden, geeft u de foutcode door aan de klantondersteuning.", "Checking your PC", ".::OnBack", "N(Wnx", "lg en sti", " (Microsoft Corporation). ", ">,?>?E?W?^?o?}?", "SPC sa vr", ":#;^;d;", "in ve yeniden deneyin.", "Si contin", "tte af en af f", "ho programu pot", ": %1!d!%%#", "8.1. ", " nouveau vos informations ult", "ration peut prendre quelques minutes.KBranchez votre PC pour ne pas d", "iamasi atsi", " nije uspelo. Ru", "li nedostatku m", " na v", "en Sie Setup, und wiederholen Sie den Vorgang./Windows 10 ist f", "ntalo de nuevo o prueba con otra clave. > > >::GetError", "%1!s! %2!s!!Problem beim Erstellen von Medien", " klucz produktu systemu Windows 10", "tepta", ", trebuie s", ".?AV?$CUnknownImplT@VCWebbrowserClientSite@@$0A@@@", "Nem tarthatja meg f", "F`Y6>~", "%sCore", "Start again from the beginning", ".text$mn$00", "?4?O?", "enjem diska sprostite prostor, nato pa poskusite znova.4Pri prena", "pt-PT", "das kodu.", "rizze, hogy a telep", "4D4X4h4o4y4", "klemeyi se", "20282E2R2W2]2d2r2", "m. Instala", " preinstall.cmd.1", "zzel keresse meg ezeket az elemeket a G", "kilo problema", "cie pom", "n.(Liberar %1!s! del equipo (unidad %2!c!:)]Selecciona o conecta un dispositivo de almacenamiento externo que tenga al menos %1!s! libres", " jour. Nous vous indiquerons lorsque nous aurons termin", "klendiyse ve etkinle", "te nainstalovat si Windows 10 na po", "titi podataka, ostanite uz PC do ponovne prijave.#Rezimirajmo, odabrali ste sljede", "[9HHGEE8$", "Valg af drev", "rer distribusjonsskript for precommit.cmd*Kj", "e se PC konfigurirati za izvo", "jra a telep", " go i pon", "Liniile se vor ad", "kim ra", "cZxUR\\", "z Windows s", "VQPWV", " a obnov", "zsSGS", "Bu anahtar denetleniyorFBu anahtar bu Windows s", "Windows installation encountered an unexpected error. Verify that the installation sources are accessible and restart the installation.", "\\__C)", "enia Windowsu 10. Uvo", "r klar.&Kraven ", "CSetupUIManager: Rollback Error [0x%X] - Showing rollback message", "imu. Pasirinkite ", "%s on lubamatu m", "ned ettevalmistused", "D$X/N", " grabar el archivo ISO en un DVD m", "Descargas:Quita archivos grandes o sin usar de la carpeta Descargas.", "233E3R3", "mes.FGrupas %d atsl", " varias veces. Esto puede tardar un poco.4Espera mientras se cierra el programa de instalaci", "CInstallUI::SetErrorMessageText", "&Anterior", "glen herunder eller afslutte installationen, aktivere Windows og derefter starte installationen igen.", "utujeme, inform", "cHIIIYY", "mtade filer. ", "EnterCriticalSection", " prie ", "s most ", "o de scripts preinstall.cmd.>Houve um problema durante a execu", "K6mZP(", " ponecha", "Windows 10 nije instaliran", " PC-en (%2!c!:-stasjonen)CVelg eller koble til en ekstern lagringsenhet med minst %1!s! ledig\"Zewn", "Gandr", "Lataa Windowsin uusin versio", ", kas ir paredz", " to resume your installation.", "vel executar esta ferramenta no seu PC. Caso continue a sentir problemas, indique o c", ". Uvoln", "7)707h7o7}7", "z kiv", "Ievadiet produkta atsl", " desteklemiyor. Daha fazla alana ihtiyac", "t tell what version of Windows you", "CInstallUI::GetCaption", "10 un j", "in dosyalar", "s recientes de Windows 10 en el equipo debido a que el espacio en disco es insuficiente. Libera un poco de espacio a continuaci", "%1!d!%% completadofEsta clave de producto no funciona. Compru", "klemeye kald", "Ne mogu se prona", "3+3f3", "NtUpdateWnfStateData", "Installasjonsprogram for Windows 10", "iat instalarea Windows. Reporni", "eneklerden birini se", "i nevoie de o cheie de produs Windows 10.", "jiet pa", ".?AVCComboBox@@", ":(:,:0:H:L:`:d:h:", " activado en este equipo", "Nu#3e", " scripturile de implementare precommit.cmd2Se execut", "lida de Windows 10.", "`Poder", "==>]>}>", "cii fungova", "klemeyi ba", " bir bilgisayara y", "CDlpResponseImpl > > >::SerializeRoutine", "No sabemos si tu equipo tiene espacio suficiente para seguir instalando Windows Server 2019. Intenta reiniciar el programa de instalaci", "ciju, lai zin", "Windows er ikke aktivert p", "s lesz konfigur", " (%2!s!)", "Fkg_[", "ker efter uppdateringar\"S", "rolnom", "&Voltar", "ivitys on k", " jenom 48 znak", "Naujinim", "Wybierz dysk flash USBjPliki na dysku USB zostan", " en anden placering.", "sies autom", "LegalCopyright", " Windows 10. ", "Error launching shell link (GLE = 0x%x)", "Nic4B", "riista kasutamiseks peate olema Windowsi sisse logitud administraatorikonto abil..ISO-faili peate hiljem DVD-plaadile kirjutama.", " Windows Server 2019M", "&Manter aplicativos e arquivos pessoais Manter somente arquivos pessoais", " deseja fazer?", "ilytt", "t pour cet ordinateur.7V", "r inte redo f", "A verificar o seu PC8Estamos a verificar se tem tudo pronto para a instala", "ime S. Toto vydanie vyberte len vtedy, ak in", "ll keep going from where we left off.%This PC can", "jak takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX", "o de Unidade", "The updates are installed, but Windows Server 2019 Setup needs to restart for them to work. After it restarts, we", "Particija diska", "Baixar-S", "6(6,606@6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", ".rdata$zETW1", "Descarregar atualiza", "8Windows Server 2019 ist f", ".?AVCSetupPageRollback@@", "Sobimatud k", "gghXvvw", "Checking this keyFThis key won", "N0R|~", "ilitatava sisu valimine", "Upotreba skladi", "re unable to run this tool on your PC. If you continue experiencing problems, reference the error code when contacting customer support.", "lteni a legfrissebbeket, hogy biztosan a Windows 10 leg", "WWWh\\", "Izdanja se ne podudaraju", "dziemy kontynuowa", " popisek", " yaln", " Windows.G", "0IDATh", "[Feilkode: 0x%x]>Det ble oppdaget en uventet feil under Windows-installasjonen.", "t work. Re-enter the one that you bought online.", " apsauga bus laikinai sustabdyta. J", " la version actuelle de Windows sur un r", ";^/[?", "ni bulamad", "2q2x2~2", "e biti dodate automatski/Instalacija nije uspela da u", "imdi de", "CoCreateInstance", "leminden ", "vot %1!s! disk", "espace2Voulez-vous continuer ", "v\\Omi", " partir de l'endroit o", "ppna Papperskorgen", "\"Luodaan Windows 10 -tietov", "Legal_Policy_Statement", "chten Sie mit dieser Auswahl fortfahren?", ";3;>;s;", "Her nogle ting, du skal huske p", "s nyelvet v", "\"Virheellinen valintaikkunan tunnus\"K", "Comprobando el equipo(Comprobando que est", "]shell:Downloads", "elite li i dalje da koristite ovaj izbor?", "o algumas dicas:", "Actualizarea gratuit", "m ier", "zlOUL", "Windows Server 2019 instal", "no ovome: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX>Slede", "k enn det du bruker n", "stroje BitLocker nefunguje. Zkontrolujte ho a zkuste to znovu nebo vyzkou", ".?AV?$CZeroInit@VCSetupCompatDlpResponse@@$00@@", "Ispravke su instalirane, ali da bi funkcionisale, neophodno je ponovo pokrenuti instalaciju izdanja Windows 10. Nakon toga nastavljamo tamo gde smo stali.1Na ovom ra", "0g0\\Omi", "8)9X9h9x9", "@V instalaci Windows 10 budeme pokra", "5TUHUUHHHHHH9%$", "Aceast", " alte c", "lnu verziu Windowsu pomocou k", "telek", ".'Windows ", "Prepara[Hai gi", "%d characters left", "ila baterija.", "ani, ali je v ra", " uudelleen..Windowsia ei ole aktivoitu t", "cznie.", "nnaren. Br", "ik kustutatakse (sh failid, rakendused ja s", ", turite ", " precisar", "CInstallUI::ShowPage: Exit is requested. Ignoring ShowPage", "ifreqOva ", "n.SBitLocker se parece a esto: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX > > >::GetResponseId", " preinstall.cmd ", "1Conserver les fichiers personnels et applications,Conserver uniquement les fichiers personnels", " ali kupite novega.", "Windows 10:n asennus", "mu Windows odstr", "daug taip: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXQKad gal", "e biti ve", "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp", "s alkalmaz", " che stai tentando di usare ", "USB-flashminne", ". Veuillez la v", "CInstallUI::CreateSplashUI", "<% >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "ili..V tomto PC sa ned", "O seu PC vai ser reiniciado v", " nytt flere ganger. Dette kan ta litt tid.+Vent mens installasjonsprogrammet avsluttes", "FVFVF", "??0exception@@QAE@ABV0@@Z", ".fKonfigurowanie aktualizacji dla systemu Windows 10", "nnen wichtige Korrekturen, aktualisierte Ger", "Jos jatkat aktivoimatta nykyist", "Produktnyckeln ska finnas i f", "ete soubory.2Po", "rile s-au aplicat", "d Product Key pre Windows 10", "@@@```", "0?c$@0", "bit locker ", " jour gratuite vers Windows", "rge. Veenduge, et installiallikas on ligip", " sistem s", "0!kk02", "kkulcsotXA telep", "trukti.XKonfig", "gi ar Windows 10.u", "\\(W/e", "GetModuleFileNameW", "udmist eemaldada.(N", "Laufwerkliste aktualisieren)Es sind mindestens %1!d! GB erforderlich.", "L'installazione di questa edizione di Windows 10 configurer", " tohoto n", "n continuare probleme, men", "n de Windows 10 configurar", "CSetupResponseTemplate::ExecuteRoutine: Next button clicked.", " nast", "tres de mise ", "re verkt", "sre k", "enia zabezpe", "0?&$@0", "VerifyVersionInfoW", ";$;0;@;u;", "sekKT", "si parancsprogramok futtat", "DownloadDiskSpaceReq", "ilitada, sest teie Windowsi praegune versioon v", "Ten?.7", "CInstallUI::ShowPage", "ce oprogramowania firmy Microsoft6Zasady zachowania poufno", ".?AVexception@@", "s crear y, despu", "s rakstz", "lgende ", "shez.", "buj u", "&Naprej", "171T1o1", "na geliyor.", "l friss", "Nem siker", "z-N`O", "s en start de computer opnieuw op. De installatie van Windows wordt dan automatisch voortgezet.", "rebilir.XY", "nienia przyczyny.", "iu verziu Windowsu 10.", " miejsca do kontynuowania instalacji systemu Windows Server 2019. Spr", "liviivat lis", "' \"$ $ *$'", "WfrXq", "teva minute.vNu am reu", ", nous avons des difficult", "6U7v7", "(%1!c!:): ", "cuter manuellement %1!s! pour ouvrir Nettoyage de disque.", ", mihin se j", " zewn", "*NW[&{", "GzzzhhhWW", "rket, at du har ", "haw-US", "line salvesti, millel on v", "i proovige m", "das kods: 0x%1!lX! - 0x%2!lX!", "7'7,7", " Windows Update[", "latot. Nyissa meg a t", "in Kurulum program", "nek folytat", "Kam j", "6E7`7g7m7r7~7", "elles fonctionnent. Apr", "jumus un personiskos failus Patur", "o e podem incluir corre", "Narezivanje ISO datoteke na DVD", "Windows nije aktiviran na ovom ra", "C>_D}]", "dition de Windows. Essayez une autre cl", "laties uzzin", " starte installasjonsprogrammet p", "Dledddh", "o e tente novamente.6Windows Server 2019 a", "eleri kald", "Bilgisayar", "edky.BInstala", "7e7y7", "? > > >::DeserializeRoutine", "ga darbojas. Turpiniet, kad esat gatavs.", "042704B0", "cution des scripts de d", "&Valmis", "Troubleshooting tips", "ali za to poskrbeti namesto vas, smo naleteli na te", "tres vont ", "sitikinkite, kad akumuliatorius diegimo metu nei", "PrepararBVoc", "SupportedInstallChoices", "k igen.wInstallationsprogrammet kunde inte starta installationen av Windows. Starta om installationsprogrammet och f", "sr-BA-Latn", "in medyay", "!-@L7+", "letet, ", "ekivanu gre", "i din nou.*Instalarea Windows Server 2019 nu a reu", "Dit zijn een paar dingen waar u rekening mee moet houden:", "000h0u0", "n o ejecute ", "A chave tem este aspeto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXMPara poder continuar a instala", "UpdateMedia", "ppp ", ", kur", "ovat v instalaci Windows. Restartujte instala", "a nieoczekiwany b", " funkcie. Tieto aktualiz", "e da pokrene Windows 10. Zatvorite instalaciju, a zatim poku", "Instalarea acestei edi", "ouverture de l", " na system Windows 10, aby aktywowa", "ifrovania BitLocker obsahuje len 48 ", "Setup is cleaning up before it closes", "mmern sollten", ", ale soubory se zachovaj", "W}}=ATT", "cego%Nie chc", "0g0O0`0U0D0", "Izberite, kaj ", "le&ri", "e sur votre PC. Activez votre version actuelle de Windows ", "Windows 10 installimine4Arvuti taask", "ciju fail", ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatActionResponse@@@@@@@@", " continuer l", "rkasime, et teil on Windows 10 jaoks vanemad installifailid. Saame aidata teil hankida uusimad failid, et saaksite installida Windows 10 k", "ete odpoji", "Vydania sa nezhoduj", "=G=z=", "o chcete urobi", "m vedie", "hilduvuse kontroll", "bu vai, izmantojot komandu uzvedni, instal", "l, na kter", "vate Windows 10", "tkamiseks vajalikku installimisteavet. Uuesti proovimiseks taask", "nt elt", "060I0T0f0q0", "dium Windowsu a spustite s", "&Refuser]Si vous refusez les termes du contrat de licence, vous quitterez le programme d", "o funcionou. Verifique-a e tente novamente ou experimente uma chave diferente.>Sua chave do produto funciona! Continue quando estiver pronto.", "Prenosi?Odstranite velike ali neuporabljene datoteke iz mape", " ei voi k", "%1!s! %2!s!'Pri vytv", " OK for genstarte og fuldf", ".?AVCSetupResponsePageDiskSpaceReq@@", "0@e$@0", "INFORMATIONS SUR L", "dia a ser usada", "ivanjem je li Windows Server 2019 spreman za va", "OYu`O", " des ", "ju, rad", "ARABIC", "ate prvi", "uriranja su instalirana, ali postavljanje sustava Windows Server 2019 mora se ponovno pokrenuti da bi funkcionirali. Nakon ponovnog pokretanja, nastavit ", "5#6{6", "d-N~b0R\"u", "Scarica la versione pi", "pet az elektromos h", "https://go.microsoft.com/fwlink/?LinkID=528892", "elite namestiti.", " bir s", "T3Mcg", "Pasiruo", "cie Windowsu sa po", "t ready for this PC yet", "CSetupUIManager::OnProgressChanged", ".zKe spu", "LeaveCriticalSection", "rberedPDu har redan fixat det h", "nSi quieres instalar Windows 10 en otra partici", " kompiuteryje yra pakankamai vietos toliau diegti ", "i instalarea Windows Server 2019.?Vom continua s", "glen virker! Forts", "as disks ir gatavs", "e se kad se prijavite u Windows 10. Da biste pridonijeli za", "s var", "mpinat o eroare nea", "Nemoj ni", "e razlikovati ovisno o ure", "Escolher itens a manter", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "llningar", "ajte s nekim drugim klju", "te si nejnov", "[Virhekoodi: 0x%x]2Windowsin asennuksessa tapahtui odottamaton virhe.", " Windows 10F", "ms-BN", "ar-IQ", "Gebruik de aanbevolen opties voor deze pc", ".?AVCRichEditCtrl@@", "ppp@@@@@@@@@@@@@@@@@@@@@```", "e jste si syst", "etka instalacije.(Preduvjeti dovr", "Windowsin tietosuojatiedot", "m, ne", "nstalleerd.", "mu, un v", "li wszystko jest gotowe, kontynuuj.", "teva minute.qNu ve", ".,Zwolnij do %1!s! na komputerze (dysk %2!c!:)hWybierz lub pod", "l..Nem siker", "e zadat k", "ves. Ellen", " selec", " nytt.>N", "Les deuxtCette cl", "sikkal, vagy v", "IsOsPreRS1", "in en son s", "Selecione a parti", "berpr", "r datorn", "aktiviz", "du.CNepavyko atidaryti ", "stroj nepodporuje jazyk nebo edici verze Windows, kter", "cessitent votre attention pour continuer l", "0W0j0D0", "t slo", "657E7Q7", "+hkkCww;", "ebuje m", "em.>Va", " zawiera", "8 8$8,8D8H8P8h8x8|8", "Notific", "hlen Sie ein anderes Laufwerk aus, und versuchen Sie es erneut.UAls n", "Nepiecie", "CleanInstallChecked", "unaru zbog nedostatka prostora na disku. Sledite uputstva u nastavku da biste dovr", "Norise: %1!d!%%$$@0", "anje je bilo v fazi %1!s! prekinjeno zaradi napake med operacijo %2!s!", "i din nou.#Windows nu este activat pe acest PC", "uriranja za Windows 10", "jiet un aizveriet failus.BL", "stroj nem", "Bitlocker klju", "Applicable notices and license terms", "%2!s!*Teie asutus haldab teie v", "moire flash USB", "Your files, apps and settings can", "tte installationen af Windows Server 2019. Pr", "dotEsta chave do produto (Product Key) n", "j]Wh(", "KillTimer", "kWe can", " obtenir les derniers fichiers afin que vous ayez la version la plus r", "Instalar esta edi", " pozornos", "Versiot eiv", "######'##''", "o para o Windows 10", "avanje skripti za primenu failure.cmd#Ovo mo", "pen.%A telep", " kilka minut.}Ten klucz produktu umo", "CSetupUIManager: Uninstall requested - No rollback message shown", "est disponible que si une version activ", "W0O0o0", "tuvi!Es nev", "ndiga filer. Kontrollera Internetanslutningen och k", "uje se sta", "CSetupLangIniLoader::Initialize: Failed to get the language information: index = %d.", "MediaSetupUIMgr.pdb", " disponible en tu idioma y arquitectura actuales.", "e de Windows", "res restants(Les tirets sont ajout", "alinkite nereikalingus failus arba atlaisvinkite vietos naudodami disko valym", "Ispravke su instalirane, ali da bi funkcionisale, neophodno je ponovo pokrenuti instalaciju izdanja Windows Server 2019. Nakon toga nastavljamo tamo gde smo stali.:Na ovom ra", "SysReq", "v en annen n", "programok ", "es, mais le programme d", " 3 GB ", "parons quelques ", "%SYSTEMDRIVE%\\windows\\system32\\isoburn.exe", "Kja;Kka", "sime nuo tos vietos, kurioje sustojome.2", "100701213655Z", " eliminato tutto, inclusi file, app e impostazioni.", ".?AV?$CZeroInit@VCSetupResponsePageInstallNowOrLater@@$00@@", "ri. Deschide", "o SD ou disco r", "No pueden conservarse tus archivos, aplicaciones y configuraci", "Installimise j", "w instalacyjnych systemu Windows. W", ">)?A?Q?Y?i?y?", "lieties, kas j", "Preuzimanje ima oko 3 GB. Ako ste na vezi s ograni", "in bir Windows'a y", "Ett tegn igjen", "d Product Key pro Windows 10.", "rsler kunne ikke ", "tett Windows nyelv", "t timp se ", "&:=I?IIHHWD9", " &Pomagati ", "re kommandoen ", "5%555B5O5\\5i5v5", "se ut", "api-ms-win-eventing-provider-l1-1-0.dll", "Architecture", "e prenesti. Preverite, ali imate vzpostavljeno povezavo z internetom, in poskusite znova.*Izvajanje skriptov uvajanja preinstall.cmd)Izvajanje skriptov uvajanja precommit.cmd'Izvajanje skriptov uvajanja failure.cmd", "Installationsmedien (USB-Speicherstick, DVD oder ISO-Datei) f", "Architecture does not match", " USB ", "5;5h5", " da instala", " de produit (Product Key) n", "ta BitLocker aizsardz", "tuma: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX9A telep", " atkursime, kai prisijungsite prie ", "dlelf", "ni minut.F", "e to dovesti do dodatnih tro", "klenirken bilgisayar", "cie Windows Servera 2019.LBudeme pokra", "CInstallUI::OnActionChanged: Posted MSG_INSTALLUI_UPDATE_PROGRESS", "Laddar ned Windows 10", "i sau conecta", "ggs till automatiskt)Det gick inte att l", "Hemos detectado que tienes archivos de instalaci", "akajte, da se namestitveni program zapre", "je a friss", "eba, aby se dalo pokra", " soubory. Zkontrolujte si p", " disponible si tienes una copia activada de Windows 7 o Windows 8.1 instalada en tu PC. Activa tu versi", "ou balenia disku DVD alebo ste ho mali z", "j dysk flash USB jest gotowy", "vCette cl", "ration va durer plusieurs minutes.", "RW0f0", ". Kirjoita verkosta ostamasi tuoteavain uudelleen.", "Kreirajte instalacioni medijum (USB fle", "%1!ld!%% k", "ckligt med ledigt utrymme. V", "<' > > >::Deserialize", "to pozorosti da biste nastavili s instalacijom.ZBitlocker izgleda otprilike ovako: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX5Klju", "XNepavyko atidaryti atsisiuntim", "Bitte wartenFBeim Ausf", "&Zaakceptuj", "`Esta chave do produto (Product Key) n", "informations sur la mise ", "n, sonra yeniden deneyin.'Baz", "Microsoft Windows0", "avo. Osve", "cii bude potrebn", "SqPq*p", " minst %1!d! GB.", "nseamn", "itamiseks. Sulgege installiprogramm ja proovige uuesti.,Windows Server 2019 installimine on nurjunud Windows Server 2019 installimine", "st, a telep", "sa\"Csak a szem", "me est survenu lors de l", "rez votre m", "n de un medio de Windows 10", "e instalacione datoteke=Instalacija nije uspela da odredi podr", "ntSA Windows 10 telep", " Operating System", "rcarea$Alege", "m s ur", " Windows 10:", "o de M", "avanja toga umjesto vas. Osvje", "teignez pas l", "ci, un p", "```PPP", "Wie m", "CSetupResponseTemplate::ExecuteRoutine: Back button clicked.", "Anna tuoteavain", "kkelen fungerer ikke. Kontroller den, og pr", "uA)E:", ", kuru m", "CDlpResponseImpl > > >::DeserializeRoutine", ".&Vaatimukset on t", "yScoate", "0L01YWeW0~0W0_0", ". Atnaujinkite s", "s espacio7%1!d! GB de espacio en disco libre necesario en (%2!s!)oQuita los archivos que ya no necesites o usa Limpieza de disco para liberar espacio y luego int", "slic.", "252Y2f2", "Todo listo>Seguiremos con la instalaci", "arhitektura nije odgovaraju", "ete da zadr", "ppp@@@@@@@@@@@@@@@```", "ljaande valimine", "bory sa ponechaj", "r den, og pr", "Selectare imagine", "rskendatud seadmedraivereid ja t", " sudaro tik 48 skaitmeniniai simboliai.;Grup", "fen Sie ihn, und versuchen Sie es noch mal, oder verwenden Sie einen anderen Key.KDieser Product Key funktioniert. Machen Sie weiter, sobald Sie bereit sind.", "ci wolnego miejsca na komputerze.Czy chcesz nadal u", " dost voln", "Mums nepavyko atsi", "- Windows 10 ", "ionat. Verifica", "!nnndG", "i Instalarea ", "wvVGGw", "Nu suntem siguri ce s-a ", "USB flash meghajt", " funkce se zm", " po prihl", "V:N`O(W", "Downloads>Verwijder grote of ongebruikte bestanden uit de map Downloads.", "ho miesta na disku (%2!s!){Odstr", " suorittaa ty", "vHr,g ", "us failus, rad", "utiliser est chiffr", "``agppq", "i aceast", " din pga. manglende diskplads. F", "4!4'4e4", "<;3E3P3W3b3i3", "050:0\\0", "3'3N3U3p3", "8L9x9", "t$4;M", "5b5j5", "394R4q4", "1(191@1^1", "L$4VP", "L$ PR", "malloc", "061M1", "5*6=6", "3!4H4O4m4", "g,n#L", "/0F0a0|0", "Af<8m", "QQVW3", "5%5\\5", "229879+4583620", "Trusted by:", "UnmapViewOfFile", "?U?v?", "J:QLx", "9!979", "L$(QW", "CI%'Q", "Squared Tate Q", ">!?Q?v?", "ZHM:c|", "1,1:1Z1", "WVj,3", "=/=m=", "VirtualProtect", "=8=?=^=i=w=", "HD_LQ", "wcsstr", "D$HPS", "uWjLP", "utf-16be", "D$09}", "uCjTS", ">E?\\?c?", "5-5T5[5z5", "7#8<8S8", "emailName", "5.5a5", "D$XPS", "010I0`0{0", "tYW9u", "20201008072501.689Z0", "9{(t0", "7I7b7{7", " !\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@", "N,:o,|", "TerminateProcess", ">?>F>K>Q>f>m>", "D$(34", "9(:>:E:", "<6<]7w7", "210211214039Z0", "2!3S3Z3", "authorizedPropertyPossessorCollection", "9 :f:W;", "0(1_1p1y1A2X2", "=A>H>]>v>", "http://www.w3.org/2001/04/xmlenc#aes128-cbc", ">)>D>X>", "ExpandEnvironmentStringsW", "1O1f1", ":`;g;", "u0a6=A", "3*3?3Z3s3", "bindingPrincipals", "cR>yH?", ">?>|>", "G;{ r", "t|N{Q", "8f;9u", "8a9h9", "_purecall", ":,;7;x;", "?+?1?@?x?", "040904B0", ")?0?g?w?", "HeapFree", "AlgorithmId", ">(>A>", "6Y7r7", "GetVersionExA", ")-#0\"", "Ch2KX,G", "\"i=7:", "200304183039Z", "p7^(\"", "D$T1D$$", ":$;C;f;t;", "162Z2s2", "708i8w8", "819\\9", "p05-msgrec wanted2", ":\":z:", "5$5F5", "-U=mV", ";%3", "=)=Z=", "0-1>1I1f1", "<1<8]iWT", ":D;T;c;s;", "888?8Q8X8_8", "465h5o5", "F(Ph\\~", "x>", "060P0U0o0v0", "5B5Z5{5", "YIUiI", "6(6C6^6y6", "api-ms-win-core-localregistry-l1-1-0.dll", "0;0@0J0O0e0j0y0", "6/7K7^7", "<8=D=K=~=", "count", "xfH2VD", "F$+F(;", "4%4G4k4", "receivePrivateKey", "4 4'4A4h4o4", "Iqzcz", "0f;1u", "@z.kT", "ProductDescription", "62797H7S7i7p7", "_:!q1", "p05ByteArrayToParams::temps", "oAxWC", ";(;H;g;p;", "1f;2u", "7O8V8`8g8q8x8", "w$WSP", "=6>|>", " ?NMZ^L2p", ";$>.>Z>w>", "0=0p0", "te9s(tY9s", "6)6>6E6u6|6", "VarFileInfo", ">(?1?U?", "')vx6=", "sdaym", "R@+A]0)", "f30r3", "=N=X=", "> >,>3>H>e>l>", "718n8", "98t\"P", "9},t~", "2\"2\\2x2", "\"O3`M", "DeleteCriticalSection", "7\"8C8i8", "1K1o1", "HZo6m|", "*>5>w>", "memmove", "1%2)2-2125292=2A2E2I2M2Q244#9g9", "6%6k6r6", "tr9;un", "9\"9'9-979?9E9N9Y9`9h9n9v9", "7$7:7R7j7", ";R<[5>X>{>", "9F@v)", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "allPrincipals", ":,:3:K:s:z:", "2\\2c2", "VirtualQuery", "2.3:3A3n3", "XNDs7", "303?3F3P3W3a3h3", "VVVV+", "(SVW3", "Exponent", ">+>O>v>}>", "\\$d3T$<", "Q9fFoFmo", "4/484e4q4", "PVVVj", "msvcrt.dll", "?456789:;<=", "MmS p", "0.0I0d0", "4C9W9", "GetCurrentThreadId", "2$3I3]3h3", "!|QMS\\", "wTz:;I", "4t;;7", "http://www.w3.org/2001/04/xmlenc#aes256-cbc", "3$3*353;3G3W3`3q3w3}3", "9(:/:B:I:|:", "D$4;D$8", ";|$Pt5", "=<=V=s=", "11282G2R2h2o2", "222M2h2", "FreeLibrary", "8?9Z9x9", "`.data", "D$(h$M", "i9s t", "=9=`=g=", "555Q5", ";/;`;q;x;", "^u&h@", "353I3", "I_RpcMapWin32Status", ">!>>>E>p>", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3", "<(<5G>j>{>", "propertyUri", "6@6p6", "9XA!F!", "bcrypt.dll", "ns%Yv", "uCjPS", "=B=[=|=", "Authorization Succeeded.", "propertyPossessor", "pkeyConfigData", "DRB>^>g>", "444B4I4T4[4", "1H2O2e2w2", "s$GSj", "6$6`6", "?.?9?O?V?y?", "=B=M=[=", "F~YYPgu", "UuidFromStringW", "< +>?>F>^>", "SetFilePointer", ":m>t>", "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", "CipherValue", "798E8w8", "t\"9\\$ t", "748=8}8", "Ly4xr", "\"'/cc", "tBC;]", "YoY=(", "8 8H8`8", ";G;N;", "9\":):M:", "Verifying Property Possessor Patterns.", "D$T1D$4", "D$09\\$H", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "A*%*d", "?\\?c?w?", "=[>s>", "<3<:1>8>j>", "7L8}8", ">#>*>5><>G>N>", "4 4(40484@4H4P4X4", ":\":-:4:<:C:N:U:", "1'1]1|1", "=@=g=n=", "Pid Generation", "=(>A>n>u>", "InternalName", "5@5a5|5", "Patterns Successfully Matched.", "Microsoft Corporation1.0,", "29q`u", "0(1/1A1H1q1", "0/1h1", "q !A$", "H xv~", "T$`+L$", "=%>\\>u>", "250701214655Z0|1", "2?3x3", "KeyName", "R29oiQq", "=?>n>", ".>C>|>", "memcpy", "121S1}1", "SVh0M", "GetModuleHandleW", "Algorithm", "l?t]R", "=%=E=g=n=", "anXmlPatternAbstract", "x v+|]", "u+j$W", "<[)?B?[?t?", "t]91uY", "0A0M0T0", "5/5W5x5", "Washington1", "WakeAllConditionVariable", "656v6", "2%3r4", "7-8U:\\:r<", "6E7N7j7", "L$$VQ", "L$43\\$T", "space", "?8???U?g?", "uvj$P", "<+<6deallocateDigit", "`}&wB", "?C?p?w?", "%{I*(", "GetModuleHandleExW", ".tls$ZZZ", "Authorizing License:", "4I5k5", ":B:\\:", "sidPrincipal", "Hl91t/", "uCh0g", ">#>*>", "4*4C4q4", ":,;9;V;\\;", "2%3,3Q3i3p3", "Rw~Og[", "8&8b8", "222=2K2", "9I:l:", "yzAm*", "j{Zf;", "D$0+t$H", "2Y2l2s2", "808I8h8o8", "5*6E6", "5D5j5", "Cf;:u", "1&1d1", "FileDescription", "HPWWj", "!_0^_", "878Q8k8", "_XcptFilter", "j0X+E", "5/oO'", "7,7?7", " p:", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "0\"0;0T0p0", "Q9t$7K7P7U7c7h7m7w7|7", "?1?B?I?R?Y?", "8,8F8`8w8", "+T$0+T$", "9V0tQ", "7'7.7A7I7O7U7[7d7z7", "?3?N?i?", "http://www.w3.org/2000/09/xmldsig#", "C#V_h", "2E3m3", "RefGroupId", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "2:2t2-4", "2M2c2}2", "_CIlog10", "6!6<6j6", "Microsoft Corporation", "+t$,3", "GroupId", "0!0C0j0q0", "/]_X,ok", "=(>O>V>v>", "9,:?:F:T:[:b:", "RoGetActivationFactory", "Ty[w*", "`jB{%", "CoCreateInstanceFromApp", " _^[]", "==>{>", "t^9{ tY9}", "T$03t$,", "\\$(taQ", "<%=Z=", "1X1_1", "?B?k?r?", ";/>?Y?v?", "626=6K6", "5&555@5V5]5", "_ftol2", "LoadLibraryExW", "4d5C7[8", "policyInt", "authorizedPrerequisiteRight", "!D$,9D$", "8+808K8Y8c8", ".text$mn$00", "=)=X=_=z=", "PSWQh", "J;]Lx", "d>grj4f", "808k8", "EtwEventRegister", "to@f;", "5m5w5", "7;7[7", "?3?I?P?b?i?", "60?0{0", "?)?O?V?]?", "api-ms-win-core-processthreads-l1-1-3.dll", "9t~E_{w", "priority", "P!pe,", ";H;O;a;h;o;", "cpi5v", "9=:F:j:", "=0>`>", "t_VVRPVh", "5\"6p6", "<3=:=P=x=", ":3pj?p", "EtwEventEnabled", "T$(1D$(", ",MjfQ0B0v13jSLNlGWDK001SokII+h+dNiFl1wiJNWXI=0Z", "3+3E3", "()/xk", "PA8>Y>", "8%9A9H9^9", "Software\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform", "WideCharToMultiByte", "\"Microsoft Window", "9.:A:Q:", "p05-msgrec betanow", "9t$(u", ":?;x;", "?+?2?R?]?k?", "8+878B8*9>9r9", "DSVWh", "515n5", "p j@Z", "=2=I=d={=", "http://www.microsoft.com/DRM/XrML2/SL/v2", "productPolicies", "5.555P5", "DE:~[", "6!7T7{7", "T$,VPSW", ":!:(:Z:u:", "EncryptedKey", "5,515T5Y5", "allConditions", "Jh3pq", "879Z9q9", "1&2:2S2o2", "u&f90t", "Authorizing Grant Issuance.", "7+7j7q7", "9)929K9", "urn:mpeg:mpeg21:2003:01-REL-SX-NS", "6)6M6T6s6~6", "8B8`8", "K.[h[", "00000", "# zwB", ":D:]:", "+T$$3", ">+>6>Q>v>", "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@", "='>0>C>L>c>l>z>", "ADVAPI32.dll", "kM=JA", "uGC;]", "2h3o3", "819:9`9", "EnterCriticalSection", ">L?p?", "5)5w5", "485|5", "1J1Q1l1", "8&;8!'", ">2>V>", "3$4<4]4", "4O4V4}4", "`[$H-", "8,8F8", ">\"?I?P?x?", "D$8B3", "uRjhS", "zZT1oH<", "Volume", "_&P#>d!!m", "SVWPPj", "timeOfIssue", "VVRQj", "485?5Q5X5_5", "u(h0g", "1J2x2", "NjB{%", "*nK'D@*", "6E6S6", "CipherData", ":E:f:", "8?8J8X8", "9!9G9Z9", "<;\\$ s", "515I5`5", ":o;~;", "7b7x7", "4.434I4N4X4]4", "4)444", ":0;7;g;", ":Z;s;x;};", "30353X3", "QSPVhPq", "OXU}5>", "QQSVW3", "4#4.4D4K4R4x4", "j$QQj", "1/0-0", "qyW)4", "172Z2q2x2", "575R5", "0.1M1a1", "4%5,5X5_5", "du>j Xf9DY", "041B1^1e1", "29q0u", ">!>M>T>s>", "<%+>3>M>o>u>", "CryptSignHashA", "9u$tv", "0S1u1|1", "value", ">)>0>;>B>X>k>", "CryptHashData", "203G3f3", "373N3[3b3}3", "http://www.w3.org/2001/04/xmlenc#sha256", "D$<1D$", "7M7Z7w7}7", "\"$D#v", "4,+J|", "1$2;2R2f2", "PSVWQ", "4/464<4H4X4^4", "msft:rm/algorithm/pkey/985", "=(>?>W>", "tEhtQ", "utf-16", "InitializeCriticalSectionAndSpinCount", "=@>G>e>j>", "929X9t9", "6\"7V7g7r7", "\\:Hef", ":N:h:", "4$4:4f4~4", "uIjdS", "LegalCopyright", "=0>K>", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "7M8T8v8}8", "Y__^[", "vN'5n?Lb", ".idata$3", "<+!?S", "4D4b4", "252:2b2", "2'2E2y2", "Ynl,+", "6L6Y6", "J+da@", "D$PPS", "F-b<5", "6!6[6", "shortsig: external_key_to_internal", "privateKey", "$`2X`F", "4<5a5", "FS7RA", "M0K0I", "Value", ">&>I>", "q`WNX", ">~L[Z", "Bxo*1", "<1<:0E0r0", ".edata", "?6?=?m?", ">9~ t", "9XLt=", "6:6X6", "9>9M9T9", "0@0W0", "[*!4@L ", "Oim|o$XV$", "T$$3|$H", "9=:{:", "959G9R9", ";*;L;[;`;~;", "0\"0R0r0", "=(>e>", "4&5b5}5", "5,636", "3%3,3X3c3", "]kA~@", "7=8o8|8", "?K btV", ".00cfg", "tD9s,t?", "9 989=9W9a9{9", "=+=9=D=n=y=", "1%1/1@1L1", "9 :):::A:", "r4o[AR4", "WVhhR", "j;XPW", "@IG`g}a", "productIdRange", "`jB~}", "T#*fn", "4!4(414w4~4", ">P>W>v>", "+T$$3T$", "L$ QW", "626Y6`6", "1NwUw", "QVPSh", "GetCurrentThread", "InverseQ", "http://www.microsoft.com/xrml/lwc14n", "313h3o3", "+T$03", "D$$PS", ":2:S:h:u:", "99:R:k:", ".data$brc", "0/0W0^0", "VWjVX", "IsProcessorFeaturePresent", "Microsoft Time-Stamp PCA 2010", "uCjLW", "4+5_5p5{5", "N)yD=ej", "6G6e6", "D$(PQ", "=0S0_0", "encryptedGrant", "5X6h6m6}6", ";1;8;?;i;", ":N:s:", "3i3r3", "; ;6;k;", "Legal_Policy_Statement", "1o1[4}4", "8@9G9p9", "03612", "ProductKeyConfiguration", ";%;,;4;;;P;j;", "_wcsnicmp", "T$$3|$D", "http://www.microsoft.com/DRM/PKEY/Configuration/2.0", "L$4+t$", "License Authorization Failed.", ";2;Y;`;", "8,939", "ProductKeyType", "=T>t>", "1(0&0", "y~0kA", "pidgenx.pdb", "; ;+;2;", "1:1S1v1", "010J0c0", "~}ed1nU[", "1,131X1_1q1x1", ":(:o:", "0(1-1O1", "[!Hv(lq", "7!7W7a7", "!F4!F8", "tAiI2", ":$;+;_;", ">E>Z>a>", "vhX ?", ">&>x>", "?!?`?g?", "u0j8S", ">+>Z>a>|>", ":7:<:^:", "c0xc>", "7A7H7l7s7", ";$;K;R;t;", "9)919Y9", "F0K0]0b0t0y0", "5!5(535:5", "2+2N2_2j2", "0/0W0", "L$494", "1%212L2s2", "SignatureMethod", "1M1Y1`1g1|1", "|$ !D$", "2:2b2m2", "gR|n=", "<0=d=u=", "9,9C9M9~9", "<#<*!>m>t>", "=<>G>", "6(7/7A7H7O7", "3$4?4Z4u4", "CompanyName", "? ?e?", ">Y>{>", "3H4\\4i4p4", "EditionId", "0<0T0k0", "?!?*?I?h?", "uMj@S", "aA*qL", ":$:M:", "9H9Q9r9", "D$(PVS", "[Kp\\e", "identity", ";1;^;3", ">1?c?j?", "3(3-3O3}3", "1W2e2", ";&+>S>Z>w>", "p05ExternServerContextInit::ctx->internal->temps0", "8!8B8K8|8", "=?Tpx", "4/4K4t4", ":%;<;W;r;", "9.:?:M:", "8\"8^8", "7#7)7/74797>7C7L7S7Z7a7h7o7v7}7", "!D$$3", "infoList", "9{Dv.V", ";G;i;p;", ">e[)H", "O[pU<", "u8cH%", "PRhXZ", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "v QPP", "0]1d1", "10.0.19041.572", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "7$767A7S7^7", "20201009141603Z0w0=", "9'9|9", "=h=q=", "WV!p<", ":0;P;", "GJ/wd", "\\$x3t$D", "Matching", ">!>]>d>s>~>", "2P2n2x2", ":::A:c:", "D$T1D$", "N$+N(", "fJ\"0#/rg", "4%4,4f4m4", "<&<+?E?d?o?}?", "{\\BAKm,~", "?\\?|?", "6\"6'6,62676=6B6H6N6T6Z6`6f6l6r6w6|6", "9H:Q:u:", "82898v8", "GetVersionExW", "0?0F0[0", "varRef", ":$:5:<:G:N:f:", "?'?P?v?", "@;F@r", "UO^|e", "uQ9D$", "8&8;8^8e8", "msft:rm/algorithm/pkey/980", "{X\"V|", "=K=V=d=", "7#787^7i7p7", "Microsoft Corporation1200", "f94Wt", "3(4/4A4H4", "081x1", "r$SRj", "+t$ 3T$<", "5<5V5n5", "71888M8f8", "t$ht$", "505;5O5v5", "HeapAlloc", "<5<<1>L>g>", "PublicKeyValue", ".CRT$XCZ", "Gp9P$tU", "4N4k4", "2I2P2k2", """, "595@5b5", "CryptReleaseContext", "5G5{5", "6\"62696u6", "0h0o0", "Y3yhP", "3!3G3n3u3", "2C2_2", "CreateEventW", "7%7<7_7", ";&;-;7;>;H;O;Y;`;u;", "Microsoft Enhanced RSA and AES Cryptographic Provider", "=0=X=_=", "5(6,606A8", "uCj9?R?k?", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "CryptGenRandom", "7'818g8q8", "4@4G4\\4", "3)3C3N3o3z3", ">&>A>", "Q8#0P", "7yMS\"l", "notAfter", "2\"ng?", "iZS.2", "9c9j9", "productId", "8E9j9~9", ";;;I;", "<-=X=", "QSVWh", "s`!Cd", "7S7i7p7y7", ".text$yd", "D$41D$", ";5<{<", "policySum", "8 8?8X8j8", ".CRT$XIAA", "'0.0W0b0p0", "=*>1>F>K>a>h>", "4B4f4v4", "2y>Oz@#", "ry@wh", "4#5d5", "J`'Ec", "8$8)8;8@8J8O8`8e8q8v8", "<.<5:>f>", "+0vSN", "1%1f1m1", "W93t[", "retrievalString", "T$89\\", "8\"8)8", ";5 >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "kXJ\\C", "0#0S0", "9\":;:B:", "Authorized Grant Verification Succeeded.", ":$;?;Z;v;", "ReleaseSemaphore", "B\"5_xf", "=1>8>C>J>", "JE2rj", "N021Z", "w#V,N", ".S_P4f", "?H?g?", "Microsoft America Operations1&0$", "6\"6:6", "aGKDI", ">0?]?", "v),KZbW", ";9;[;", ">!?B?X?_?", "!#&dI", "GetThreadPriority", "runSoftware", "j0Yf;", "484S4n4", "3#4i4", "<+", "4j5q5", "6z9y+E", "InitializeCriticalSection", "anXmlExpression", "RAL1z-", "2,232@2G2]2u2}2", "u3j@V", "proxyExecutionKey", "Microsoft Corporation1&0$", "GetModuleFileNameW", "8L8f8", "-TT*2", "2'3h3q3", "8!878B8a8", ":):.:@:E:O:U:\\:a:t:y:", ":):0:7:h:o:", "EV6CSqC", ":6:N:", "sU)Fb~hc`", "AuFO=", ":8:K:", "GetFileSize", "=0=X=_=u=", "Modulus", "!LK!(", "ReleaseSRWLockExclusive", "4/5i5", "7&7z7", "2V2w2", ".CRT$XCU", "QPj@j", " !\"#$%&'()*+,-./0123", "?&?+?=?B?T?Y?|?", ";Y;r;", "C;_0r", "bv#mE]", "0Q0x0", "2%2i2v2", "KeyInfo", "<#<*<83m3", "=?=F=\\=", "tNj,V", "t4h$g", "+0O0s0", "Wmh^1KY", "9!:^:v:", "!e%!u", "2h2o2", "2>2U2\\2", "8\"8;8W8p8", "0?0w0", "9E9[9e9", "api-ms-win-core-com-l1-1-1.dll", "9I9P9t9{9", "1#1_1", ";!;,;3;};", "uCj8S", "41565n5s5", "2@2O2", "encryptedContent", "$\"wJ&", "7W8l8", "7I7P7Z7", "506G6f6", "=8>_>", "PWSQhPg", "000Y0", "ActConfigId", ".data", "Thales TSS ESN:3BBD-E338-E9A11%0#", "7'7.797@7K7R7]7d7m7t7", "msft2009:%s&%s", "@@@@@@", "t Cg1H", "tGj0SV", "686U6x6", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "+t$(3", "UIt(;", "C@Phli", " Windows", "3=8`8r8U9", "5S5u5", "D8#!?", "3\"4U4|4", "5'5O5y5", "161=1n1s1", "/-j>Bv", "papi-ms-win-core-winrt-l1-1-0.dll", "_sz&m", ">!>,>b>", "?1?8?p?w?", "8&9c9", "<+<2F?i?", "=!>r>", "7\"797q7", "(Pln5", ">6?Q?q?", "j9Xf;", "wcsncmp", "@6JxC", "536R6w6", "030:0W0", "N^B/8Z", "s7vh\\g|N5", "?X?_?q?x?", "7:7\\7", ">`?g?", "2<2E2P2W2i2o2u2{2", "keyHolder", "90:r:", ";=;h;", "L$XG@", "=0>N>S>", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "6H7O7d7", "%3333", "3 4B4I4_4", "L$ 3D$,3", "8S9Z9p9", "7K7U7", "2>9>Q>x>", "GetCurrentProcessId", "<0 ?&?S?Z?x?~?", "3.3D3|3", ">U?^?", ";-;F;b;~;", "Yw]es", "===t=", "SumPSQR3", "Verifying Remaining Patterns.", "51565X5|5", "999J9U9", "'z}B ", "7G8]8h8", "T$01D$0", ":\":_:", ":jqZb", ".idata$4", "414X4_4}4", "|$@3T$<", ">9?@?h?s?z?", "SVWj3^", "a_dv?M", "> ~\"1i", "0:0k0", "PVShPq", "?4?O?j?", "Authorized Grant Verification Failed.", "2A2H2h2", "8>9U9", "2$3\\3w3", "=!=a=n=u=", " 4V+283", "6:7L7u8", "5D6R6", "issue", "9g9I:P:", "9^`IH", "2P7c7", "t9htQ", ".CRT$XIA", "4(4/4h4o4", "=3`3r3H4", "?5?D?I?j?o?", "=2=T=", "D$(3<03", "4#515?5", "111019184142Z", "m~ZdtXR", "oi,J6Q", "0k'-%8", "1C1j1", "VirtualFree", "?H?O?e?w?", "8!8[8", ";6;U;n;", "wildcard", ".rdata", "585z5", "1-141G1n1u1", "D$89E", "http://www.w3.org/2001/04/xmlenc#sha512", "L$P9D$|v.", "<`D?V?n?", "?X?_?t?", "9{ v)V", "F]:/[", "OriginalFilename", "0\"1)1T1[1", "default", "3$3+3@3[3s3", "x8@1sI", "707H7O7d7", "right", "SetThreadPriority", "Microsoft Corporation1%0#", "eN?T.", "msft2005:", "9n:{:", "lL7Ki\"0", ";Fn>u>", "80A0Z0a0j0q0", "2k3~3", "5fu", ">1?g?", "555F5Q5", "renderer", "tOhDg", "5'6>6R6", "^YkSu_", "4(4@4^4{4", "0123456789", "CryptGetHashParam", "1H1`1", "^}-$rb", "}x@'5", "?Y?s?", "5_2G#", "252Q2~2", "8)8n8", "6*6T6", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", ";(/.e", "http://www.w3.org/2001/04/xmlenc#aes192-cbc", "4'4-43494D4K4Q4[4j4r4~4", "586?6T6g6", "444K4f4w4~4", "~[#XzN", "1E1O1", "0:0}0", "7$8C8Z8a8", "1O1V1u1", "L$ QP", "<\"===F=d=", "r3>.L", "<,n0p7", "[wZtP", ".idata$2", "D$,;D$", "|$09|$", "<\"<8<", "='=.=I=t={=", "v0`zLQ,", "O4_^[", "1q2z2", "051I1R1{1", "4+4D4]4", "=,=S=Z=", "u.f;U", "UjO13", "r.Fj0Xf9", "<25C5H5N5U5\\5c5j5q5x5", "9\\$ t", "3g4{4+5,6", "LeaveCriticalSection", "5V6n6u6", "T$ 1D$ ", "303[3b3}3", "UI\\k-", "w<;Si", "3=3W3", "5W5c5", ".rdata$T$brc", "AcgApi", "?6?H?", "3P3W3f3q3", "5\"6F6", "4,5f5m5", "ProductVersion", "424S4}4", "tmE'u]", "2(2E2b2x2", "PVSQh", "authorizedPrerequisiteRightCollection", "RSAKeyValue", "!D$#>->2>B>G>Q>[>n>s>", "TSVW3", "= =:=T=", "oN\"8L", ">%c!i", "1!2@2M2", "=<>[>", "VirtualAlloc", "SVRQhX", "s$WSj", "273T3v3", "|$03t$,", "0J0d0m0", "Z%.Tg", "7'7A7H7R7Y7", "4,575J5", "$SVW3", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "4>5e5l5", "j-Xf9F", ":G:e:", "?&?b?", "decryptWithPrivateKey", "?(?H?", "2G2`2y2", "ov+`Uv", "9_0v'", "O@_^[", ":#:N:i:", "definition", "{6V#;s", "A4jXj", "L$x3t$8", "7#797", "?.?T?[?h?", "GetProcessMitigationPolicy", "VS_VERSION_INFO", "GetSystemDefaultLangID", "T$$G3", ";\"<:<[<", "6'7h7", "<7=A=K=", "rl1]zuc", "LocalAlloc", "WindowsDeleteString", "pidgenx.dll", " t:", "q1I>w", "?RAjT", ";D$$w", "8N8m8", "prerequisiteRight", "?2?J?g?", "3b6@s", "CryptGenKey", "[f", "PSWQhPg", "ijLXPWS", "+R^ic", ":3:x:", "1.2J2", ">L>e>", "???g?n?", "PWSQh", "tFQRP", ";+;>;C;I;];b;n;", "=%>,>W>", "dC8`D*i", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "<+<2A?H?r?", "=%=0=Q=]=d=", "S8g{)", "j:Xf9F", "#>*>5><>", "PWVRh", "_unlock", "3*3t3", " P%K`,", "1,131U1", "O Qj@j", "7:7C7[7h7~7", "3m'SK'pr", "q$Ggl", ":F:M:", "j Xf;", ":9Lmj", "uCj\\S", "SquaredTatePairing Pmul", "8.959Z9{9", "858C8h8", "7_8#9", "181W1", "u=C;]", "s$HSP", ">:>C>a>", "-WnjI", "j\"Xf;G", "FHPhd~", "3w1]_", "[O2^'", "aM7b]", ";.;G;N;p;", "73888Y8^8l8s8x8}8", "DA4z{", ".giats", "<3<:", "=9~0u8S", "securityProcessor", ",0G0P0o0", "7m7{7", "k(aK`", "SV]qG", "4P9s9", "575_5", ">->H>c>~>", "-+-SW", "holdsPrivateKey", ")Microsoft Root Certificate Authority 20100", "536:6k6", "90:K:c:z:", "PWSRhPg", "=/=4=V=", ">6>x>", "noBinding", ">K?|?", "AcquireSRWLockExclusive", "7;7F7T7", ";$;K;Z;a;", "100701213655Z", "0/0M0a0g0", "636|6", "Retail", "msft:rm/algorithm/pkey/2005", "WaitForSingleObject", "H?|`7IoJ", "172v2I7]7", "2H2u2", "<7", "858<8g8", ">/?6?", "7,878W8", "=T=k=t=", "tzje[", "5Q6X6c6j6", "8L8h8o8", ";+<<<`S>i>", "XSVW3", "=,=3=;=B=J=Q=", "261019185142Z0", "CryptCreateHash", "6&6S6", "959B9I9a9q9", "6f7m7|8", "90:7:", "='=2=M=", "575`5", "5M6f6m6", "ReadFile", "1}[0d", "UsR|#p", "9%92999J9^9", "#D$@+", "4$4W4|4", "7<7]7w7", "6Y6r6", "8%9g9n9", "2W2p2", "u/9D$$u", "7!8B8i8", "1>1E1O1V1`1g1|1", "2-343", "FileTimeToSystemTime", "2&282?2T2{2", "qp!At", "8$9+9v9}9", "keyUsage", "H(u(/", "VSWRQj", "9)909J9r9y9", "KERNEL32.dll", "3%3@3[3r3", "8 ;';", "|X4)#o", "= =;=V=", "9~$vG9F4u", "Signature", "898T8_8", "?;?x?", "5(6/6A6x6", "0J0f0m0", "SetEvent", "6'6:6~6", ":::A:f:", "1'1=1y1", "4o[AR4", "=3=k=", "u-jAXf9E", "2 2;2", "\"$9a%k$", "`\\}3g}", "2,2G2b2}2", "393@3K3R3f3", ">(?/?A?H?", "variableSubstitution", "YxC%T2&", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", "validityIntervalFloating", "QQSVW", "V9_$v,", "2e6t6", "696S6m6", "MdDy,S?", "= >F>", "<.=r=", "82898D8K8V8]8h8o8", "$(>1vpc", ">i?p?", "0-1T1[1}1", "292@2h2", "tk9pDufW", ".text$mn", "YQVO4", "RpcStringFreeW", "7(7F7q7", "u?jPS", "2U3l3", "propertyAbstract", "(5XO4&S$}", "323K3d3", "5G6i6", "rxy(p", "signWithPrivateKey", ";Q0s#", ">+?K?", " ,-z6", ">9>`>g>", ";PFr", "jE[f;", "GetCurrentProcess", ">$?}?", "trustedRootIssuers", ">w eP+p", "<'=Y=s=", "7d7m7x7", "3\"4B4d4", ">K>W>^>", "utf-16le", ";=;H;V;", "TraceMessage", "businessRules", "8B8N8", "Microsoft Windows0", "=?=k=r=|=", "=0=7=\\=|=", "4Rich", "29q8u", ">K>f>", ";Yz0B", "Configuration", "msft2005:%s&%s", "2(4`4L7", ";9http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", ">\\>{>", "9K:R:g:", "tiS;y", "2W3\\3~3", "29q8U8o8", "6*6F6i6w6", "licensePartIdRef", "xrml:auth", "SetLastError", "0(0K0\\0g0", "7@8L8X8", "2E2", "SVWh(", "O8[_^", ":(;C;L;j;", "GetProcessAffinityMask", ";$;,;6;D;P;^;f;l;", "3p3y3", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", "6 6K6u6", "='=B=^=p=x=", "2X4p4", "3R3l3", "=&=K=Q=a=}=", "9A9i9", "Hbg&~", "r4o[AR4;", "9':.:b:", "9(949;9l9", "W;n~F7}M=;ZP", "768u8|8&9/9Q9x9", ":$:(:,:0:4:8:<:@:D:H:L:", "5.5O5p5", "lV! Uy:c9", "2l2s2", "6!6/646E6J6[6`6n6s6", "=)=0=F=m=t=", "7$8y8%9", "KCf'4", "authorizedGrant", "4'4?4p4", "141<1C1l1", "symmetricKey", ":\":,:^:v:", "=/=V=", "=?>F>", "8g9v9}9", "uPPj@Z", "\\?AIY", "10E0T0Y0", "8 8:8", "9/9C9\\9x9", "7k7v7", "C_k6'", "uIjPS", "u4C;]", "TlP0X", "909K9f9", "1V6l6", "&", "j>Xf;G", "licensePartId", "$l-?`", "1I1b1i1", ";U;v;", "u$f98t$f", "070>0V0}0", "uwj0W", "Reference", "=5>w>~>", "<2", "LocalFree", "<-V>i>p>z>", "3%4H4O4r4", "; ;';C;`;", "3*383C3x3", "assurance", ">'>@>", "O,Wh]", "O VSRj", "GSQ^z", "FXPhl~", "8C8J8j8", "3[3l3z3", "_except_handler4_common", "condition", "9 969=9i9t9", "2$2)2@2E2S2X2g2|2", ";|$@t(", "7(7H7S7p7", "=b=k=", "96:n:u:", "6'6h6", "EulaType", "Verifying Trust for Authorized Grants.", "uhhPg", "gWindows.Internal.SecurityMitigationsBroker", "_wtoi", "57m4'", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "2Y2x2", "182h2o2", "as4s-", "2(3/3B3I3", "xmlns", "93B**", "555@5N5", "&]Iv ~,#", "6R7[7", "9<9u9", ";!;\\;t;", "notBefore", "qnnC<", "9.959U9j9", "%Microsoft Windows Production PCA 20110", "20201008141603Z", "030W0", "BCryptGenRandom", "4\"4s4", "666U6", "7<7C7h7o7", "C;\\$,", "uuj0P", "issuer", "OT_^[", ")?B?g?", ";5;`;g;", " xmlns", "j Xf;", "urn:mpeg:mpeg21:2003:01-REL-R-NS", ";8n", ":8;u;", "=(=O=V=t=", "3L4u4", "JC&|x2", "XPs00R", "rVjl3", "FhPht~", "/-/)4,S", "trustedLicensor", ":%:g:r:", "3:3?3i3n3", "i*yV+?J", ">>?m?", ";1;X;_;~;", "msft:rm/algorithm/pkey/2009", "CreateThread", "0$0I0p0" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "8284b15c3cf3271ecd4625904fba003f48bfe9c9b84a954880512dee095e32e6", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/8284b15c3cf3271ecd4625904fba003f48bfe9c9b84a954880512dee095e32e6", "guest_paths": [ "overlay" ], "size": 8504, "crc32": "41953157", "md5": "e985c058f40a725c39db9ab2886246d5", "sha1": "3345ba049ef1b2557226fa80b8c54a7a08f3d2c2", "sha256": "8284b15c3cf3271ecd4625904fba003f48bfe9c9b84a954880512dee095e32e6", "sha512": "cf4287bbfbd02a55640d5e9fd7f2da7b40b068fdd0e077ea9bd0a161b35d338b8973536930cdbb67797f0de3707a4d9371d8ce3e29fa62b1eadb2b478d743599", "rh_hash": null, "ssdeep": "96:f9MDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGuGDXsd8ZaDuTgDf/DV:Vr8VHwDDBQABJT+wCNxXeRqnajIhNKB", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1970219C18F681443EAA7BD5013A8F9D77D3C93CB2820446665AAF9A82CC77C6EF0456D", "sha3_384": "eb0feff3dc4b941f71e8e78f49a9fd049e93685bba1e0c20e9cfca72fbd1e93573d54624992dc5971ab8d4f34b6b01a8", "data": null } ], "extracted_files_time": 0.0005308010004227981, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "pkeyconfig.xrm-ms" ], "path": "/opt/CAPEv2/storage/analyses/3/files/a3471eb8dc2c3045e33eb48abaef4046eeebbe30161a52f7056f68e479400823", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" ], "size": 582696, "crc32": "EA161349", "md5": "7d72243366184b4048a90af77d63f21c", "sha1": "4d1a0cb9cc75b1ac7dbec285da7b90fbc85b3892", "sha256": "a3471eb8dc2c3045e33eb48abaef4046eeebbe30161a52f7056f68e479400823", "sha512": "a223abbd4c3d3cdc6c1fe345e68613e0225b583d7c8705a89b3a9f91dec96ec20428066830147642816b6b6628c7def368e89cc91d2378aa001cab9e3bee71f3", "rh_hash": null, "ssdeep": "6144:GeUJmDlHwVeCx2qTMTTnaP/d5/NbyBNiX4OOqd:GfARHwVeCx2qTMTTnaP/d5/NfJ", "type": "XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T124C4C54267A30874E2FA2CCC2E74D8DF95B1ABBF6AD36DD4A33C47414C61142DEA3919", "sha3_384": "26ea4d860dbcac286a52694d651da026e744e902a79a77847f9116c5bfb8787826b858435880bc55243f225c9f5e2d4c", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\\xfeffXrML 2.1 License - Product Key ConfigurationAM88tJM/7qpuE9kzeYjkyRVvHkQ=PWzqO0CQ/zvdWvsWvvzedwuiQkUffzy6lObE9lyuXs51deJdVX04mcG5sNs3IagG33I3yMRU6PwopbfsX2r7WYPsokvjr4O0ZjLeR/L9RuiZj143SfppVbPmG2hBmDaLBM6cTbvvtnjnE/Z8UErHYSUdbxqK8EudVX3/iQwQQhLbCbXGB/FtLGNSV/hopcYAh+H7qNgRxwgWgER/yMguzpA1izELdxIM2BGbDF8zWoJeKLG0qsa9W3ePKOhXeh6bqyCMB7lRdsDE+9bgkf8uQq1DYQe02y91jZ4+PmoXlHjaxAA7TGSJIxWAQr8m2qeBZHO8Depzx4VQx/561780aA==1N+QaYteSIjGmRMzTkxCE+5oiPoLk2Fq+RA9GLnl+dHOcyxt2a/0HvUdagaL/NwDquzOef4JOMMuVavd4PtWQiO/aBLvxVv7yIhUhhB6PEsw59mhbVlT/Z5OGkp6gfzH9ezZ+qHHFHo0cloAAu5QGUeuYCPLheVK7X3+syHE1qXagfRa5m0xG+770FyPeMKazK+keeQ/goW+nt2wTM9Pofj4yTGCbn6Fc6EpKdyHmzrzQDc5FjZemXP2PbGjS6iPC7l3+Ut5JPL66ZUZzCs5qRc+/wRODknUWAcqURJWP79knfPhf3/dvbytHpr64wFfpBNDSbNVubol0E8oTa/NYw==AQAB2016-01-01T00:00:00Zmsft:sl/PKEYCONFIG/SIGNEDmsft:sl/PKEYCONFIG/SIGNED2.0PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4NCjxQcm9kdWN0S2V5Q29uZmlndXJhdGlvbiB4bWxucz0iaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL0RSTS9QS0VZL0NvbmZpZ3VyYXRpb24vMi4wIj4NCjxDb25maWd1cmF0aW9ucz4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPns5Mjk3Nzk2Yi0zOTcyLTQzNDctOTA2ZS03ODkwNWRhNTQ3ZTJ9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjM3ODg8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlckF6dXJlTmFubzwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE2IFJUTSBTZXJ2ZXJBenVyZU5hbm8gUmV0YWlsPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+UmV0YWlsPC9Qcm9kdWN0S2V5VHlwZT4NCjxJc1JhbmRvbWl6ZWQ+ZmFsc2U8L0lzUmFuZG9taXplZD4NCjwvQ29uZmlndXJhdGlvbj4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPns5MjExNDMxOS0xMmVhLTRiY2EtOWQ2My04NzQwZGU5ZmVmZjN9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjQyOTA8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlclN0YW5kYXJkPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkIFJldGFpbDwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPlJldGFpbDwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57YzJkMjNlMWYtZWUzZS00NTMzLTkwOTQtZTZkYzBiOGFhMDQ5fTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40MjkxPC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE5IFJUTSBTZXJ2ZXJTdGFuZGFyZCBPRU06Tk9OU0xQPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+T0VNOk5PTlNMUDwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57ZmQ5NDY1OTQtNmYwZC00YzVjLTliZjctZjVmNjI4ZWNkMGI5fTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40MjkyPC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE5IFJUTSBTZXJ2ZXJTdGFuZGFyZCBPRU06Tk9OU0xQIChNVUkgbG9ja2VkIHRvIHpoLUNOKTwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPk9FTTpOT05TTFA8L1Byb2R1Y3RLZXlUeXBlPg0KPElzUmFuZG9taXplZD5mYWxzZTwvSXNSYW5kb21pemVkPg0KPC9Db25maWd1cmF0aW9uPg0KPENvbmZpZ3VyYXRpb24+DQo8QWN0Q29uZmlnSWQ+e2QwN2VkYmQ4LTAyY2ItNDliMS04MzU4LWYyZGU3YWZkOGE0ZH08L0FjdENvbmZpZ0lkPg0KPFJlZkdyb3VwSWQ+NDI5MzwvUmVmR3JvdXBJZD4NCjxFZGl0aW9uSWQ+U2VydmVyU3RhbmRhcmQ8L0VkaXRpb25JZD4NCjxQcm9kdWN0RGVzY3JpcHRpb24+V2luZG93cyBTZXJ2ZXIgMjAxOSBSVE0gU2VydmVyU3RhbmRhcmQgT0VNOlNMUDwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPk9FTTpTTFA8L1Byb2R1Y3RLZXlUeXBlPg0KPElzUmFuZG9taXplZD5mYWxzZTwvSXNSYW5kb21pemVkPg0KPC9Db25maWd1cmF0aW9uPg0KPENvbmZpZ3VyYXRpb24+DQo8QWN0Q29uZmlnSWQ+ezQyODViYmRhLTYyMTktNGMxYS05OGU5LTg1OWU2MGQ2NjlmYn08L0FjdENvbmZpZ0lkPg0KPFJlZkdyb3VwSWQ+NDI5NDwvUmVmR3JvdXBJZD4NCjxFZGl0aW9uSWQ+U2VydmVyU3RhbmRhcmQ8L0VkaXRpb25JZD4NCjxQcm9kdWN0RGVzY3JpcHRpb24+V2luZG93cyBTZXJ2ZXIgMjAxOSBSVE0gU2VydmVyU3RhbmRhcmQgT0VNOlNMUCAoTVVJIGxvY2tlZCB0byB6aC1DTik8L1Byb2R1Y3REZXNjcmlwdGlvbj4NCjxQcm9kdWN0S2V5VHlwZT5PRU06U0xQPC9Qcm9kdWN0S2V5VHlwZT4NCjxJc1JhbmRvbWl6ZWQ+ZmFsc2U8L0lzUmFuZG9taXplZD4NCjwvQ29uZmlndXJhdGlvbj4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPnsyODFjMjE2YS01OTU3LTQzOWItYWRmMi1hZmY0MDk4YTJiZGR9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjQyOTU8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlclN0YW5kYXJkPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkIE9FTTpETTwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPk9FTTpETTwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57OGVhNTZjMzEtZmU2ZS00ZDU2LTlkMTctOGRjMWFiMzVkZDhifTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40Mjk2PC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE5IFJUTSBTZXJ2ZXJTdGFuZGFyZCBPRU06RE0gKE1VSSBsb2NrZWQgdG8gemgtQ04pPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+T0VNOkRNPC9Qcm9kdWN0S2V5VHlwZT4NCjxJc1JhbmRvbWl6ZWQ+ZmFsc2U8L0lzUmFuZG9taXplZD4NCjwvQ29uZmlndXJhdGlvbj4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPntkZTMyZWFmZC1hYWVlLTQ2NjItOTQ0NC1jMWJlZmI0MWJkZTJ9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjQyOTc8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlclN0YW5kYXJkPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkIFZvbHVtZTpHVkxLPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+Vm9sdW1lOkdWTEs8L1Byb2R1Y3RLZXlUeXBlPg0KPElzUmFuZG9taXplZD5mYWxzZTwvSXNSYW5kb21pemVkPg0KPC9Db25maWd1cmF0aW9uPg0KPENvbmZpZ3VyYXRpb24+DQo8QWN0Q29uZmlnSWQ+ezQ0YTViNGMzLWU0YjEtNDgzYi04MWU4LTBmNzhmNGQ5ODI4M308L0FjdENvbmZpZ0lkPg0KPFJlZkdyb3VwSWQ+NDI5ODwvUmVmR3JvdXBJZD4NCjxFZGl0aW9uSWQ+U2VydmVyU3RhbmRhcmQ7U2VydmVyU3RhbmRhcmRBQ29yPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkO1NlcnZlclN0YW5kYXJkQUNvciBWb2x1bWU6TUFLPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+Vm9sdW1lOk1BSzwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57ZTkzNmY2MzAtNTEyNS00YTM5LWIxZGUtNTQ0ZDZjMDM2NDkxfTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40Mjk5PC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDtTZXJ2ZXJTdGFuZGFyZEFDb3I8L0VkaXRpb25JZD4NCjxQcm9kdWN0RGVzY3JpcHRpb24+V2luZG93cyBTZXJ2ZXIgMjAxOSBSVE0gU2VydmVyU3RhbmRhcmQgVlQ6SUE8L1Byb2R1Y3REZXNjcmlwdGlvbj4NCjxQcm9kdWN0S2V5VHlwZT5WVDpJQTwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57MzRlMWFlNTUtMjdmOC00OTUwLTg4NzctN2EwM2JlNWZiMTgxfTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40MzAwPC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJEYXRhY2VudGVyPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlckRhdGFjZW50ZXIgVm9sdW1lOkdWTEs8L1Byb2R1Y3REZXNjcmlwdGlvbj4NCjxQcm9kdWN0S2V5VHlwZT5Wb2x1bWU6R1ZMSzwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57Y2VhZTYyNjYtODAzNC00OGRiL :>_>", "516@6O6Z6l6", "3\"383=3V3g3q3", "sr-Cyrl-RS", "WDS.Client.JoinDomain.Account.PrestageUsingMAC", "es-DO", ".CRT$XLA", "Microsoft Time-Stamp Service", "G\\!_P!_TQ", "3t4~4", "3*3/3i3", "SystemTimeToFileTime", "mi-NZ", "Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}", "4Q4X4b4x4", "Device Name=%s", "> >(>0>8>@>H>P>X>d>h>l>", "\\system32\\ssshim.dll", "WdsCliSetTransferBufferSize", "5$5.5d5n5", "2/2F2Q2j2z2", "ar-MA", "5(545@5L5X5d5p5|5", "SPLEVEL", "RtlNtStatusToDosError", "ml-IN", "WdsCliGetSystemMetadata", "nb-NO", "Control\\MUI\\UILanguages", "=n=y=", ">+?C?", "lo-LA", ":\";6;I;d;", "778c8", "es-BO", "malloc", "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmitargetosinfo.cpp", "_wtoi64", "929w9", "ProcessProgressMessage", "<$<.<[9?J?c?", "=\">@>`>p>", "2%2;2x2", "8.969H9R9", "es-CL", "8@8u8", "03191l1v1", "Image OS Version Info = %d.%d.%d", "pwszManufacturer", "_purecall", "j1Yf;", "040904B0", "Microsoft Time-Stamp Service0", "hi-IN", "Binary", "HeapFree", "base\\eco\\wds\\lib\\metadata\\core\\metadata.cpp", "SetThreadpoolThreadMaximum", "sw-KE", "Number of Chassis Types = %d", ".data$r$brc", "7(747@7L7X7d7p7|7", "898A8F8K8P8U8Z8d8s8", "es-MX", "969l9", "WDSDDP_MACHINE_INFO", "kok-IN", "Redmond1", "fr-CA", "4K4Y4", ";)K?c?~?", "VERSION/BUILD", ".?AUIWdsMetadataBuilder@@", "-> WdsClipTransferNextFile", "uImageFormat", "ullVersion", "9NXvt", "<- WdsCliCancelTransfer=%x", "zu-ZA", "ur-PK", "> >)>2>A>G>L>a>k>", "8@9J9W9", "jyhlN", "CurrentIP", "839:9D9e9l9v9", "=*>5>B>Y>", "SubNotebook", "WDSCLIENTAPI", "ar-EG", ".xdata$x", "Handheld", "fr-SN", "en-ZW", "pizzabox", "VER_OS_AUTO", "Microsoft Corporation1", "5\\5c5{5", "\\VarFileInfo\\Translation", ">b?u?z?", "en-AE", "============================", "0&000=0i0z0", "2.2D2V2o2y2", "MachineGuid", "WdsTransportClientReleaseBuffer", "WdsCliSetSystemMetadata", "4#5/5N5W5b5", ";+;5;R;`;j;", "230865+4584940", "VERSION", "WDS.Client.JoinDomain.Machine.Domain", "StringFileInfo", "N0L0J", "ja-JP", "r~akow", "CompatibleIds", "[%S:%u] Expression: %S, Win32 Error=0x%x", "343H3i3}3", "'SQWP", "SetupDiGetDeviceRegistryPropertyW", "<<$>Q>V>", "OPTIONS", "D$$;A", "PXEv6 Warning: DUID-LLT unrecognized hardware type %u", "GetAdaptersAddresses", "=\"=&=*=.=2=6=:=>=B=F=J=N=R=V=Z=^=b=f=j=n=r=v=", "WDS.Client.DDP.Default.Match", "8.9Q9}9", "-> CallbackTransportSessionStart", "cs-CZ", "<,<0`base\\eco\\wds\\wdslib\\xml\\xmldocument.cpp", "WSAAddressToStringW", "qj*Xf;", "ca-ES-valencia", "memmove", "AdjustTokenPrivileges", "0<1F1Q1]1h1u1~1", "9$9b9p9z9", "-0@0E0f0", "pa-Arab", "=.=:=n=w=", "1W1a1 2/242W2f2k2", "t!j|h", "9A9K9m9w9", "7.7<7M7i7y7", "quz-PE", "PQQVW", "454<4F4\\4", "1(3-3", "ig-NG", "3,3?3]3", "8T8o8", "JH;ZLr", ":D;R;w;", "2K3t3", "dwArchitecture", "9t$ u7", ".Index", "BIOS Vendor Info = %s", "ProductSuite", ";8;B;", "es-SV", "fr-CD", "IdnToAscii", "N{h[)", "WDS.Client.JoinDomain.User.LastName", ",>0>H>X>h>x>", "WDS.Client.Property.SMBIOS.Vendor", "?3?W?w?", "FALSE", "GetCurrentThreadId", "D$$9D$0", "gsw-FR", "0&0C0d0w0|0", "~(9~,t", "2l2v2", ">C>H>y>~>", "j:Xf;", "Hardware Id [%d]=%s", "5!5C5J5T5v5", "WdsCliSimulateSmbiosInfo", "sma-NO", "272E2k2r2", "quc-Latn", "4-4<4[4", "FreeLibrary", "`.data", "8,8F8g8m8", "C0j0s0", "en-HK", "\\Registry\\Machine", "|$8Y3", ">`base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmirawsmbios.cpp", "9O8t\"", "~,9~$t", "CreateThreadpoolWork", "0(0,00040H0L0h0l0p0t0", "expansionchassis", "4(4,4H4L4P4T4h4l4", "sd-Arab", "D$HSVW", "WDSMachineInfo/TargetOsInfo", ":+:5:N:^:h:", "MsgQueueNotifyProgress", "PackageGuid", "-> ConvertMachineInfo", "L$ PQ", "6+6>6L6n6", "CreateThreadpoolCleanupGroup", "pwszBiosVendor", "ControllerList", "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z", "km-KH", "101h1m1", ".CRT$XCA", "u F;s", "=\"=5=\\=o=t=", "2%2B2", "G PQQ", "GetFileSizeEx", "BiosVersion", "tcPQP", "MsgQueueNotifySessionComplete", "NotEqual", "ATL$__a", "SetFilePointer", "fr-MA", "C;\\$ ", "212R2_2", "hBMSR", "WdsCpPacketRelease", "LowProfileDestkop", "or-IN", "ha-Latn-NG", ".?AV?$CComObject@VCWdsComMetadata@@@ATL@@", "base\\eco\\wds\\clientapi\\client\\src\\transfer.cpp", ",zezBuw5nSATlu/5zeHu1B9mD489JH9HxUdL8/lE3bXM=0Z", ".?AUIUnknown@@", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "RegQueryInfoKeyW", "GreaterThanOrEqual", "7M8W8", "VWSh\"?6?E?O?V?u?", "200304182929Z", "WDS.Client.Property.SMBIOS.Manufacturer", "{00000000-0000-0000-0000-000000000000}", "4E4X4]4", "sr-Cyrl-BA", ">+?]?g?", "Received session complete callback for session 0x%08x", "onecore\\base\\eco\\wds\\wdslib\\dhcplib\\dhcpv6options.cpp", "$Microsoft Ireland Operations Limited1&0$", "9O9Y9", "tt-RU", "PRODUCTSUITE", "base\\eco\\wds\\clientapi\\lib\\src\\imgsrvpacket.cpp", "InternalName", "<>", "D$$Pj", "250701214655Z0|1", "7(7,7H7L7P7T7h7l7", "base\\eco\\wds\\clientapi\\client\\src\\imageinfo.cpp", "base\\eco\\wds\\clientapi\\client\\src\\domainjoin.cpp", "%s=%u.%u.%u.%u", ".?AV?$CComObject@VCWdsComMetadataEntry@@@ATL@@", "5n6x6", "3 3$3(3,303<3H3T3`3l3x3", "080=0b0l0", "ConstructPartialMsgVW", "storagechassis", "=4=D=T=d=h=l=p=x=", "w49wdt", "PSSSSSS", "bs-Latn", "WdsTransportClientCloseSession", "PATH_%u", "WdsTransportClientCancelSession", "WdsCpRecvPacketInitialize", "-> WdsCliObtainDriverPackages", "String", "1&2,2", "CloseThreadpoolCleanupGroupMembers", "u(jJh", "fr-FR", "Translation", "j]Xf9Ds", "%s.%s[%u]", "nl-BE", "ve-ZA", "tzm-Latn", ".tls$", ":/:6:@:E:", "D$ PS", "tr-TR", "fr-HT", "PSj h(:", "pwszProviderName", "mr-IN", "memcpy", "~!jW^h", "kernel32.dll", "GetModuleHandleW", "?@?J?z?", "WDSDDP_TARGET_OS_INFO", ".CRT$XLZ", "GetSystemInfo", "0$0I0P0r0y0", "WSShhV", "dwBuild", "WdsCliCreateSession", "gl-ES", "CWdsMiTargetOsInfo::LogW", "WdsCliFreeStringArray", "MESSAGE_TYPE", "Image Lang Pack [%d]=%s", ";.;Y;o;", "3J3T3", "20201008085628Z", " http://www.microsoft.com/windows0", "tPVVPQ", "%s-%u", "1(1,10141H1L1h1l1p1t1", "0)0p0z0", "t2j-Zf9", "8!8.878e8", "DataMgrGetPercentWritten", ";4;I;i;y;", "WdsCliGetDeploymentMetadata", "tzm-Arab-MA", "bs-Cyrl", "4!5(5d5k5", "Washington1", "WakeAllConditionVariable", "<1", "WDSParseImageInformation", "MACHINEDN", "wcschr", "40555.686s6x6", "8)9.9", "7.888]8g8", "WdsCliObtainDriverPackages", "r'j6Xf;", "LessThan", "WdsCliWaitForTransfer", "<- WdsCliGetImageHandleFromTransferHandle=%x", "9)9.9F9O9b9g9", "ms-MY", ":#:):.:_:f:p:", ">#?-?", "GetFileVersionInfoSizeW", "UuidCreate", "pwszImageFilePath", "Control\\ProductOptions", "127.0.0.1", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp", "9x(vH", "is-IS", "1\"151=1", "PVj h(:", "Microsoft Corporation", "Files", "WS2_32.dll", "6G7L7o7y7", "Devices", "dz-BT", "1:1a1k1|1", "8C8Y8", ": :$:(:4:8:@:H:`:d:|:", "1N2q2x2", "CJ\\B/", "sLanguagePacks", "4(444@4L4X4d4p4|4", "5[6r6", "RegQueryValueExW", "-> WdsCliGetImageHandleFromTransferHandle", "Msxml2.DOMDocument.6.0", "3A3I3P3V3[3g3r3", "6 7M7W7l7{7", "WDS.Client.JoinDomain.ResetBootProgram", "5!5'5,555;5A5F5O5U5[5`5i5o5u5z5", "ky-KG", "IMAGE_NAME", "dsb-DE", "797n7", "wdscc", "-> WdsCliTransferImage", "CLIENT_UNATTEND", "dwSpLevel", "ARM64", "D$`PjZ", "GetProcessHeap", "other", "$0.0N0Y0", ":4;o;Fd\"", "=P=Z=o=", "j.Zf;", "5 5*5O5V5\\5a5l5w5", "base\\eco\\wds\\clientapi\\lib\\src\\clientlib.cpp", "VWj,3", ":L:`:|:", "tQf9>u", "WdsCliGetImageDescription", "Device Description=%s", "DeviceList.Count", "MINOR", "0G0/191r1w1", "PVj hT<", "wcsncpy_s", "mt-MT", "tPWWj", "NAMESPACE_%u", "WDS.Client.JoinDomain.User.FirstName", "CreateThreadpool", "WdsCliFindNextImage", "??1exception@@UAE@XZ", "multisystemchassis", "8S8Z8e8|8", "WDS.Client.Unattend.XML", "<)=`=g=n=", ";X;{;", "y PhH", "Metadata specified %s=TRUE but no other unattend entries were provided.", "8 8(8,84888@8D8L8P8X8\\8d8h8p8t8|8", "1pyyT", "ProductType", "%s.%s", "Target Image Information", "%s[%s:%u] %s", "3V4`4", "ar-SA", "GetTempPathW", "et-EE", "my-MM", "G9^8u", "7!777>7T7[7j7q7", "\"Microsoft Window", "bo-CN", "9t$(u", ";Q;[;", "G;~(r", ":$:A:J:P:q:y:", "~(9~$", "= >^>", "GreaterThan", "9^(v=", "RegEnumKeyExW", "878>8g8q8", "<\"7?E?", "PathIsUNCW", ">M>}>", "EventUnregister", "LOGLEVEL", "90G0i0p0z0", "3,3Y3", "=(=,=H=L=P=T=", "1#1(1A1R1W1", "pa-Arab-PK", "3!4&4K4R4", "WdsSetupLogMessageW", "sr-Latn-CS", "already exists", "uKj-X", "SYSTEMROOT", "fr-RE", ".text$mn$01", "base\\Eco\\WDS\\wdslib\\xml\\XmlDocument.h", "0'0A0X0r0", "ControlSet%03u", "pwszBiosVersion", "RtlAllocateHeap", "MACHINE_OU", "-> WdsCliObtainDriverPackagesEx", "QQSVW3", "Kernel32", "AdvancedTca", "WdsCliCreateSessionEx", "VERSION/MAJOR", "1/0-0", "9K:b:g:", "ta-LK", "8$848;8C8T8[8c8o8x8", "uNamespaceContentSize", "5.5\\5t5", "CloseThreadpoolWork", "707T7", "40565w5", "InstallLanguage", ".?AVbad_alloc@std@@", "WdsCliGetImageFiles", "D$thp9", "UuidToStringW", "1V2]2o2t2", "Microsoft\\Windows NT\\CurrentVersion", "7)7Y7z7", "_onexit", "9,:N:", "Created new session. Caller handle: 0x%08x, MC Client handle: 0x%08x", "-> WdsCliCancelTransfer", ".?AVCWdsComMetadataEntry@@", "dockingstation", "%s", "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmachineinfo.cpp", "t(f98t#", ":(:,:H:L:P:T:h:l:", "030N0", "UnknownChassis", "4.5:5", "0E1q1", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\netaddr.cpp", "RtlInitUnicodeString", "WdsCliGetImageLanguage", "5S5~5", "9,9o9", "5*646w6", "(SVWj", "quz-BO", "eu-ES", "WDS.Client.Driver.Path", "0)080B0c0m0", "pwszImageGroup", "CompactPci", "bs-Cyrl-BA", "WdsImgOpenImage", "Microsoft Corporation1(0&", "9'9.94999D9Q9e9", "LegalCopyright", "FIRMWARE", "7;7Z7j7", "Expected 0 or 1 instances of Tag [%s]; received %u instances", ">*?S?X?y?", "Y__^[", "4%4/4", "<- CallbackTransportSessionComplete=%x", ".idata$3", "tzm-Latn-DZ", "626?6O6h6", "towlower", "1'2-2G2N2w2", "$`2X`F", "WDSCLIENTAPI.dll", "MESSAGE", "GetFileVersionInfoSizeExW", "[9w,t", "??1type_info@@UAE@XZ", "qps-plocm", "1I2V2p2", "WDSCORE.dll", "WDS.Client.Property.SMBIOS.Version", "NAMESPACE_SIZE_%u", "5-525U5d5i5", "|hK,_", "WIM image requires more than one reference file (count=%u); not supported", "RETAIL ASSERT", "6;6E6c6m6", "", "uz-Latn", "EventRegister", "BiosVendor", "IMAGE_GROUP", "D$(Ph", "LookupPrivilegeValueW", "u%9_ ", "SetupDiDestroyDeviceInfoList", "<$<0<<@>N>~>", ".edata", "<- WdsCliObtainDriverPackages=%x", "3!3>3H3s3", "=$=+=<=C=T=[=l=s=", "2;3^3e3o3", "sd-Arab-PK", "QQSVWjl", "u$j|h", "es-EC", "nso-ZA", "RegOpenKeyExW", "5%5Q5[5q5v5", "979Z9~9", "Notebook", ".00cfg", "Current", "PPPPW", ":X;q;", "j]Yf9", "<0<:U>", "UUID Info = %s", "Microsoft Code Signing PCA 20100", "8C8m8w8", "D$H)F@B1", "D$L;T$8r", "RESOURCEFILEPATH_%u", ";AllOf", "u}9G(v@", "141E1V1", "WDS_TRACING_%u", "=&=0=S=]=", "WdsClientInitializeLibrary", ">:>t>", "H ;x(r", "pwszInfFilePath", "arn-CL", "", "D$$hhz", "5$505<5H5T5`5l5x5", "WdsTransportConsumerCancelSession", "0(1-1", "WdsCliGetImageVersion", "WdsCliGetUnattendVariables", ".?AV?$CComObject@VCWdsComMetadataBuilder@@@ATL@@", "lowprofiledesktop", "iu-Cans-CA", "9_$ve", "st-ZA", ".CRT$XIZ", "<- WdsCliObtainDriverPackagesEx=%x", "CompanyName", "5+575<5W5", "GetComputerNameW", "NtUnloadKey2", " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "3,3R3h3", ":2;B;[;s;", "de-LU", "sealedcasecomputer", ": :F:O:V:`:", "8>8E8W8f8", "WdsCliGetImageNamespace", ";\\$(r", "PWj h", "9D$8u", "7 7,787D7P7\\7h7t7", ">H>^>s>", "CreateFileW", "pSmbiosInfo", "SetFilePointerEx", "FIRSTNAME", "sk-SK", "wd9wht", "Xml Failure: ", "8E8\\8", "wcsrchr", ".text", "es-CO", "en-PH", "fr-CI", ";6;V;", "?-?7?", "portable", "%s: failing with error 0x%08x", "6\\7|7", "Microsoft Corporation1-0+", "808?8Y8t8", "ba-RU", "SubChassis", "0@0t0", "-----------------------------------------------------------------", "9~ vG", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "5G6g6", "-> WdsCliWaitForTransfer", "10.0.19041.572", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "base\\eco\\wds\\clientapi\\client\\src\\metadata.cpp", "j:^f9", "WdsCliFindFirstImage", "CompatibleIds/CPID", "handheld", "DeviceList.Identifier", "8N9i9", "p0123456789abcdefABCDEF", "WDS.Client.Unattend.Override", "2.252}2", "WdsCliGetImageIndex", "9.:8:", "WDS.Client.InstallImageChoice", "spacesaving", "050E0X0c0s0y0", "advancedtca", "3G4m4", "<- CallbackTransportSessionStart=%x", "s V9x", "SetFileAttributesW", "co-FR", "iswdigit", "_vsnwprintf", "444>4U4\\4b4g4r4|4", "-> CallbackTransportSessionComplete", ";O;o;v;", "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}", "00070F0W0`0e0j0r0", "WdsCliFreeDomainJoinInformation", "Microsoft Corporation1200", "bEnabled", "WdsCliGetImagePath", "BusExpansionChassis", "9Y:`:", "9<9A9", "4Y4f4", ":;:Y:c:", "5(5,5H5L5P5T5h5l5", "ar-JO", "HeapAlloc", "<#=_=", "WDS.Client.InstallImage.Path", "<- WdsCliRegisterTrace=%x", "VPhXE", "sr-Latn-ME", "j.Xf;F", "{aed06655-9679-4b3d-bec2-68eb3234e6a7}", "QueryPerformanceCounter", "WDS.Device.ID", "SleepConditionVariableSRW", "D$ ;A(s", "$Microsoft Ireland Operations Limited1", "Metadata tag [%s] was specified, but it is not allowed when account %s", "ug-CN", "th-TH", "sms-FI", ">$>.>P>W>a>", "peripheralchassis", "j\\Xf9", ";(;,;H;L;P;T;h;l;", "sd-Deva-IN", "WdsCliFilterImageArchitecture", "Tower", "pt-BR", ".CRT$XCZ", "PVj h\\;", "toupper", "D$8;C", "C;^(r", "en-029", "MetadataRS", "be-BY", "ne-IN", "SessionComplete", "D$HP3", "CreateEventW", "6q7{7", "de-DE", "WdsClientSessionExecute", "CurrentMajorVersionNumber", ":6;@;i;t;", "1U1i1n1", "MinorVersion", "ti-ET", "2(2,20242H2L2h2l2p2t2", "es-419", "sa-IN", "WdsClientApi.dll", "WDS.Client.Request.Version", "??0exception@@QAE@XZ", "PizzaBox", "<<u", ".CRT$XIAA", "_get_errno", "quc-Latn-GT", ">-?7?R?h?", "ar-YE", "2B2H2V2`2f2l2", "j\\Zf;Ty", "9(9?9F9\\9c9y9", "3&33383=3E3V3]3p3", "DeleteFileW", "Count", "j\\Zf9TA", "WdsCliGetImageLanguages", "pEntry", "1Z1d1", "WWWPW", "PrivilegeCheck", "??0exception@@QAE@ABV0@@Z", "RegCloseKey", "7'7`7q7", "2k2p2", "UNATTEND_MODE", "6\"6p6|6", "ii-CN", "3#3.3;3I3O3]3r3", "j0Yf;", "ro-RO", "5,51585=5E5Q5Y5e5o5w5~5", "en-AU", "GetProcAddress", "", "FindClose", "CompareFileTime", "t$0Sh ", "InitializeCriticalSection", "9/:G:", "DataMgrSetDeleteOnClose", "D$$9A", "<-0?M?T?^?t?", ".CRT$XCU", "PeripheralChassis", "bs-Latn-BA", "M QRSP", "MACHINE_NAME", "SetupDiGetDeviceInstanceIdW", "6O6|6", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\wdsmgmtutil.cpp", "8?8I8", "zh-Hant", "MsgQueueCreate", ";2;L;`;", "3Q3e3~3", "gd-GB", ":o:v:|:", "210303182929Z0t1", "9~ v;", ".?AVexception@@", "WdsCpParameterAdd", ":2:<:|:", "CWdsMiDevice::LogW", "DeviceQuery.NamePattern", "Controller", ".data", "9':,:G:T:q:", "<2=>=H=x=", ".?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@", "MsgQueueNotifySessionStart", ";/;E;N;g;", " Windows", "WDSMachineInfo/SmbiosInfo", "9(9,9H9L9P9T9h9l9", ";Cpv ", "6'7H8R8", "9G vi", ":3;B;M;_;", "6@6S6X6l6", "WdsTransportClientRegisterCallback", "es-US", "CWdsMachineInfo::LogW", "Laptop", "210121231915Z0", "WDS.Client.JoinDomain.Account.Exists", "es-AR", "SVWt^", "5%6S6X6q6", "6+7C7[7", "InstallationType", "=1===G=v={=", "3*3s3", "WdsCliGetEnumerationFlags", "rw-RW", "wcsncmp", "hu-HU", "WdsCpParameterValidate", "DeviceList.Offset", "WdsImgClose", "=H>}>", "9*9<9b9w9|9", ".?AUIWdsMetadata@@", "haw-US", "az-Cyrl", "\\StringFileInfo\\%04x%04x\\%s", "%s=%u/%u/%u:%u:%u:%u.%u", "zh-Hans", "<;'>=>h>", "WdsCliTransferImage", "sr-Cyrl-CS", "GetCurrentProcessId", "-> pWdsCliObtainDriverPackages", "VerQueryValueW", "100706204017Z", "9::D:", "ru-RU", "RegFlushKey", "MPR.dll", "SessionCreate", "lv-LV", "8 999f9", ">8>B>`>j>", "Chassis Type %d = %d", "VERSION/MINOR", "se-NO", "ks-Arab", "6.6y6", "?\"?-?I?^?d?i?", ":J:s:", "PRODUCTNAME", "<- ConvertMachineInfo=%x", ";(;4;@;L;X;d;p;|;", "WDS.Client.Property.SMBIOS.Model", "br-FR", "WDSMachineInfo/Devices", "Res.rwm", "WdsCliGetTransferSize", "WDS.Client.Property.Firmware.Type", "subchassis", ".idata$4", "CurrentMinorVersionNumber", "SpaceSaving", "\\\\?\\UNC", "ga-IE", "en-GB", "base\\eco\\wds\\wdslib\\xml\\xmlnodelist.cpp", "jthXG", "ks-Deva-IN", "GetFileAttributesExW", "bn-BD", "ARCHITECTURE", "Microsoft Corporation0", "SessionInsertMessage", "base\\Eco\\WDS\\wdslib\\xml\\XmlNode.h", "base\\eco\\wds\\clientapi\\client\\src\\client.cpp", "KnILk", "hr-BA", "Control\\Nls\\Language", "el-GR", "es-PR", "; ;8;<;T;X;p;t;", "D$ Ph", ".CRT$XIA", "5/595]5", "8K8X8", "IMGSRV_IMAGE", "4.434?4", "_wcsupr", "pap-029", "?0F0Z0", "ko-KR", "zh-CN", "2$202<2H2T2`2l2x2", "WdsCliClose", "D$$;D$0", "chr-Cher", "8#8o8z8", "?what@exception@@UBEPBDXZ", "de-AT", "es-PE", "?\"?K?z?", "es-PY", "FindFirstFileW", ".rdata", ";-;O;Y;y;~;", "<* WdsCliTransferFile", ".text$di", "2 2@2Q2\\2", "uExFlags", "D$TPQQ", "ExFlags", "SPBUILD", "SetupDiEnumDeviceInfo", "OriginalFilename", ";*j.W", "829r9", "WdsTransportClientShutdown", "WdsClientSessionCreate", "WorkerThread", "RtlFreeHeap", "WDS.Client.JoinDomain", "DepFiles", "D$(9G", "si-LK", "bin-NG", "{bf1a281b-ad7b-4476-ac95-f47682990ce7}", " j,WV", "tLQQj", "WdsCliGetImageArchitecture", "_callnewh", "?+?>?G?X?{?", "TRANSACTION_ID", "0123456789", "0_1i1", "fr-ML", "9$909<9H9T9`9l9x9", "ThreadPoolEnqueueWorkItem", "828;8F8w8", "bn-IN", "ATL$__z", "SOFTWARE", "3M3i3", "556;6k6", "<- pWdsCliObtainDriverPackages=%x", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "tn-ZA", "ru-MD", "prs-AF", "MsgQueueWorkerThread", "%s\\ControlSet%03u", ":8:?:H:`:", "t#;_ s", "7.7k7q7", "TargetOsInfo", "pwszSourceFile", "Select", "wprintf", "MultiByteToWideChar", "959:9X9g9", "0G0~0", "en-NZ", "RevertToSelf", "@.rsrc", "memcmp", "az-Latn-AZ", "chr-Cher-US", "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmidevice.cpp", "9^Tt~3", "Microsoft Time-Stamp PCA 20100", "sl-SI", "pwszResourceFilePath", "fr-BE", "%s\\Select", "?5?J?i?s?", "CloseThreadpool", "w2t,-L", "pwszLocaleName", "Unable to retrieve the SMBIOS Manufacturer information.", "Control\\Windows", "Portable", ">T>|>", "WdsTransportConsumerStartSession", ".idata$2", "2:3N3", ">1><>", ".CRT$XCL", "8I8v8", "DRIVER PACKAGE NAME", "EditionID", "WdsCliGetDriverQueryXml", "WDSDDP_DEVICE", ">l?r?", "y7Vh`~", "9\\$ t", "Sending metadata server request; %u entries.", "LeaveCriticalSection", "en-ZA", "LANGUAGE", "GetEnvironmentVariableW", "SETUPAPI.dll", "%s%s%s", ">.><>F>y>", ";$;-;9;E;};", "8-848]8", "pwszFriendlyName", ".rdata$T$brc", "{7ebc3661-e661-4943-95a5-412378cb16d1}", "]>h>", "Image SP Build Info = %d", "en-ID", "dwDetails", "VS_VERSION_INFO", "3O3r3y3", "ms-BN", "ar-IQ", "af-ZA", "OutputDebugStringW", "sma-SE", "8$8u8", "OLEAUT32.dll", "O0M0K", "DeviceExists", "ClassGuid", "uz-Cyrl-UZ", "WDS.Client.Property.Architecture.Process", "mn-MN", ";[u_f", "00000000000000000000", "VERSION.dll", ".ResourcePath", "LANGUAGES", "Build", "Default", "1(292M2Z2", ".rdata$r$brc", "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!", "191023231915Z", "tLPPj", "6 6,686D6P6\\6h6t6", "LANGUAGES/LANGUAGE", "WdsCliLog", "1!2*22292@2J2h2", "4=4`4n4", "qps-Latn-x-sh", ";G spk", "PRODUCTTYPE", "base\\eco\\wds\\clientapi\\client\\src\\drivers.cpp", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", ">.?8?R?^?d?u?", ";\";2;v;", " %s", ":0:D:I:", "base\\eco\\wds\\wdscsl\\lib\\controlpacket.cpp", "7U7r7", "8+959J9Z9e9z9", "SYSTEM", "PXEv6 Error: DUID-LL truncated at length %Iu, require %Iu", "so-SO", "mn-Mong", "pwszEdition", "ChassisType", ">(>4>@>L>X>d>p>|>", "Thales TSS ESN:8D41-4BF7-B3B71%0#", "SHLWAPI.dll", "ha-Latn", "1,111", "pwszManufacturerName", "sv-FI", "8(8,8H8L8P8T8h8l8", "u>9{ u", "?!?&?W?\\?", "HardwareIds/HWID", "LessThanOrEqual", ".rsrc$01", ">w>}>", "5&545H5Z5a5g5l5w5", "_vsnprintf", "tQPPj", "_unlock", "5G5Q5", "00050\\0a0v0", "fr-CH", "Version", "AllInOne", "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmismbiosinfo.cpp", "WdsClientFreeLibrary", "dwMajorVersion", "iu-Cans", ".gfids", "compactpci", "zh-TW", "sr-Cyrl-ME", "FLAGS", ".rsrc$02", "9\"919B9X9", "GetLastError", "5A5F5\\5", "WDSDDP_SMBIOS_INFO", ";2;[;g;u;|;", "GetTempFileNameW", "LASTNAME", "en-JM", "=\">T>[>", "20201009085628Z0w0=", "Compatible Id [%d]=%s", "j/Zf;", "WdsOsInfo", "se-SE", "en-BZ", "ntdll.dll", "Normaliz.dll", "SubmitThreadpoolWork", "1-161C1_1d1", "_amsg_exit", "es-CU", "es-GT", "da-DK", "6$606<6H6T6`6l6x6", "WDS_TRACING_CONSOLE_OUTPUT", "ta-IN", "4*414;4Q4", "3*333=3U3}3", "Microsoft", "MACHINEOU", "unknownchassis", "CSDVersion", "<- WdsClipTransferNextFile=%x", "ku-Arab", "minitower", "4%40474=4G4V4^4j4o4u4", "ti-ER", "SERVICINGDATA", "UnhandledExceptionFilter", ";-<7%s", "base\\eco\\wds\\wdscsl\\lib\\serialize.cpp", "Metadata", "ar-BH", "G ;_(r", "WdsCliFilterImageVersion", "0K1n1z1", "WdsCliSimulateArchitecture", "\\system32\\ntoskrnl.exe", "0q0{0", "HSVW3", "ExpansionChassis", ")Microsoft Root Certificate Authority 20100", "k", "Architecture", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "D$ Pj", "_wcsicmp", "Model Info = %s", "QQSV3", ".idata", "GetFileAttributesW", "it-CH", "fr-LU", "PVj h$<", "10.0.19041.572 (WinBuild.160101.0800)", "T$(;T$8", "laptop", "=!=7=e=}=", ":!:E:`:t:y:", " ?*?`?j?", "ar-AE", "MsgQueueRegisterCallback", "9\\$0t", "PXEv6 Error: DUID-EN truncated at length %Iu, require %Iu", "Writing data to offset %08x'%08x", "7&7p7", "ThreadPoolCleanupOutstandingWork", "pwszHardwareId", "989E9", "485=5", "<- WdsCliWaitForTransfer=%x", "FileTimeToSystemTime", "WDS.Client.Property.Architecture.Native", "onecore\\base\\Eco\\WDS\\wdslib\\common\\inc\\BufferedFileWriter.h", "2 2$2~2", "towupper", "gu-IN", "4 4F4j4", "KERNEL32.dll", ";1;T;^;", ".Display.Name", "WdsCliConnectToImageStore", "mn-Mong-MN", "CLIENT_UUID", "Index", "-> CallbackTransportProgress", "DockingStation", "smj-NO", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp", " !\"#$%&'()*+,-./0123456789", "CopyFileW", "<6<@ WdsCliRegisterTrace", ";\";.;?;G;Z;f;n;", "PXEv6 Warning: DUID-LL unrecognized hardware type %u", "WDS.Client.QueryDDPServer", "SmbiosInfo", "PXEv6 Error: Received DUID of length %Iu, minimum size %Iu", "u+k_ ", "QQSVW", "C$jZh", "CopyFileExW", "WDSTPTC.dll", "51696?6Y6", "ff-Latn", "GetSystemFirmwareTable", "base\\eco\\wds\\lib\\metadata\\com\\wdsdevicecontrollerpacket.cpp", "RtlAdjustPrivilege", "Other", "fil-PH", ".text$mn", "8,8B8^8i8", "Image Architecture = %d", "RpcStringFreeW", "% moa", "Total Number of Devices=%d.", "WDS.Client.Host.Version", "The WDS server does not not support metadata queries.", "PXEv6 Error: DUID-LLT truncated at length %Iu; require %Iu", "5!5f5t5z5", "syr-SY", "base\\eco\\wds\\lib\\metadata\\com\\wdscommetadatabuilder.cpp", "= =,=8=D=P=\\=h=t=", ">\"?)?5?K>]>k>x>", "889<9@9D9P9l9", "APPID", "3e3{3", "WDSFreeImageInformation", "[%S:%u] Expression: %S, hr=0x%x", "WDS.Client.InstallImage", "WdsCliGetImageName", " Operating System", "SetupDiGetClassDevsW", "<9=@=|=", "BuildLab", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "7(7/797l7s7}7", "qps-ploca", "MACHINEDOMAIN", "MatchingDeviceId", "828<8", "6(6-6P6_6d6", "SetLastError", "sah-RU", "040V0[0", ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0", "> ?+?7?Z?", "202]2", "oK0D$\"<", "_lock", ":7;A;t;~;", "9?:\\:c:m:", ".rdata$brc", "WdsCliObtainDriverPackagesEx", "Microsoft Code Signing PCA 2010", "DeviceDescription", "DEFAULT", "it-IT", "5&5C5M5", "z.9Wv", "t]f9Ls", "does not exist", "364@4f4p4", "8#8-828", "4#4J4V4c4k4", "D$0Pj", ".?AVCWdsComMetadataBuilder@@", "WDSCSL.dll", "=\">->L>", "9/:^:k:", "5K5d5", "Entry %s is of type %s; expected %s", "f;L$8t", "en-MY", "ImpersonateLoggedOnUser", "dwMinorVersion", "DSVW3", "GetProcessAffinityMask", "GetFileVersionInfoExW", "pwszDeviceInstanceId", "WDS.Client.Property.SMBIOS.UUID", "ar-OM", "6 6q6v6", "DataMgrSetFileSize", "959<9F9K9", "INDEX_%u", "3(3,383H3L3P3T3h3l3", "onecore\\internal\\base\\inc\\private\\eco\\wds\\locks.h", "=X=i=s=", "ps-AF", "Manufacturer Info = %s", "WdsTransportClientAddRefBuffer", "?-?y?", "NAMESPACE_NAME", "! !!!\"!#!$!%!&!'!(!)!*!+!,!-!.!/!0!1!2!3!4!5!6!7!8!9!:!;!!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!", "tPPPj", "2 2&2.2;2F2S2\\2b2j2w2}2", "6W6e6v6|6", "9*9F9T9^9r9w9", "fr-CM", "====================", "<0", "282M2R2", "2O3Y3", "D$|W3", "kl-GL", "EventWrite", "WdsTransportClientStartSession", "?8?^?", ".rdata$sxdata", "7.7U7_7{7", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\bufferedfilewriter.cpp", "WdsImage.dll", "=(=4=>=W=c=m=", "iswxdigit", "IMAGE LANGUAGE", "ne-NP", "GetSystemTimeAsFileTime", "memset", "_TmpHive_", "GetTickCount", "9^(v_", "CoInitializeEx", "mn-Cyrl", "allinone", "<- WdsCliTransferFile=%x", "id-ID", "pwszPackagePath", "PVh0$", ".?AVCWdsDeviceControllerClient@@", "=&=0=t=~=", "=K=U=_=l=", "SVWQj", "Q&{+w", "ProductName", "8[9~9", "sr-Latn-BA", "616:6K6W6", "K4;C u(;K$u#", "WdsCliGetImageLastModifiedTime", "CLSIDFromProgID", "%s\\%s", "DeviceQuery.Type", "151L1]1b1", "ExcludeIds", "WdsCliGetWimImageReferenceFile", "_except_handler4_common", "WDS.Client.JoinDomain.Machine.DN", "WdsCpPacketInitialize", "MAJOR", "<\"<)<0<7<>\">7>T>~>", "wo-SN", "la-001", ";AtLeastOneOf", "2.2B2`2t2", "fa-IR", "4+4Q4[4r4y4", "1U1h1", "q(9>u", "9;:S:k:", "_wtoi", "ulProcessorArchitecture", "_set_errno", "u$jZh", "~&jW^h", "y Whh", "3K3U3", "1H2S2e2~2", "\\system32\\winpeshl.exe", "PVj h", "WdsCliGetDeploymentMetadataAvailable", ":8:L:f:z:", "=)=0=:=x=", "656;6G6r6{6", "I0G1-0+", "wcstol", "kk-KZ", "3 3,353:3@3J3T3d3t3z3", "0#070Z0a0v0}0", "WdsCliGetImageGroup", "080=0x0", "<- CallbackTransportProgress=%x", "WDS.Client.Request.ResendAuthenticated", ";@<$=K=X=^=c=~=", "CLIENT_MAC", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.", " Microsoft Corporation. All rights reserved.", "SealedCaseComputer", "?2?F?K?[?`?|?", "OSVMn", "PVj hD;", "8 8+858H8P8W8]8b8m8", "2'3]3h3", "pwszNamespace", "SessionSetClientHandle", "%s%s%s%s=%s", "!This program cannot be run in DOS mode.", ">.?L?", "ku-Arab-IQ", "DataMgrCreateFile", "WdsCliFreeUnattendVariables", "zh-MO", "Line: %u", ";bQ", "WdsCliGetImageHandleFromFindHandle", "0 0,080D0P0\\0h0t0", "20201008073436.699Z0", "2+373A3g3s3}3", "=A>x>", "MACHINENAME", ".rdata$zzzdbg", "BIOS Version Info = %s", "646>6W6c6m6", "oc-FR", "757:7T7e7j7", "Unable to retrieve the BIOS Version information.", ".MulticastNamespace", ">#>D>Q>r>", "CompareStringW", ".Display.Description", "CreateThread" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "653b88be8d3cf06c7aba3ee0c308d9771d175d61816da523d2cbe5ef155b1495", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/653b88be8d3cf06c7aba3ee0c308d9771d175d61816da523d2cbe5ef155b1495", "guest_paths": [ "overlay" ], "size": 8648, "crc32": "A65249E4", "md5": "e160d0d2f5ace6b3a7bc70eaa3e32f07", "sha1": "0893a2eaeef5084cfd7379a47f5c502f993bebf8", "sha256": "653b88be8d3cf06c7aba3ee0c308d9771d175d61816da523d2cbe5ef155b1495", "sha512": "18504d6b953208a3966e723acf74b9eca50a08681551c7b913084fe79c971e6b46635da1fd226408882a970b5d1296bca2ab805cc2d9e3f11712c116fab1a43b", "rh_hash": null, "ssdeep": "96:DGiiDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLNNDEs3r4X9Dm24DfOG:dWf9BvVVWQ4eWaMX+o7qnajOaFV9", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1C7022AE2DE6C9543FA927D5053C8E9937C3D57D72910A0A612AEF4E82CC73D1EB0186E", "sha3_384": "8260093cd3a23500bf164df9f305cb6eea8d6443dd3f259ebea95b13c80a6869d4d100c0cf93265a0f38c7bf91c9b402", "data": null } ], "extracted_files_time": 0.000500107002153527, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "Diager.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/ae0f8123d3ef8801961211d7d71780bee76c418ebc8c6893b385d5faba6bb68f", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\Diager.dll" ], "size": 41792, "crc32": "278CD4E0", "md5": "4396bdd1707419909f04a92184ad1317", "sha1": "eaa238531420dcfbdb864fa31bd95373b53977d7", "sha256": "ae0f8123d3ef8801961211d7d71780bee76c418ebc8c6893b385d5faba6bb68f", "sha512": "d7e526a1bb8b7d4fb91de5f10dd1cd1a005dd26aec7839b22e66303bada8ecba34e92f2467ea510584c29c93c51a78c4fa36849050f72bfeda456671136aa8ec", "rh_hash": null, "ssdeep": "768:GjGabdDxVfFrX8khxIWdOghUak3h1PQRVta:G9dDxNFrX80IWdOdaeXP4ta", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T14D133B00A2648AE7D5F729F025AEB133683EA0B41FD493D70A53A7ED6D933D0D9341A6", "sha3_384": "3e287ca054351cfdc111298e4c458c1cf4bfecd79409b183f6a55c6e5358279746f4800a313e12dd31e98fdce84e3b97", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x000058b0", "ep_bytes": "8bff558bec837d0c017505e865060000", "peid_signatures": null, "reported_checksum": "0x0000ffe6", "actual_checksum": "0x0000ffe6", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "diagER.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x100081e4", "name": "malloc" }, { "address": "0x100081e8", "name": "free" }, { "address": "0x100081ec", "name": "fwprintf" }, { "address": "0x100081f0", "name": "_callnewh" }, { "address": "0x100081f4", "name": "_XcptFilter" }, { "address": "0x100081f8", "name": "_wfopen" }, { "address": "0x100081fc", "name": "fclose" }, { "address": "0x10008200", "name": "_vsnwprintf" }, { "address": "0x10008204", "name": "_amsg_exit" }, { "address": "0x10008208", "name": "_initterm" }, { "address": "0x1000820c", "name": "?terminate@@YAXXZ" }, { "address": "0x10008210", "name": "_lock" }, { "address": "0x10008214", "name": "_unlock" }, { "address": "0x10008218", "name": "__dllonexit" }, { "address": "0x1000821c", "name": "_onexit" }, { "address": "0x10008220", "name": "??1type_info@@UAE@XZ" }, { "address": "0x10008224", "name": "_except_handler4_common" }, { "address": "0x10008228", "name": "_CxxThrowException" }, { "address": "0x1000822c", "name": "wcsrchr" }, { "address": "0x10008230", "name": "_purecall" }, { "address": "0x10008234", "name": "__CxxFrameHandler3" }, { "address": "0x10008238", "name": "memset" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x10008000", "name": "RegCloseKey" }, { "address": "0x10008004", "name": "RegDeleteKeyExW" }, { "address": "0x10008008", "name": "RegCreateKeyExW" }, { "address": "0x1000800c", "name": "RegSetValueExW" }, { "address": "0x10008010", "name": "RegOpenKeyExW" }, { "address": "0x10008014", "name": "RegDeleteValueW" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x1000801c", "name": "GlobalUnlock" }, { "address": "0x10008020", "name": "GetTickCount" }, { "address": "0x10008024", "name": "MapViewOfFile" }, { "address": "0x10008028", "name": "GetDriveTypeW" }, { "address": "0x1000802c", "name": "DebugBreak" }, { "address": "0x10008030", "name": "CopyFileExW" }, { "address": "0x10008034", "name": "GlobalMemoryStatus" }, { "address": "0x10008038", "name": "LoadLibraryExW" }, { "address": "0x1000803c", "name": "GetExitCodeProcess" }, { "address": "0x10008040", "name": "QueryPerformanceCounter" }, { "address": "0x10008044", "name": "GetCurrentProcessId" }, { "address": "0x10008048", "name": "GetSystemTimeAsFileTime" }, { "address": "0x1000804c", "name": "UnhandledExceptionFilter" }, { "address": "0x10008050", "name": "SetUnhandledExceptionFilter" }, { "address": "0x10008054", "name": "VirtualQuery" }, { "address": "0x10008058", "name": "AcquireSRWLockExclusive" }, { "address": "0x1000805c", "name": "ReleaseSRWLockExclusive" }, { "address": "0x10008060", "name": "VirtualProtect" }, { "address": "0x10008064", "name": "CreateFileMappingW" }, { "address": "0x10008068", "name": "DuplicateHandle" }, { "address": "0x1000806c", "name": "GetLastError" }, { "address": "0x10008070", "name": "GetUserDefaultLangID" }, { "address": "0x10008074", "name": "GetModuleFileNameW" }, { "address": "0x10008078", "name": "GetTempPathW" }, { "address": "0x1000807c", "name": "WaitForSingleObject" }, { "address": "0x10008080", "name": "CloseHandle" }, { "address": "0x10008084", "name": "CopyFileW" }, { "address": "0x10008088", "name": "CreateDirectoryW" }, { "address": "0x1000808c", "name": "ReadFile" }, { "address": "0x10008090", "name": "GetVolumeInformationW" }, { "address": "0x10008094", "name": "GetLogicalDrives" }, { "address": "0x10008098", "name": "FindFirstFileW" }, { "address": "0x1000809c", "name": "HeapCreate" }, { "address": "0x100080a0", "name": "HeapFree" }, { "address": "0x100080a4", "name": "SetLastError" }, { "address": "0x100080a8", "name": "EnterCriticalSection" }, { "address": "0x100080ac", "name": "VirtualFree" }, { "address": "0x100080b0", "name": "GetCommandLineW" }, { "address": "0x100080b4", "name": "GetFullPathNameW" }, { "address": "0x100080b8", "name": "FindNextFileW" }, { "address": "0x100080bc", "name": "GetCurrentProcess" }, { "address": "0x100080c0", "name": "WriteFile" }, { "address": "0x100080c4", "name": "ExpandEnvironmentStringsW" }, { "address": "0x100080c8", "name": "GetShortPathNameW" }, { "address": "0x100080cc", "name": "GetDiskFreeSpaceW" }, { "address": "0x100080d0", "name": "VirtualAlloc" }, { "address": "0x100080d4", "name": "TerminateProcess" }, { "address": "0x100080d8", "name": "RemoveDirectoryW" }, { "address": "0x100080dc", "name": "SetFileTime" }, { "address": "0x100080e0", "name": "LeaveCriticalSection" }, { "address": "0x100080e4", "name": "InitializeCriticalSection" }, { "address": "0x100080e8", "name": "SetErrorMode" }, { "address": "0x100080ec", "name": "SetFilePointer" }, { "address": "0x100080f0", "name": "SetEndOfFile" }, { "address": "0x100080f4", "name": "WaitForMultipleObjectsEx" }, { "address": "0x100080f8", "name": "FindClose" }, { "address": "0x100080fc", "name": "GetLocaleInfoW" }, { "address": "0x10008100", "name": "CreateFileW" }, { "address": "0x10008104", "name": "GetFileAttributesW" }, { "address": "0x10008108", "name": "GetCurrentThreadId" }, { "address": "0x1000810c", "name": "OpenEventW" }, { "address": "0x10008110", "name": "GetVersionExW" }, { "address": "0x10008114", "name": "GetComputerNameExW" }, { "address": "0x10008118", "name": "HeapWalk" }, { "address": "0x1000811c", "name": "UnmapViewOfFile" }, { "address": "0x10008120", "name": "GetFileType" }, { "address": "0x10008124", "name": "HeapValidate" }, { "address": "0x10008128", "name": "OpenProcess" }, { "address": "0x1000812c", "name": "SetFileAttributesW" }, { "address": "0x10008130", "name": "GetLogicalDriveStringsW" }, { "address": "0x10008134", "name": "CreateEventW" }, { "address": "0x10008138", "name": "GetPrivateProfileStringW" }, { "address": "0x1000813c", "name": "Sleep" }, { "address": "0x10008140", "name": "GlobalSize" }, { "address": "0x10008144", "name": "SetEvent" }, { "address": "0x10008148", "name": "GetDiskFreeSpaceExW" }, { "address": "0x1000814c", "name": "GetVersionExA" }, { "address": "0x10008150", "name": "GlobalAlloc" }, { "address": "0x10008154", "name": "DeleteFileW" }, { "address": "0x10008158", "name": "GlobalFree" }, { "address": "0x1000815c", "name": "HeapReAlloc" }, { "address": "0x10008160", "name": "RaiseException" }, { "address": "0x10008164", "name": "GetSystemInfo" }, { "address": "0x10008168", "name": "CreateThread" }, { "address": "0x1000816c", "name": "ResetEvent" }, { "address": "0x10008170", "name": "HeapAlloc" }, { "address": "0x10008174", "name": "GetOverlappedResult" }, { "address": "0x10008178", "name": "HeapCompact" }, { "address": "0x1000817c", "name": "HeapDestroy" }, { "address": "0x10008180", "name": "GetWindowsDirectoryW" }, { "address": "0x10008184", "name": "GetProcAddress" }, { "address": "0x10008188", "name": "GlobalLock" }, { "address": "0x1000818c", "name": "MoveFileExW" }, { "address": "0x10008190", "name": "GetFileSize" }, { "address": "0x10008194", "name": "DeleteCriticalSection" }, { "address": "0x10008198", "name": "ExitProcess" }, { "address": "0x1000819c", "name": "GetProcessHeap" }, { "address": "0x100081a0", "name": "CreateProcessW" }, { "address": "0x100081a4", "name": "FreeLibrary" }, { "address": "0x100081a8", "name": "GetTempFileNameW" }, { "address": "0x100081ac", "name": "CreateProcessA" }, { "address": "0x100081b0", "name": "LoadLibraryExA" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x10008240", "name": "RtlAllocateHeap" }, { "address": "0x10008244", "name": "RtlFreeHeap" } ] }, "SHELL32": { "dll": "SHELL32.dll", "imports": [ { "address": "0x100081b8", "name": "ShellExecuteExW" }, { "address": "0x100081bc", "name": "ExtractIconExW" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x100081c4", "name": "CharNextW" } ] }, "WDSCORE": { "dll": "WDSCORE.dll", "imports": [ { "address": "0x100081cc", "name": "WdsSetupLogMessageW" }, { "address": "0x100081d0", "name": "ConstructPartialMsgVW" }, { "address": "0x100081d4", "name": "CurrentIP" }, { "address": "0x100081d8", "name": "WdsSetupLogInit" }, { "address": "0x100081dc", "name": "WdsSetupLogDestroy" } ] } }, "exported_dll_name": "diagER.dll", "exports": [ { "address": "0x10002930", "name": "??0CDwWinER@@QAE@ABV0@@Z", "ordinal": 1 }, { "address": "0x100034a0", "name": "??0CDwWinER@@QAE@PBGH@Z", "ordinal": 2 }, { "address": "0x10002840", "name": "??0CWfpER@@QAE@ABV0@@Z", "ordinal": 3 }, { "address": "0x10002b40", "name": "??0CWfpER@@QAE@PBGW4_DIAG_REPORT_TYPE@@H@Z", "ordinal": 4 }, { "address": "0x100027b0", "name": "??0IDiagER@@QAE@ABV0@@Z", "ordinal": 5 }, { "address": "0x100043b0", "name": "??0IDiagER@@QAE@PBGH@Z", "ordinal": 6 }, { "address": "0x10003770", "name": "??1CDwWinER@@UAE@XZ", "ordinal": 7 }, { "address": "0x10002dc0", "name": "??1CWfpER@@UAE@XZ", "ordinal": 8 }, { "address": "0x100047f0", "name": "??1IDiagER@@UAE@XZ", "ordinal": 9 }, { "address": "0x10002ac0", "name": "??4CDiagERFactory@@QAEAAV0@$$QAV0@@Z", "ordinal": 10 }, { "address": "0x10002ac0", "name": "??4CDiagERFactory@@QAEAAV0@ABV0@@Z", "ordinal": 11 }, { "address": "0x100029b0", "name": "??4CDwWinER@@QAEAAV0@ABV0@@Z", "ordinal": 12 }, { "address": "0x10002880", "name": "??4CWfpER@@QAEAAV0@ABV0@@Z", "ordinal": 13 }, { "address": "0x10002800", "name": "??4IDiagER@@QAEAAV0@ABV0@@Z", "ordinal": 14 }, { "address": "0x100010ec", "name": "??_7CDwWinER@@6B@", "ordinal": 15 }, { "address": "0x100010d4", "name": "??_7CWfpER@@6B@", "ordinal": 16 }, { "address": "0x10001104", "name": "??_7IDiagER@@6B@", "ordinal": 17 }, { "address": "0x10003860", "name": "?AddBucketingParameters@CDwWinER@@UAEKPAPBGI@Z", "ordinal": 18 }, { "address": "0x10002ff0", "name": "?AddBucketingParameters@CWfpER@@UAEKPAPBGI@Z", "ordinal": 19 }, { "address": "0x100044e0", "name": "?AddBucketingParameters@IDiagER@@UAEKPAPBGI@Z", "ordinal": 20 }, { "address": "0x10003a90", "name": "?AddFiles@CDwWinER@@UAEKPAPBGI@Z", "ordinal": 21 }, { "address": "0x10003100", "name": "?AddFiles@CWfpER@@UAEKPAPBGI@Z", "ordinal": 22 }, { "address": "0x10004620", "name": "?AddFiles@IDiagER@@UAEKPAPBGI@Z", "ordinal": 23 }, { "address": "0x10004a60", "name": "?CreateInstance@CDiagERFactory@@SGKPBGW4_DIAG_REPORT_TYPE@@HPAPAVIDiagER@@@Z", "ordinal": 24 }, { "address": "0x10004a50", "name": "?GetErrorReporter@CDiagERFactory@@SGPAVIDiagER@@XZ", "ordinal": 32 }, { "address": "0x10003520", "name": "?Initialize@CDwWinER@@UAEKXZ", "ordinal": 33 }, { "address": "0x10002bc0", "name": "?Initialize@CWfpER@@UAEKXZ", "ordinal": 34 }, { "address": "0x10004c70", "name": "?ReleaseInstance@CDiagERFactory@@SGXXZ", "ordinal": 35 }, { "address": "0x100037a0", "name": "?SetHeader@CDwWinER@@UAEKPBG@Z", "ordinal": 36 }, { "address": "0x10002f20", "name": "?SetHeader@CWfpER@@UAEKPBG@Z", "ordinal": 37 }, { "address": "0x10004460", "name": "?SetHeader@IDiagER@@UAEKPBG@Z", "ordinal": 38 }, { "address": "0x10003c90", "name": "?Submit@CDwWinER@@UAEKK@Z", "ordinal": 39 }, { "address": "0x10003270", "name": "?Submit@CWfpER@@UAEKK@Z", "ordinal": 40 }, { "address": "0x10007378", "name": "?m_diagER@CDiagERFactory@@0PAVIDiagER@@A", "ordinal": 44 }, { "address": "0x10004db0", "name": "DiagERAddBucketingParameters", "ordinal": 25 }, { "address": "0x10004e80", "name": "DiagERAddFiles", "ordinal": 26 }, { "address": "0x10004ca0", "name": "DiagERInitialize", "ordinal": 27 }, { "address": "0x10004d30", "name": "DiagERSetHeader", "ordinal": 28 }, { "address": "0x10004f10", "name": "DiagERSubmit", "ordinal": 29 }, { "address": "0x10004f70", "name": "DiagERSubmitEx", "ordinal": 30 }, { "address": "0x10005000", "name": "DiagERTerminate", "ordinal": 31 }, { "address": "0x10007008", "name": "g_Kernel32", "ordinal": 41 }, { "address": "0x10007004", "name": "g_Shell32", "ordinal": 42 }, { "address": "0x10007000", "name": "g_WerApi", "ordinal": 43 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000065c0", "size": "0x000006aa" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x00008250", "size": "0x000000a0" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0000a000", "size": "0x000003f8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00008200", "size": "0x00002140" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x0000b000", "size": "0x000007b8" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00002400", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00001010", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00008000", "size": "0x0000024c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x000064c8", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00005c6a", "size_of_data": "0x00005e00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "5.94" }, { "name": ".data", "raw_address": "0x00006200", "virtual_address": "0x00007000", "virtual_size": "0x000003a8", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.73" }, { "name": ".idata", "raw_address": "0x00006400", "virtual_address": "0x00008000", "virtual_size": "0x00000f18", "size_of_data": "0x00001000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.19" }, { "name": ".didat", "raw_address": "0x00007400", "virtual_address": "0x00009000", "virtual_size": "0x0000001c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.31" }, { "name": ".rsrc", "raw_address": "0x00007600", "virtual_address": "0x0000a000", "virtual_size": "0x000003f8", "size_of_data": "0x00000400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.37" }, { "name": ".reloc", "raw_address": "0x00007a00", "virtual_address": "0x0000b000", "virtual_size": "0x000007b8", "size_of_data": "0x00000800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.55" } ], "overlay": { "offset": "0x00008200", "size": "0x00002140" }, "resources": [ { "name": "RT_VERSION", "offset": "0x0000a060", "size": "0x00000398", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.51" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Diagnostic ER Module" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "diagER.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "DIAGER.DLL" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "d13ec8d6bd114ce7df8549576c8e140f", "timestamp": "2009-02-19 10:49:41", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 7 }, "data": null, "strings": [ "DiagERAddFiles:Entry", "GlobalMemoryStatus", "Microsoft", "CDwWinER::Initialize:Entry", "?AddFiles@CDwWinER@@UAEKPAPBGI@Z", "CWfpER::Submit", "UnhandledExceptionFilter", ".text$yd", "__dllonexit", "/StageOne/Generic/%s", "WerReportSetParameter", "PQSVW", "Microsoft Time-Stamp Service", ".CRT$XIAA", "<$<73cP", "DiagERTerminate:Entry", "R!s4Z", "ExpandEnvironmentStringsW", "IDiagER::SetHeader:Entry", "8.83898M8R8^8o8w8", "'XD}*", "Stage1URL=%s", "_purecall", "040904B0", "Microsoft Time-Stamp Service0", "?Initialize@CDwWinER@@UAEKXZ", "3.3B3X3h3x3", "IDiagER::AddBucketingParameters:Entry", "HeapFree", "?AddFiles@CWfpER@@UAEKPAPBGI@Z", "GetTempPathW", ">0?7?=?B?M?]?l?", "GetVersionExA", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "DiagERSetHeader", "Thales TSS ESN:0A56-E329-4D4D1%0#", "IDiagER::~IDiagER:Entry", "\"Microsoft Window", "OpenEventW", ".idata", ".data$r$brc", "GetFileAttributesW", ",yWAVBmA4UR7Lz3ocXyBl0jrhQ2rgZpoLtQtddGN4xaM=0Z", ".data", "DiagERAddBucketingParameters:ERROR_NOT_READY", "Redmond1", "10.0.19041.572 (WinBuild.160101.0800)", "WaitForMultipleObjectsEx", "Consent Value = HKCU\\%s!%s has been cleaned out", " Windows", ">->8>H>S>y>", "QSVW3", "??4IDiagER@@QAEAAV0@ABV0@@Z", "??4CDiagERFactory@@QAEAAV0@$$QAV0@@Z", "??4CDwWinER@@QAEAAV0@ABV0@@Z", "1\"1'121<1O1u1|1", "??0CDwWinER@@QAE@PBGH@Z", ".didat$5", "261019185142Z0", "??0IDiagER@@QAE@ABV0@@Z", "191219011459Z", "?ReleaseInstance@CDiagERFactory@@SGXXZ", "CWfpER::AddFiles:Failed Adding file=%s, Result=%d", "=8>=>O>m>", "=(=/=6=>=I=T=Y=m=x=", "GetLogicalDrives", "_wfopen", "ADVAPI32.dll", "ReadFile", "CharNextW", "RegDeleteValueW", "USER32.dll", "??1IDiagER@@UAE@XZ", "EnterCriticalSection", "CWfpER::~CWfpER:Entry", "MapViewOfFile", "GlobalUnlock", "959L9a9", ";t04u", "3B4l4w4", "Stage2URL=%s", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "8'878?8H8p8", "Consent Value = HKCU\\%s!%s could NOT been set to %d, Err=%d", "TitleName=%s", "WdsSetupLogMessageW", ")qBI~Z", "3*3?3K3R3W3]3i3v3", "CWfpER::AddFiles", "DiagERSubmitEx:Entry", "CurrentIP", ".xdata$x", "GetOverlappedResult", "base\\ntsetup\\diagnostics\\diager\\src\\diager.cpp", ".didat$3", "Microsoft Corporation1", "RtlAllocateHeap", "QQSVW3", "CreateFileMappingW", "0L0P0X0`0x0", "20201008050501Z", "AhN~%", "1/0-0", " Microsoft Operations Puerto Rico1", "StringFileInfo", "KERNEL32.dll", "GetDriveTypeW", "Sleep", "N0L0J", "CWfpER::AddBucketingParameters:Entry", "r~akow", "IDiagER::AddFiles:Entry", "?/?H?X?h?x?", "GetCurrentProcessId", "9%949:9a9o9~9", ";p;~;", "CopyFileW", "SetEvent", "sCWfpER::AddBucketingParameters", "_onexit", "229879+4583610", ".idata$4", "GetComputerNameExW", ";(;`;i;p;v;{;", "IDiagER::AddBucketingParameters", "CopyFileExW", "WdsSetupLogInit", "Flags=%d", "? ?&?+?6?@?S?}?", "g_WerApi", "8%858@8F8K8W8a8t8", ".didat$7", ".text$mn", "IDiagER::SetHeader", "?GetErrorReporter@CDiagERFactory@@SGPAVIDiagER@@XZ", "576G6R6X6]6i6s6", "j,hxc", "%Microsoft Windows Production PCA 2011", "?SetHeader@CWfpER@@UAEKPBG@Z", "@.didat", ".CRT$XIA", "??0CDwWinER@@QAE@ABV0@@Z", ".text$x", "DiagERSubmit:Entry", "210303183038Z0p1", "DtCSV", "LegalCopyright", "dIDiagER::~IDiagER", "GetLocaleInfoW", "111019184142Z", "CreateDirectoryW", "HeapCompact", "VirtualFree", "Y__^[", ".idata$3", "dCDwWinER::CDwWinER", "watson.microsoft.com", "FindFirstFileW", ".rdata", "GetWindowsDirectoryW", "727G7T7q7z7", "ywer.dll", "$`2X`F", "CDwWinER::AddBucketingParameters:Entry", "M0K0I", "WerReportSubmit", "=&=.=R=[=", ".text$di", "uCjW^SS", "VarFileInfo", "GetCurrentProcess", "?SetHeader@CDwWinER@@UAEKPBG@Z", ">6?T?c?l?u?", "??1type_info@@UAE@XZ", "DiagERAddBucketingParameters", "ExitProcess", "WDSCORE.dll", "|hK,_", "DeleteCriticalSection", "OriginalFilename", "1 1*141D1T1Z1e1k1w1", "_CxxThrowException", "Microsoft Windows0", "CDwWinER::Initialize", "@.reloc", ".edata", "CWfpER::Initialize:Entry", " Operating System", "GlobalSize", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "RtlFreeHeap", "210317011459Z0", "HeapReAlloc", "??4CWfpER@@QAEAAV0@ABV0@@Z", "U0S0Q", "Rich,", "RegOpenKeyExW", "Microsoft Corporation1)0'", "LoadLibraryExA", "t$hp7", "SetLastError", "GetLogicalDriveStringsW", ".00cfg", "_callnewh", "RegDeleteKeyExW", "404P4l4p4", "oK0D$\"<", "_lock", "VirtualQuery", "IDiagER::AddFiles", ".rdata$brc", " !\"#$%&'+", "DiagERSubmitEx", "CDwWinER::SetHeader:Setting header=%s", "fwprintf", "msvcrt.dll", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "z.9Wv", "CDwWinER::SetHeader:Entry", "CDwWinER::AddFiles:Adding file=%s", "2e~hUb", "GetCurrentThreadId", "MoveFileExW", ".data$brc", "Microsoft Time-Stamp PCA 2010", "CWfpER::Submit:Entry", "CWfpER::AddFiles:Entry", "FreeLibrary", "`.data", "??_7IDiagER@@6B@", "dCWfpER::SetHeader", "WerReportAddFile", "Legal_Policy_Statement", "Microsoft Time-Stamp PCA 20100", "__CxxFrameHandler3", "=$=Q=p=|=", "7=7W7a7u7", "ExtractIconExW", "??1CDwWinER@@UAE@XZ", "1(0&0", "Consent Value = HKCU\\%s!%s could NOT be cleaned out, Err=%d", "?Submit@CDwWinER@@UAEKK@Z", "Changing Report Type from Critical To Non Critical to support silent mode", ".idata$2", "0!0+0>0d0k0t0y0", "??0CWfpER@@QAE@PBGW4_DIAG_REPORT_TYPE@@H@Z", "Diagnostic ER Module", ".CRT$XCA", "WerReportSetUIOption", "SetUnhandledExceptionFilter", "GetCommandLineW", "9-:I:R:^:g:", "2\"282H2X2h2x2", "LeaveCriticalSection", "SetFilePointer", "TlP0X", "wer.dll", "_91$[bS", ",*~_i", "diagERman.txt", "HeapCreate", "1'1.1", "Unable to create manifest file=%s", "??4CDiagERFactory@@QAEAAV0@ABV0@@Z", "ProductVersion", "/dw/GenericTwo.ASP?EventType=%s", ".rdata$sxdata", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "GetVolumeInformationW", "DiagERSetHeader:Entry", "VirtualAlloc", "RemoveDirectoryW", "GetSystemTimeAsFileTime", "memset", "GetTickCount", ".CRT$XIZ", "#>.>8>K>c>", "k`Ee-", "-d %s", "SetFileTime", "GetDiskFreeSpaceW", "CWfpER::AddBucketingParameters:Adding bucketing param=%s", "Server=%s", "%Microsoft Windows Production PCA 20110", "GetSystemInfo", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "IDiagER::IDiagER", "CWfpER::AddFiles:Adding file=%s", "?CreateInstance@CDiagERFactory@@SGKPBGW4_DIAG_REPORT_TYPE@@HPAPAVIDiagER@@@Z", "^ Wj<_W", "l0yX\"", "10.0.19041.572", "CWfpER::SetHeader:Setting header=%s", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "GetPrivateProfileStringW", "SetErrorMode", "lCWfpER::CWfpER", " http://www.microsoft.com/windows0", "diagER.dll", "?AddBucketingParameters@IDiagER@@UAEKPAPBGI@Z", " Microsoft Corporation. All rights reserved.", "gDiagERSetHeader", "+a,Y?", "HeapValidate", "SetFileAttributesW", "uGjW^WW", "_vsnwprintf", "!This program cannot be run in DOS mode.", "CDwWinER::AddFiles:Entry", "GetExitCodeProcess", "Washington1", ".rsrc$01", "GetVersionExW", "DiagERInitialize", "DebugBreak", "??0CWfpER@@QAE@ABV0@@Z", "_unlock", "CWfpER::Initialize", "Microsoft Corporation1200", "DiagERSubmit", "5-545:5@5H5R5e5u5|5", "base\\ntsetup\\diagnostics\\diager\\src\\wfper.cpp", ".gfids", "GetDiskFreeSpaceExW", "HeapAlloc", ".rsrc$02", "5%5/5B5H5]5l5r5", "GetLastError", "CloseHandle", "GetTempFileNameW", "QueryPerformanceCounter", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", ";/<_@[", "?AddFiles@IDiagER@@UAEKPAPBGI@Z", "CDwWinER::AddBucketingParameters:Adding bucketing param=%s", ">(>8>H>X>h>x>", "=<=C=I=N=V=`=s=", "CDwWinER::CDwWinER:Entry", ".CRT$XCZ", "dCWfpER::~CWfpER", "FileDescription", "GetUserDefaultLangID", "FileVersion", "ntdll.dll", "_XcptFilter", ".rdata$zzzdbg", "fclose", "CWfpER::SetHeader:Entry", "CreateEventW", "_amsg_exit", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "2(262J2", "GlobalFree", "g_Shell32", "GetFileType", ".idata$6", "6-6@6\\6", "5J5Q5^5e5s5", "UI_LCID=%d", "DiagERAddFiles", "SHELL32.dll", "CreateThread" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "dbd899ba4380f4dfaac85bbf4b40af6e4c79673fedca3207e1bb5860292bb966", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/dbd899ba4380f4dfaac85bbf4b40af6e4c79673fedca3207e1bb5860292bb966", "guest_paths": [ "overlay" ], "size": 8512, "crc32": "67490188", "md5": "c8ed9d48ee08298c37e31049e4c07c7a", "sha1": "de85f91f4930a96a276d2b9f2a5f966a255dc2d6", "sha256": "dbd899ba4380f4dfaac85bbf4b40af6e4c79673fedca3207e1bb5860292bb966", "sha512": "a81f409cb5f8ca38a68585024cc919d941b78e4989c53b41b331accd5213d9245b7d74014c3f668c1cc95d8f91f3c47098a4dd0449e6af7f7f4d7dfa0416fc3a", "rh_hash": null, "ssdeep": "96:/kDDXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGueDXREsbJpCBDqh0hr:8qF2q8hDBQABJQECWQ2SkqnajKs9CKb", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T199024CD1DB7C5443DFA679805798E4837C3E53CB28108066556BF9A52CC33C6EB085AD", "sha3_384": "7f6832e45041185203946715b194ee7ecd8fdb6b8082c08d7487a7eea907b2787538d0a5a446ed28cf8af7633824eb68", "data": null } ], "extracted_files_time": 0.000686906001647003, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "setupplatform.cfg" ], "path": "/opt/CAPEv2/storage/analyses/3/files/c40fddbb16853406d12d30e01e170de8474728bb8ec24794db721de0a7f67927", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" ], "size": 10452, "crc32": "C9C06D02", "md5": "033e7adc314c248cc29a9f14906c21e5", "sha1": "6b31f8a23514b4e98217cd05be08e7967eca7048", "sha256": "c40fddbb16853406d12d30e01e170de8474728bb8ec24794db721de0a7f67927", "sha512": "46b46d548f5a2269e886a9f6873d97549eeb92c7294114c62baf7805ac423e4d3aa3a50cd7b3294be03e22c271f6bef1134adf797d9f838962ef5b42e8ecd19e", "rh_hash": null, "ssdeep": "192:seqadKxSRlb3dY/e7sxzs7c6i19WO7hD26BV+btnQfz/:sjmTrq/e7s1vpMvoz/", "type": "ASCII text, with CRLF line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1E5228344E47D842382757E86140F0D447C4D528726C27B38A6FD8776E9CAABBE998CE4", "sha3_384": "cfbeee5fe807c29941f440c0b6effbd9622bbcfc8452f026fdff06e00440892bb45df5bbfdca20ce31c8133057e8f22b", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": ";\n; This section describes the footprint dependencies\n; of various platform sections\n;\n[Dependencies]\nBasic =\nServicing = Basic\nICB = Basic, Servicing\nMigration = Basic\n\n;\n; Each element in a footprint section can be one of three things:\n; - File name: this must not ending in '\\'.\n; - Folder name: this must end in '\\'.\n; - File pattern pattern: these can contain wild cards.\n; These pattern should be one of the format\n; accepted by FindFirstFile().\n;\n\n\n[Footprint.Basic]\ndiager.dll\ndiagtrack.dll\ndiagtrackrunner.exe\nreagent.admx\nreagent.dll\nreagent.xml\nsetupplatform.cfg\nsetupplatform.dll\nsetupplatform.exe\nunbcl.dll\nwdsclientapi.dll\nwdscore.dll\nwdscsl.dll\nwdsimage.dll\nwdstptc.dll\nwdsutil.dll\nWinSetupBoot.sys\nWinSetupBoot.hiv\n\n[Footprint.Basic.Delayed]\n*-*\\reagent.adml\n*-*\\reagent.dll.mui\n*-*\\setupplatform.exe.mui\n*-*\\wdsimage.dll.mui\ndu.dll\nReserveManager.dll\n\n\n[Footprint.Servicing]\ndismapi.dll\ndismcore.dll\ndismcoreps.dll\ndismprov.dll\nfolderprovider.dll\nimagingprovider.dll\nlogprovider.dll\npnppropmig.dll\nvhdprovider.dll\nwimprovider.dll\nunattend.dll\nwpx.dll\n\n[Footprint.Servicing.Delayed]\n*-*\\compatprovider.dll.mui\n*-*\\dismapi.dll.mui\n*-*\\dismcore.dll.mui\n*-*\\dismprov.dll.mui\n*-*\\folderprovider.dll.mui\n*-*\\imagingprovider.dll.mui\n*-*\\logprovider.dll.mui\n*-*\\vhdprovider.dll.mui\n*-*\\wimprovider.dll.mui\n\n[Footprint.Servicing.Delayed.amd64]\nsxs\\\n\n[Footprint.Servicing.Delayed.x86]\nsxs\\\n\n\n[Footprint.ICB]\ncmi2migxml.dll\ncsiagent.dll\ndlmanifests\\\nmxeagent.dll\nmigapp.xml\nmigcore.dll\nmighost.exe\nmigisol.dll\nMigration\\\nmigres.dll\nmigstore.dll\nmigsys.dll\noffline.xml\noscomps.xml\noscomps.woa.xml\nosfilter.inf\nreplacementmanifests\\\nsflistw7.dat\nsflistw8.dat\nsflistw8.woa.dat\nsflistwb.dat\nsflistwb.woa.dat\nsflistwt.dat\nsflistwt.woa.dat\nsflistrs1.dat\nsfcn.dat\nsflcid.dat\nsfpat.inf\nsfpatw7.inf\nsfpatw8.inf\nsfpatwb.inf\nsfpatwt.inf\nsfpatrs1.inf\nupgrade_comp.xml\nupgrade_bulk.xml\nupgrade_data.xml\nupgrade_frmwrk.xml\nupgradeagent.dll\nupgradeagent.xml\nupgWow_bulk.xml\n\n[Footprint.ICB.Delayed]\n*-*\\migres.dll.mui\n\n\n[Footprint.Migration]\ncmi2migxml.dll\ncsiagent.dll\ndlmanifests\\\nhwcompat.dll\nhwcompat.txt\nhwcompatPE.txt\nhwexclude.txt\nhwexcludePE.txt\nmxeagent.dll\nmigapp.xml\nmigcore.dll\nmighost.exe\nmigisol.dll\nMigration\\\nmigres.dll\nmigstore.dll\nmigsys.dll\nOfflineProfileUtils.dll\noffline.xml\noscomps.xml\noscomps.woa.xml\nosfilter.inf\nreplacementmanifests\\\nsflistw7.dat\nsflistw8.dat\nsflistw8.woa.dat\nsflistwb.dat\nsflistwb.woa.dat\nsflistwt.dat\nsflistwt.woa.dat\nsflistrs1.dat\nsfcn.dat\nsflcid.dat\nsfpat.inf\nsfpatw7.inf\nsfpatw8.inf\nsfpatwb.inf\nsfpatwt.inf\nsfpatrs1.inf\nuninstall.xml\nuninstall_data.xml\nupgrade_comp.xml\nupgrade_bulk.xml\nupgrade_data.xml\nupgrade_frmwrk.xml\nupgradeagent.dll\nupgradeagent.xml\nupgWow_bulk.xml\n\n[Footprint.Migration.Delayed]\n*-*\\migres.dll.mui\n\n[Footprint.Migration.arm64]\nupgWowA32_bulk.xml\nmiggac\\\n\n\n[Migration.Services.Deferred]\nWinDefend\nWdNisSvc\nWdFilter\nWSearch\nVSS\nSchedule\nWUAUServ\nUSOSvc\nLanmanWorkstation\nBrowser\nNetlogon\nWHSConnector\nvmms\nVmHostAgent\nDoSvc\nPeerDistSvc\nUALSVC\nwscsvc\nDHCPServer\nwlidsvc\nwbiosrvc\nCDPSvc\nWpnService\nTermServLicensing\nhns\nhvsics\nCmService\nWAS\nftpsvc\nW3SVC\nNetMsmqActivator\nNetPipeActivator\nNetTcpActivator\n\n\n[Migration.Services.NoVersionCheck.ServerAzureCor]\nRDAgent\nRDSRS\n\n\n[Migration.VerbosePatterns]\nRegistry,HKLM\\SYSTEM\\CurrentControlSet\\Services\\MpsSvc\\*[*]\nRegistry,HKLM\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\*[*]\nRegistry,HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\*[*]\nRegistry,HKCU\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\*[*]\nFile,%programdata%\\Microsoft\\Windows\\AppRepository\\Packages\\*[*]\n\n\n[Migration.WatchChanges]\n\n\n[Migration.Ignore.ServerAzureCor]\nMicrosoft-Client-License-Platform-Service-Migration\nMicrosoft-OneCore-TileDataRepository\nMicrosoft-Windows-AppX-Deployment-Server\nMicrosoft-Windows-DeliveryOptimization\nMicrosoft-Windows-DeviceAssociationFramework\nMicrosoft-Windows-Security-SPP\nMicrosoft-Windows-Security-NGC-LocalAccountMigPlugin\nMicrosoft-Windows-ServicingStack\nMicrosoft-Windows-WindowsUpdateClient-Core\n\n\n[Migration.IgnoreSMI]\nMicrosoft-Windows-Application-Experience-Infrastructure\nMicrosoft-Windows-CAPI2-certs\nMicrosoft-Windows-CodeIntegrity\nMicrosoft-Windows-CommandPrompt\nMicrosoft-Windows-Credential-Manager\nMicrosoft-Windows-DataIntegrityScan\nMicrosoft-Windows-EventCollector\nMicrosoft-Windows-FSD\nMicrosoft-Windows-Flighting-Settings\nMicrosoft-Windows-HAL\nMicrosoft-Windows-HelpAndSupport\nMicrosoft-Windows-HTTP\nMicrosoft-Windows-International-Core\nMicrosoft-Windows-International-TimeZones\nMicrosoft-Windows-Kernel-PnP\nMicrosoft-Windows-MUI-Settings\nMicrosoft-Windows-NTFS\nMicrosoft-Windows-Network-Security\nMicrosoft-Windows-Network-Security-Domain-Clients-Svc\nMicrosoft-Windows-NetworkProfile\nMicrosoft-Windows-NlaSvc\nMicrosoft-Windows-OS-Kernel-MinWin\nMicrosoft-Windows-PartitionManager\nMicrosoft-Windows-Power-Policy-Definitions\nMicrosoft-Windows-RasBase-RasSstp\nMicrosoft-Windows-Rasppp-Eap\nMicrosoft-Windows-ReFS\nMicrosoft-Windows-Resource-Exhaustion-Detector-Core\nMicrosoft-Windows-SecureStartup-FilterDriver\nMicrosoft-Windows-Security-CredSSP\nMicrosoft-Windows-Security-Digest\nMicrosoft-Windows-Security-Kerberos\nMicrosoft-Windows-Security-NTLM\nMicrosoft-Windows-Security-Schannel\nMicrosoft-Windows-Services-ServiceController-MinWin\nMicrosoft-Windows-TCPIP\nMicrosoft-Windows-TerminalServices-RDP-WinStationExtensions\nMicrosoft-Windows-TerminalServices-SessionDirectory-Client\nMicrosoft-Windows-Time-Service\nMicrosoft-Windows-UDFS\nMicrosoft-Windows-UserInit\nMicrosoft-Windows-VirtualDiskService\nMicrosoft-Windows-WMI-Core\nMicrosoft-Windows-Web-Services-for-Management-Core\nMicrosoft-Windows-Wininit\nProduct-clientcore__Microsoft-Windows-NlaSvc\nProduct-coresystemserver__Microsoft-Windows-Time-Service\nProduct-onecore__Microsoft-Windows-NlaSvc\nProduct-systemos__Microsoft-Windows-NlaSvc\n\n\n[Servicing.KnownDeviceClasses]\n{6bdd1fc1-810f-11d0-bec7-08002be2092f} ; 1394\n{7ebefbc0-3200-11d2-b4c2-00a0c9697d07} ; 61883\n{c166523c-fe0c-4a94-a586-f1a80cfbbf3e} ; AudioEndpoint\n{5989fce8-9cd0-467d-8a6a-5419e31529d4} ; AudioProcessingObject\n{c06ff265-ae09-48f0-812c-16753d7cba83} ; AVC\n{c243ffbd-3afc-45e9-b3d3-2ba18bc7ebc5} ; BarcodeScanner\n{72631e54-78a4-11d0-bcf7-00aa00b7b32a} ; Battery\n{53d29ef7-377c-4d14-864b-eb3a85769359} ; Biometric\n{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} ; Bluetooth\n{4d36e965-e325-11ce-bfc1-08002be10318} ; CDROM\n{4d36e966-e325-11ce-bfc1-08002be10318} ; Computer\n{14b62f50-3f15-11dd-ae16-0800200c9a66} ; DigitalMediaDevices\n{4d36e967-e325-11ce-bfc1-08002be10318} ; DiskDrive\n{4d36e968-e325-11ce-bfc1-08002be10318} ; Display\n{48721b56-6795-11d2-b1a8-0080c72e74a2} ; Dot4\n{49ce6ac8-6f86-11d2-b1e5-0080c72e74a2} ; Dot4Print\n{9da2b80f-f89f-4a49-a5c2-511b085b9e8a} ; EhStorSilo\n{e2f84ce7-8efa-411c-aa69-97454ca4cb57} ; Extension\n{4d36e969-e325-11ce-bfc1-08002be10318} ; FDC\n{f2e7dd72-6468-4e36-b6f1-6488f42c1b52} ; Firmware\n{4d36e980-e325-11ce-bfc1-08002be10318} ; FloppyDisk\n{4d36e96a-e325-11ce-bfc1-08002be10318} ; HDC\n{772e18f2-8925-4229-a5ac-6453cb482fda} ; HidCashDrawer\n{745a17a0-74d3-11d0-b6fe-00a0c90f57da} ; HIDClass\n{2a9fe532-0cdc-44f9-9827-76192f2ca2fb} ; HidMsr\n{6bdd1fc6-810f-11d0-bec7-08002be2092f} ; Image\n{6bdd1fc5-810f-11d0-bec7-08002be2092f} ; Infrared\n{4d36e96b-e325-11ce-bfc1-08002be10318} ; Keyboard\n{8ecc055d-047f-11d1-a537-0000f8753ed1} ; LegacyDriver\n{4d36e96c-e325-11ce-bfc1-08002be10318} ; MEDIA\n{43675d81-502a-4a82-9f84-b75f418c5dea} ; Media Center Extender\n{ce5939ae-ebde-11d0-b181-0000f8753ec4} ; MediumChanger\n{5099944a-f6b9-4057-a056-8c550228544c} ; Memory\n{d421b08e-6d16-41ca-9c4d-9147e5ac98e0} ; Miracast\n{4d36e96d-e325-11ce-bfc1-08002be10318} ; Modem\n{4d36e96e-e325-11ce-bfc1-08002be10318} ; Monitor\n{4d36e96f-e325-11ce-bfc1-08002be10318} ; Mouse\n{4d36e970-e325-11ce-bfc1-08002be10318} ; MTD\n{4d36e971-e325-11ce-bfc1-08002be10318} ; MultiFunction\n{50906cb8-ba12-11d1-bf5d-0000f805f530} ; MultiPortSerial\n{4d36e972-e325-11ce-bfc1-08002be10318} ; Net\n{4d36e973-e325-11ce-bfc1-08002be10318} ; NetClient\n{4d36e974-e325-11ce-bfc1-08002be10318} ; NetService\n{4d36e975-e325-11ce-bfc1-08002be10318} ; NetTrans\n{4d36e977-e325-11ce-bfc1-08002be10318} ; PCMCIA\n ", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "wdsimage.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/4ed57014301e91b0504e0c2a62f4ee969ccf4c179de9788d1307dbc71186d543", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\wdsimage.dll" ], "size": 750032, "crc32": "7B6CCAF6", "md5": "b5d99819cb865c4da4ebe8880f5ada7e", "sha1": "5bad51becb913f65acc8b2df912ac76a24f0834d", "sha256": "4ed57014301e91b0504e0c2a62f4ee969ccf4c179de9788d1307dbc71186d543", "sha512": "5ac313784cb4aa3829ae59770049b27d3d50193b206cad43c2d79bb7674766be5199f4f76be9854df635df2094e763ca61f14699d8538f62393f10c781fccfb7", "rh_hash": null, "ssdeep": "12288:YuUi9cOIJAeMgC14k1BzD96/am+Bzqx8J8yh7Rb6bbYYcdacXgmr0zZkIvSzfqav:Ai9cOsMgC144vOe7RbibYZMcSsldT", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1EAF46D13A6E841BDF2B37530167D3B7A197BB6306F70D8CF12124C9A75216C29A3A727", "sha3_384": "8e700fecfb7849e33b83586ca6ce613be71fb6251b90828378e25f73f14fba7ebfa2245cfdb8da9e41fe73a518785df2", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x000a7850", "ep_bytes": "8bff558bec837d0c017505e8e5050000", "peid_signatures": null, "reported_checksum": "0x000c4b79", "actual_checksum": "0x000c4b79", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "WdsImage.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x100ad380", "name": "memcpy" }, { "address": "0x100ad384", "name": "wprintf" }, { "address": "0x100ad388", "name": "_vscwprintf" }, { "address": "0x100ad38c", "name": "towupper" }, { "address": "0x100ad390", "name": "wcscpy_s" }, { "address": "0x100ad394", "name": "swscanf_s" }, { "address": "0x100ad398", "name": "wcsncmp" }, { "address": "0x100ad39c", "name": "_wcstoi64" }, { "address": "0x100ad3a0", "name": "wcsnlen" }, { "address": "0x100ad3a4", "name": "wcsstr" }, { "address": "0x100ad3a8", "name": "strncpy_s" }, { "address": "0x100ad3ac", "name": "memmove" }, { "address": "0x100ad3b0", "name": "??1type_info@@UAE@XZ" }, { "address": "0x100ad3b4", "name": "__RTDynamicCast" }, { "address": "0x100ad3b8", "name": "__dllonexit" }, { "address": "0x100ad3bc", "name": "_unlock" }, { "address": "0x100ad3c0", "name": "_lock" }, { "address": "0x100ad3c4", "name": "__CxxFrameHandler3" }, { "address": "0x100ad3c8", "name": "_initterm" }, { "address": "0x100ad3cc", "name": "_amsg_exit" }, { "address": "0x100ad3d0", "name": "_XcptFilter" }, { "address": "0x100ad3d4", "name": "_CxxThrowException" }, { "address": "0x100ad3d8", "name": "_callnewh" }, { "address": "0x100ad3dc", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0x100ad3e0", "name": "??1exception@@UAE@XZ" }, { "address": "0x100ad3e4", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0x100ad3e8", "name": "??0exception@@QAE@XZ" }, { "address": "0x100ad3ec", "name": "malloc" }, { "address": "0x100ad3f0", "name": "free" }, { "address": "0x100ad3f4", "name": "_wcsicmp" }, { "address": "0x100ad3f8", "name": "wcschr" }, { "address": "0x100ad3fc", "name": "_strnicmp" }, { "address": "0x100ad400", "name": "_wcslwr" }, { "address": "0x100ad404", "name": "bsearch" }, { "address": "0x100ad408", "name": "?terminate@@YAXXZ" }, { "address": "0x100ad40c", "name": "_wcsrev" }, { "address": "0x100ad410", "name": "qsort" }, { "address": "0x100ad414", "name": "strcpy_s" }, { "address": "0x100ad418", "name": "memmove_s" }, { "address": "0x100ad41c", "name": "iswdigit" }, { "address": "0x100ad420", "name": "_wcstoui64" }, { "address": "0x100ad424", "name": "vswprintf_s" }, { "address": "0x100ad428", "name": "iswctype" }, { "address": "0x100ad42c", "name": "_vsnwprintf_s" }, { "address": "0x100ad430", "name": "wcsrchr" }, { "address": "0x100ad434", "name": "_wcsnicmp" }, { "address": "0x100ad438", "name": "wcstoul" }, { "address": "0x100ad43c", "name": "memcmp" }, { "address": "0x100ad440", "name": "_wcsupr" }, { "address": "0x100ad444", "name": "wcstok_s" }, { "address": "0x100ad448", "name": "toupper" }, { "address": "0x100ad44c", "name": "iswspace" }, { "address": "0x100ad450", "name": "iswxdigit" }, { "address": "0x100ad454", "name": "wcsncat_s" }, { "address": "0x100ad458", "name": "_onexit" }, { "address": "0x100ad45c", "name": "_except_handler4_common" }, { "address": "0x100ad460", "name": "_ftol2" }, { "address": "0x100ad464", "name": "memcpy_s" }, { "address": "0x100ad468", "name": "_wtoi64" }, { "address": "0x100ad46c", "name": "_wtoi" }, { "address": "0x100ad470", "name": "_vsnwprintf" }, { "address": "0x100ad474", "name": "_purecall" }, { "address": "0x100ad478", "name": "memset" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x100ad480", "name": "RtlRaiseStatus" }, { "address": "0x100ad484", "name": "NtYieldExecution" }, { "address": "0x100ad488", "name": "RtlInitializeCriticalSection" }, { "address": "0x100ad48c", "name": "NtQuerySymbolicLinkObject" }, { "address": "0x100ad490", "name": "NtOpenSymbolicLinkObject" }, { "address": "0x100ad494", "name": "NtQueryObject" }, { "address": "0x100ad498", "name": "VerSetConditionMask" }, { "address": "0x100ad49c", "name": "RtlVerifyVersionInfo" }, { "address": "0x100ad4a0", "name": "NtQueryDirectoryObject" }, { "address": "0x100ad4a4", "name": "NtOpenDirectoryObject" }, { "address": "0x100ad4a8", "name": "RtlGetVersion" }, { "address": "0x100ad4ac", "name": "RtlReAllocateHeap" }, { "address": "0x100ad4b0", "name": "RtlNtStatusToDosError" }, { "address": "0x100ad4b4", "name": "RtlAllocateHeap" }, { "address": "0x100ad4b8", "name": "RtlFreeHeap" }, { "address": "0x100ad4bc", "name": "RtlCompareMemory" }, { "address": "0x100ad4c0", "name": "NtSetInformationFile" }, { "address": "0x100ad4c4", "name": "RtlDosPathNameToNtPathName_U_WithStatus" }, { "address": "0x100ad4c8", "name": "RtlGetThreadErrorMode" }, { "address": "0x100ad4cc", "name": "NtUnloadKey2" }, { "address": "0x100ad4d0", "name": "NtQuerySecurityObject" }, { "address": "0x100ad4d4", "name": "RtlAdjustPrivilege" }, { "address": "0x100ad4d8", "name": "RtlImpersonateSelf" }, { "address": "0x100ad4dc", "name": "NtSetEaFile" }, { "address": "0x100ad4e0", "name": "RtlInitUnicodeString" }, { "address": "0x100ad4e4", "name": "NtQueryDirectoryFile" }, { "address": "0x100ad4e8", "name": "RtlDeleteResource" }, { "address": "0x100ad4ec", "name": "RtlReleaseResource" }, { "address": "0x100ad4f0", "name": "RtlAcquireResourceShared" }, { "address": "0x100ad4f4", "name": "RtlAcquireResourceExclusive" }, { "address": "0x100ad4f8", "name": "RtlInitializeResource" }, { "address": "0x100ad4fc", "name": "NtOpenFile" }, { "address": "0x100ad500", "name": "NtClose" }, { "address": "0x100ad504", "name": "NtCreateFile" }, { "address": "0x100ad508", "name": "RtlDosPathNameToNtPathName_U" }, { "address": "0x100ad50c", "name": "NtQueryEaFile" }, { "address": "0x100ad510", "name": "NtSetSecurityObject" }, { "address": "0x100ad514", "name": "RtlFindAceByType" }, { "address": "0x100ad518", "name": "RtlSetControlSecurityDescriptor" }, { "address": "0x100ad51c", "name": "RtlGetLastNtStatus" }, { "address": "0x100ad520", "name": "NtQueryInformationProcess" }, { "address": "0x100ad524", "name": "NtQueryVolumeInformationFile" }, { "address": "0x100ad528", "name": "NtQueryInformationFile" }, { "address": "0x100ad52c", "name": "RtlSetThreadErrorMode" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x100ad000", "name": "RegFlushKey" }, { "address": "0x100ad004", "name": "SetThreadToken" }, { "address": "0x100ad008", "name": "DuplicateTokenEx" }, { "address": "0x100ad00c", "name": "GetKernelObjectSecurity" }, { "address": "0x100ad010", "name": "AdjustTokenPrivileges" }, { "address": "0x100ad014", "name": "LookupPrivilegeValueW" }, { "address": "0x100ad018", "name": "RegLoadKeyW" }, { "address": "0x100ad01c", "name": "RegUnLoadKeyW" }, { "address": "0x100ad020", "name": "RegQueryInfoKeyW" }, { "address": "0x100ad024", "name": "RevertToSelf" }, { "address": "0x100ad028", "name": "CloseEncryptedFileRaw" }, { "address": "0x100ad02c", "name": "WriteEncryptedFileRaw" }, { "address": "0x100ad030", "name": "OpenEncryptedFileRawW" }, { "address": "0x100ad034", "name": "GetSecurityInfo" }, { "address": "0x100ad038", "name": "GetAclInformation" }, { "address": "0x100ad03c", "name": "GetSecurityDescriptorLength" }, { "address": "0x100ad040", "name": "FreeSid" }, { "address": "0x100ad044", "name": "SetSecurityDescriptorDacl" }, { "address": "0x100ad048", "name": "EqualSid" }, { "address": "0x100ad04c", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x100ad050", "name": "SetNamedSecurityInfoW" }, { "address": "0x100ad054", "name": "GetFileSecurityW" }, { "address": "0x100ad058", "name": "ConvertSecurityDescriptorToStringSecurityDescriptorW" }, { "address": "0x100ad05c", "name": "GetSecurityDescriptorControl" }, { "address": "0x100ad060", "name": "GetSecurityDescriptorOwner" }, { "address": "0x100ad064", "name": "GetSecurityDescriptorGroup" }, { "address": "0x100ad068", "name": "GetSecurityDescriptorDacl" }, { "address": "0x100ad06c", "name": "GetSecurityDescriptorSacl" }, { "address": "0x100ad070", "name": "AddAccessAllowedAce" }, { "address": "0x100ad074", "name": "InitializeAcl" }, { "address": "0x100ad078", "name": "GetLengthSid" }, { "address": "0x100ad07c", "name": "GetTokenInformation" }, { "address": "0x100ad080", "name": "OpenProcessToken" }, { "address": "0x100ad084", "name": "OpenThreadToken" }, { "address": "0x100ad088", "name": "AllocateAndInitializeSid" }, { "address": "0x100ad08c", "name": "InitializeSecurityDescriptor" }, { "address": "0x100ad090", "name": "RegCloseKey" }, { "address": "0x100ad094", "name": "RegDeleteKeyExW" }, { "address": "0x100ad098", "name": "ReadEncryptedFileRaw" }, { "address": "0x100ad09c", "name": "RegCreateKeyExW" }, { "address": "0x100ad0a0", "name": "RegEnumKeyExW" }, { "address": "0x100ad0a4", "name": "RegSetValueExW" }, { "address": "0x100ad0a8", "name": "RegOpenKeyExW" }, { "address": "0x100ad0ac", "name": "RegDeleteValueW" }, { "address": "0x100ad0b0", "name": "RegEnumValueW" }, { "address": "0x100ad0b4", "name": "RegQueryValueExW" }, { "address": "0x100ad0b8", "name": "RegGetValueW" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x100ad0dc", "name": "GetTempFileNameW" }, { "address": "0x100ad0e0", "name": "GetFileSize" }, { "address": "0x100ad0e4", "name": "FindFirstVolumeW" }, { "address": "0x100ad0e8", "name": "GetLogicalDrives" }, { "address": "0x100ad0ec", "name": "Wow64DisableWow64FsRedirection" }, { "address": "0x100ad0f0", "name": "CreateProcessW" }, { "address": "0x100ad0f4", "name": "Wow64RevertWow64FsRedirection" }, { "address": "0x100ad0f8", "name": "WaitForSingleObjectEx" }, { "address": "0x100ad0fc", "name": "FindVolumeClose" }, { "address": "0x100ad100", "name": "DefineDosDeviceW" }, { "address": "0x100ad104", "name": "MapViewOfFileEx" }, { "address": "0x100ad108", "name": "GetDiskFreeSpaceExW" }, { "address": "0x100ad10c", "name": "RaiseException" }, { "address": "0x100ad110", "name": "QueryDosDeviceW" }, { "address": "0x100ad114", "name": "FindNextVolumeW" }, { "address": "0x100ad118", "name": "TerminateProcess" }, { "address": "0x100ad11c", "name": "GetCurrentProcess" }, { "address": "0x100ad120", "name": "GetExitCodeProcess" }, { "address": "0x100ad124", "name": "OutputDebugStringW" }, { "address": "0x100ad128", "name": "GetFileTime" }, { "address": "0x100ad12c", "name": "MoveFileWithProgressW" }, { "address": "0x100ad130", "name": "GetVolumePathNamesForVolumeNameW" }, { "address": "0x100ad134", "name": "LoadLibraryW" }, { "address": "0x100ad138", "name": "TlsSetValue" }, { "address": "0x100ad13c", "name": "TlsGetValue" }, { "address": "0x100ad140", "name": "TlsFree" }, { "address": "0x100ad144", "name": "TlsAlloc" }, { "address": "0x100ad148", "name": "SetFileTime" }, { "address": "0x100ad14c", "name": "LocalFileTimeToFileTime" }, { "address": "0x100ad150", "name": "DosDateTimeToFileTime" }, { "address": "0x100ad154", "name": "MultiByteToWideChar" }, { "address": "0x100ad158", "name": "WaitForMultipleObjectsEx" }, { "address": "0x100ad15c", "name": "CreateSemaphoreExW" }, { "address": "0x100ad160", "name": "GetSystemDirectoryW" }, { "address": "0x100ad164", "name": "RemoveDirectoryW" }, { "address": "0x100ad168", "name": "GlobalMemoryStatusEx" }, { "address": "0x100ad16c", "name": "GetVolumeInformationByHandleW" }, { "address": "0x100ad170", "name": "UnmapViewOfFile" }, { "address": "0x100ad174", "name": "MapViewOfFile" }, { "address": "0x100ad178", "name": "CreateFileMappingW" }, { "address": "0x100ad17c", "name": "CreateSemaphoreW" }, { "address": "0x100ad180", "name": "ReleaseSemaphore" }, { "address": "0x100ad184", "name": "WaitForMultipleObjects" }, { "address": "0x100ad188", "name": "GetPrivateProfileSectionW" }, { "address": "0x100ad18c", "name": "SetThreadIdealProcessor" }, { "address": "0x100ad190", "name": "GetSystemInfo" }, { "address": "0x100ad194", "name": "DuplicateHandle" }, { "address": "0x100ad198", "name": "HeapReAlloc" }, { "address": "0x100ad19c", "name": "OpenProcess" }, { "address": "0x100ad1a0", "name": "GetCurrentThread" }, { "address": "0x100ad1a4", "name": "WideCharToMultiByte" }, { "address": "0x100ad1a8", "name": "ReleaseMutex" }, { "address": "0x100ad1ac", "name": "GetModuleHandleExW" }, { "address": "0x100ad1b0", "name": "CreateMutexW" }, { "address": "0x100ad1b4", "name": "LocalAlloc" }, { "address": "0x100ad1b8", "name": "UnlockFileEx" }, { "address": "0x100ad1bc", "name": "VirtualFree" }, { "address": "0x100ad1c0", "name": "VirtualAlloc" }, { "address": "0x100ad1c4", "name": "UnhandledExceptionFilter" }, { "address": "0x100ad1c8", "name": "GetTickCount" }, { "address": "0x100ad1cc", "name": "GetSystemTimeAsFileTime" }, { "address": "0x100ad1d0", "name": "GetCurrentThreadId" }, { "address": "0x100ad1d4", "name": "LockFileEx" }, { "address": "0x100ad1d8", "name": "SetFilePointer" }, { "address": "0x100ad1dc", "name": "InitializeCriticalSectionAndSpinCount" }, { "address": "0x100ad1e0", "name": "CreateEventW" }, { "address": "0x100ad1e4", "name": "GetVolumeInformationW" }, { "address": "0x100ad1e8", "name": "WriteFile" }, { "address": "0x100ad1ec", "name": "GetOverlappedResult" }, { "address": "0x100ad1f0", "name": "ReadFile" }, { "address": "0x100ad1f4", "name": "SetEndOfFile" }, { "address": "0x100ad1f8", "name": "SetFilePointerEx" }, { "address": "0x100ad1fc", "name": "GetFileSizeEx" }, { "address": "0x100ad200", "name": "GetHandleInformation" }, { "address": "0x100ad204", "name": "LoadLibraryExW" }, { "address": "0x100ad208", "name": "FreeLibrary" }, { "address": "0x100ad20c", "name": "GetCurrentProcessId" }, { "address": "0x100ad210", "name": "QueryPerformanceCounter" }, { "address": "0x100ad214", "name": "Sleep" }, { "address": "0x100ad218", "name": "LocalFree" }, { "address": "0x100ad21c", "name": "LeaveCriticalSection" }, { "address": "0x100ad220", "name": "EnterCriticalSection" }, { "address": "0x100ad224", "name": "GetFullPathNameW" }, { "address": "0x100ad228", "name": "DeleteCriticalSection" }, { "address": "0x100ad22c", "name": "InitializeCriticalSection" }, { "address": "0x100ad230", "name": "DeleteFileW" }, { "address": "0x100ad234", "name": "CopyFileW" }, { "address": "0x100ad238", "name": "SetFileAttributesW" }, { "address": "0x100ad23c", "name": "CloseHandle" }, { "address": "0x100ad240", "name": "CreateFileW" }, { "address": "0x100ad244", "name": "SetLastError" }, { "address": "0x100ad248", "name": "FindClose" }, { "address": "0x100ad24c", "name": "FindNextFileW" }, { "address": "0x100ad250", "name": "FindFirstFileW" }, { "address": "0x100ad254", "name": "MoveFileW" }, { "address": "0x100ad258", "name": "CreateDirectoryW" }, { "address": "0x100ad25c", "name": "GetLastError" }, { "address": "0x100ad260", "name": "GetFileAttributesW" }, { "address": "0x100ad264", "name": "FileTimeToSystemTime" }, { "address": "0x100ad268", "name": "HeapAlloc" }, { "address": "0x100ad26c", "name": "GetProcessHeap" }, { "address": "0x100ad270", "name": "HeapFree" }, { "address": "0x100ad274", "name": "SetUnhandledExceptionFilter" }, { "address": "0x100ad278", "name": "ResetEvent" }, { "address": "0x100ad27c", "name": "CreateThread" }, { "address": "0x100ad280", "name": "SetEvent" }, { "address": "0x100ad284", "name": "FormatMessageW" }, { "address": "0x100ad288", "name": "WaitForSingleObject" }, { "address": "0x100ad28c", "name": "GetEnvironmentVariableW" }, { "address": "0x100ad290", "name": "SetEnvironmentVariableW" }, { "address": "0x100ad294", "name": "GetDriveTypeW" }, { "address": "0x100ad298", "name": "GetCurrentDirectoryW" }, { "address": "0x100ad29c", "name": "GetVolumeNameForVolumeMountPointW" }, { "address": "0x100ad2a0", "name": "GetVolumePathNameW" }, { "address": "0x100ad2a4", "name": "GetModuleFileNameW" }, { "address": "0x100ad2a8", "name": "GetFinalPathNameByHandleW" }, { "address": "0x100ad2ac", "name": "GetLongPathNameW" }, { "address": "0x100ad2b0", "name": "CompareStringW" }, { "address": "0x100ad2b4", "name": "FlushFileBuffers" }, { "address": "0x100ad2b8", "name": "CopyFileExW" }, { "address": "0x100ad2bc", "name": "GetProcAddress" }, { "address": "0x100ad2c0", "name": "SetFileInformationByHandle" }, { "address": "0x100ad2c4", "name": "GetFileInformationByHandle" }, { "address": "0x100ad2c8", "name": "GetModuleHandleW" }, { "address": "0x100ad2cc", "name": "GetTempPathW" }, { "address": "0x100ad2d0", "name": "DeviceIoControl" }, { "address": "0x100ad2d4", "name": "GetFileInformationByHandleEx" }, { "address": "0x100ad2d8", "name": "GetDiskFreeSpaceW" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x100ad308", "name": "I_RpcMapWin32Status" }, { "address": "0x100ad30c", "name": "UuidToStringW" }, { "address": "0x100ad310", "name": "RpcStringFreeW" }, { "address": "0x100ad314", "name": "UuidFromStringW" }, { "address": "0x100ad318", "name": "NdrClientCall2" }, { "address": "0x100ad31c", "name": "RpcStringBindingComposeW" }, { "address": "0x100ad320", "name": "RpcBindingFromStringBindingW" }, { "address": "0x100ad324", "name": "RpcBindingSetAuthInfoW" }, { "address": "0x100ad328", "name": "RpcBindingFree" }, { "address": "0x100ad32c", "name": "UuidCreate" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x100ad344", "name": "CharUpperW" }, { "address": "0x100ad348", "name": "CharUpperBuffW" } ] }, "bcrypt": { "dll": "bcrypt.dll", "imports": [ { "address": "0x100ad360", "name": "BCryptOpenAlgorithmProvider" }, { "address": "0x100ad364", "name": "BCryptGetProperty" }, { "address": "0x100ad368", "name": "BCryptCreateHash" }, { "address": "0x100ad36c", "name": "BCryptFinishHash" }, { "address": "0x100ad370", "name": "BCryptDestroyHash" }, { "address": "0x100ad374", "name": "BCryptHashData" }, { "address": "0x100ad378", "name": "BCryptCloseAlgorithmProvider" } ] }, "Cabinet": { "dll": "Cabinet.dll", "imports": [] }, "SHLWAPI": { "dll": "SHLWAPI.dll", "imports": [ { "address": "0x100ad33c", "name": "PathIsUNCW" } ] }, "Normaliz": { "dll": "Normaliz.dll", "imports": [ { "address": "0x100ad2e0", "name": "IdnToAscii" } ] }, "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x100ad534", "name": "CLSIDFromString" }, { "address": "0x100ad538", "name": "StringFromCLSID" }, { "address": "0x100ad53c", "name": "CoCreateInstance" }, { "address": "0x100ad540", "name": "CoTaskMemFree" }, { "address": "0x100ad544", "name": "CoUninitialize" }, { "address": "0x100ad548", "name": "CoInitializeEx" }, { "address": "0x100ad54c", "name": "CoSetProxyBlanket" }, { "address": "0x100ad550", "name": "CoInitializeSecurity" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x100ad2e8", "name": "VariantClear" }, { "address": "0x100ad2ec", "name": "SetErrorInfo" }, { "address": "0x100ad2f0", "name": "GetErrorInfo" }, { "address": "0x100ad2f4", "name": "SafeArrayGetElement" }, { "address": "0x100ad2f8", "name": "SysFreeString" }, { "address": "0x100ad2fc", "name": "SysAllocString" }, { "address": "0x100ad300", "name": "SysStringLen" } ] }, "SETUPAPI": { "dll": "SETUPAPI.dll", "imports": [ { "address": "0x100ad334", "name": "CMP_WaitNoPendingInstallEvents" } ] }, "VERSION": { "dll": "VERSION.dll", "imports": [ { "address": "0x100ad350", "name": "GetFileVersionInfoSizeExW" }, { "address": "0x100ad354", "name": "GetFileVersionInfoExW" }, { "address": "0x100ad358", "name": "VerQueryValueW" } ] }, "FLTLIB": { "dll": "FLTLIB.DLL", "imports": [ { "address": "0x100ad0d0", "name": "FilterAttach" }, { "address": "0x100ad0d4", "name": "FilterLoad" } ] } }, "exported_dll_name": "WdsImage.dll", "exports": [ { "address": "0x100205e0", "name": "FindFirstImage", "ordinal": 1 }, { "address": "0x100206b0", "name": "FindNextImage", "ordinal": 2 }, { "address": "0x1001c150", "name": "WDSFreeImageInformation", "ordinal": 3 }, { "address": "0x1001c480", "name": "WDSGetImageInformation", "ordinal": 4 }, { "address": "0x1001c120", "name": "WDSInitializeEmptyImageInformation", "ordinal": 5 }, { "address": "0x1001c590", "name": "WDSParseImageInformation", "ordinal": 6 }, { "address": "0x1001c350", "name": "WDSSetImageInformation", "ordinal": 7 }, { "address": "0x10024760", "name": "WdsImgAddReference", "ordinal": 8 }, { "address": "0x1001df70", "name": "WdsImgApplyImage", "ordinal": 9 }, { "address": "0x1001ce20", "name": "WdsImgAssignImageIdentifier", "ordinal": 10 }, { "address": "0x1001cf20", "name": "WdsImgAssignPredefinedImageIdentifier", "ordinal": 11 }, { "address": "0x1001e3d0", "name": "WdsImgCaptureImage", "ordinal": 12 }, { "address": "0x1001ce90", "name": "WdsImgClearImageIdentifier", "ordinal": 13 }, { "address": "0x100246b0", "name": "WdsImgClose", "ordinal": 14 }, { "address": "0x1001ded0", "name": "WdsImgCopyImage", "ordinal": 15 }, { "address": "0x1001f000", "name": "WdsImgCreateImageGroup", "ordinal": 16 }, { "address": "0x1001e020", "name": "WdsImgDeleteImage", "ordinal": 17 }, { "address": "0x1001f3a0", "name": "WdsImgDeleteImageGroup", "ordinal": 18 }, { "address": "0x1001db70", "name": "WdsImgDeleteUnattendFile", "ordinal": 19 }, { "address": "0x1001ddd0", "name": "WdsImgExportImage", "ordinal": 20 }, { "address": "0x1001e510", "name": "WdsImgExtractFiles", "ordinal": 21 }, { "address": "0x10020740", "name": "WdsImgFindFirstImage", "ordinal": 22 }, { "address": "0x1001fa00", "name": "WdsImgFindFirstImageGroup", "ordinal": 23 }, { "address": "0x10020820", "name": "WdsImgFindNextImage", "ordinal": 24 }, { "address": "0x1001fac0", "name": "WdsImgFindNextImageGroup", "ordinal": 25 }, { "address": "0x1001d660", "name": "WdsImgGetArchitecture", "ordinal": 26 }, { "address": "0x1001d220", "name": "WdsImgGetBootIndex", "ordinal": 27 }, { "address": "0x100249d0", "name": "WdsImgGetCompressionType", "ordinal": 28 }, { "address": "0x1001d760", "name": "WdsImgGetCreationTime", "ordinal": 29 }, { "address": "0x1001d8b0", "name": "WdsImgGetDependantFiles", "ordinal": 30 }, { "address": "0x1001cfa0", "name": "WdsImgGetDescription", "ordinal": 31 }, { "address": "0x1001d4d0", "name": "WdsImgGetEnabled", "ordinal": 32 }, { "address": "0x1001d550", "name": "WdsImgGetExFlags", "ordinal": 33 }, { "address": "0x1001cfc0", "name": "WdsImgGetFlags", "ordinal": 34 }, { "address": "0x1001cca0", "name": "WdsImgGetGuid", "ordinal": 35 }, { "address": "0x1001d5e0", "name": "WdsImgGetHalName", "ordinal": 36 }, { "address": "0x10024930", "name": "WdsImgGetHandleFromFindHandle", "ordinal": 37 }, { "address": "0x1001cba0", "name": "WdsImgGetImageFormat", "ordinal": 38 }, { "address": "0x1001cd90", "name": "WdsImgGetImageIdentifier", "ordinal": 39 }, { "address": "0x1001cd20", "name": "WdsImgGetImageIdentifierPresent", "ordinal": 40 }, { "address": "0x1001d1b0", "name": "WdsImgGetIndex", "ordinal": 41 }, { "address": "0x1001d310", "name": "WdsImgGetLanguage", "ordinal": 42 }, { "address": "0x1001d930", "name": "WdsImgGetLanguages", "ordinal": 43 }, { "address": "0x1001d7d0", "name": "WdsImgGetLastModifiedTime", "ordinal": 44 }, { "address": "0x1001cc80", "name": "WdsImgGetName", "ordinal": 45 }, { "address": "0x1001d040", "name": "WdsImgGetPartitionStyle", "ordinal": 46 }, { "address": "0x10024800", "name": "WdsImgGetPath", "ordinal": 47 }, { "address": "0x1001d490", "name": "WdsImgGetProductFamily", "ordinal": 48 }, { "address": "0x1001d4b0", "name": "WdsImgGetProductName", "ordinal": 49 }, { "address": "0x1001cc10", "name": "WdsImgGetResourcePath", "ordinal": 50 }, { "address": "0x1001d0b0", "name": "WdsImgGetSecurity", "ordinal": 51 }, { "address": "0x1001d410", "name": "WdsImgGetServicePackLevel", "ordinal": 52 }, { "address": "0x1001d130", "name": "WdsImgGetSize", "ordinal": 53 }, { "address": "0x1001d5c0", "name": "WdsImgGetSystemRoot", "ordinal": 54 }, { "address": "0x1001d840", "name": "WdsImgGetUnattendFilePresent", "ordinal": 55 }, { "address": "0x1001d390", "name": "WdsImgGetVersion", "ordinal": 56 }, { "address": "0x1001d6e0", "name": "WdsImgGetXml", "ordinal": 57 }, { "address": "0x1001f420", "name": "WdsImgGroupCanImportImage", "ordinal": 58 }, { "address": "0x1001f530", "name": "WdsImgGroupGetImageFormat", "ordinal": 59 }, { "address": "0x1001fb40", "name": "WdsImgGroupGetName", "ordinal": 60 }, { "address": "0x1001f2a0", "name": "WdsImgGroupGetSecurity", "ordinal": 61 }, { "address": "0x1001f2e0", "name": "WdsImgGroupSetName", "ordinal": 62 }, { "address": "0x1001f340", "name": "WdsImgGroupSetSecurity", "ordinal": 63 }, { "address": "0x1001dcb0", "name": "WdsImgImportImage", "ordinal": 64 }, { "address": "0x10024700", "name": "WdsImgIsAccessible", "ordinal": 65 }, { "address": "0x1001d290", "name": "WdsImgIsBootImage", "ordinal": 66 }, { "address": "0x1001d9c0", "name": "WdsImgIsFoundationImage", "ordinal": 67 }, { "address": "0x100247b0", "name": "WdsImgIsValidImageFile", "ordinal": 68 }, { "address": "0x1001f1c0", "name": "WdsImgOpenBootImageGroup", "ordinal": 69 }, { "address": "0x1001cac0", "name": "WdsImgOpenImage", "ordinal": 70 }, { "address": "0x1001f100", "name": "WdsImgOpenImageGroup", "ordinal": 71 }, { "address": "0x1001f680", "name": "WdsImgOpenImageStore", "ordinal": 72 }, { "address": "0x1001dfe0", "name": "WdsImgRefreshData", "ordinal": 73 }, { "address": "0x1001e160", "name": "WdsImgReplaceImage", "ordinal": 74 }, { "address": "0x1001e380", "name": "WdsImgSetBootImage", "ordinal": 75 }, { "address": "0x1001da70", "name": "WdsImgSetDescription", "ordinal": 76 }, { "address": "0x1001daf0", "name": "WdsImgSetEnabled", "ordinal": 77 }, { "address": "0x1001da30", "name": "WdsImgSetName", "ordinal": 78 }, { "address": "0x1001dab0", "name": "WdsImgSetSecurity", "ordinal": 79 }, { "address": "0x1001dc20", "name": "WdsImgSetUnattendFile", "ordinal": 80 }, { "address": "0x1001e070", "name": "WdsImgVerifyImageFile", "ordinal": 81 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000a9be0", "size": "0x00000a01" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000ad55c", "size": "0x00000140" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x000b0000", "size": "0x00001298" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x000b5000", "size": "0x000021d0" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x000b2000", "size": "0x00006d04" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x0001b330", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x000037ac", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00003700", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x000ad000", "size": "0x00000558" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x000a95e1", "size_of_data": "0x000a9600", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.52" }, { "name": ".data", "raw_address": "0x000a9a00", "virtual_address": "0x000ab000", "virtual_size": "0x000018a8", "size_of_data": "0x00000e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "4.82" }, { "name": ".idata", "raw_address": "0x000aa800", "virtual_address": "0x000ad000", "virtual_size": "0x000024c0", "size_of_data": "0x00002600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.65" }, { "name": ".rsrc", "raw_address": "0x000ace00", "virtual_address": "0x000b0000", "virtual_size": "0x00001298", "size_of_data": "0x00001400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.23" }, { "name": ".reloc", "raw_address": "0x000ae200", "virtual_address": "0x000b2000", "virtual_size": "0x00006d04", "size_of_data": "0x00006e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.76" } ], "overlay": { "offset": "0x000b5000", "size": "0x000021d0" }, "resources": [ { "name": "MUI", "offset": "0x000b11d0", "size": "0x000000c8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.68" }, { "name": "RT_MESSAGETABLE", "offset": "0x000b04b8", "size": "0x00000d14", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.26" }, { "name": "RT_VERSION", "offset": "0x000b00f0", "size": "0x000003c8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.51" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Deployment Services Image Library" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "WdsImage.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "WdsImage.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "81a88ef33e5f5f68f3ab0bd66cd8f5f3", "timestamp": "2037-03-20 07:31:10", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 15 }, "data": null, "strings": [ "Wmi::OpenNamespace: Failed to initialize security (0x%08x)", "ro-MD", "mk-MK", "WimImageEnqueueOperation", "GetTokenInformation", "? ?,?8?D?P?\\?h?t?", "Property value is an array; will return the first item.", "808A8H8~8", ">_>f>q>", ".?AV?$CAutoDeleteArray@G@RAII@@", "AddReparsePointToImage", "sr-Cyrl-RS", "es-DO", ".CRT$XLA", "WdsImgIsFoundationImage", "545V5n5w5", "A>m>t>", "f92u9A", "9$9b9", "lo-LA", "#document", "<15S5f5", "malloc", "es-BO", "y0Vh[", "9sTtr", ".?AVIDepWIMImage@@", "_wtoi64", "3>3O3", ">V?]?|?", "QQQQj", "tFWj;P", "UCS-4", "6Q6e6", ";3;9;E;b;i;u;", "SendAbortMessage", "9~Xt#", "t';z|r\"w", "NtQueryInformationProcess", "QQVW3", "%s: Generated new metadata for %s.", "7,838", "777>7h7", "RegCreateKeyExW", "PUBLIC", "DuplicateHandle", "UnmapViewOfFile", "Substitue name string copy failed", "2J2x2", "Cf9Y*", "az-Cyrl-AZ", "9t$8tJ", "3(343@3L3X3d3p3|3", "2;3x3", "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X", "=3>\\>f>~>", "686o6x6", "InitVDSService:Loading VDS service... ", "de-CH", "Mount path low", "6!666h6", "sr-Latn", "u%jXh0j", "L$D_^[3", "VhdSafeReadMetadata: Failed to read file %s [0x%08x]", ">6?|?", "A(SQSSPSSQ", "FveAddAuthMethodInformation", "2,383s3", "061E1K1", "LocalSize failed", "WdsImgDeleteUnattendFile", "WIM_Chunked_Number_Of_Buffers", "3!3)353?3G3N3^3", "Image Index", "StateStoreGetMountedImageStatus", ";X;e;l;w;", "WIM_Chunked_Parallel_Decode", "TOTALBYTES", "ysWhE", "WdsImgGetGuid", "1 1<1", "GetImageErrorCode", "wcsstr", "system32", "en-CA", "D$H^f", "9\\$Pv", ">2>8>O>V>", "ts-ZA", "WDSSetImageInformation", "OpenProcess", "CVhdInfoInterface::GetFileParts", "t!<(t", "DetachVirtualDisk", "[ybVhl", "Base.VHDX", "9d:m:", "@(93u", "<==D=", "2\"3G3^3e3", "DefineDosDeviceW", "Apparent split WIM file [%s] is part number %u (expected %u)", "CommitTransaction", "D$0VPhH", "TerminateProcess", "The image group already contains images of a different type. %n", "y6Vhj", "SetThreadToken", "RestoreSecurityDescriptor failed", "s$97t", ">,>0>@>D>T>X>\\>t>x>", "VW9Y0ty", "CreationTime\\HighPart", ".idata$5", ".?AVCDepVHDImage@@", "3%3O3i3o3", "3!353<3Q3X3g3n3", "t*WPd", "NtOpenFile", "Group not found. %n", "fr-029", "IsReadOnly", "tn-BW", "30B0Z0w0", "t0WWj", "WIMCommitImageHandle", "FileCount", "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x", "0!1@1^1k1", "D$8PW", ";,;3;R;y;", "7=7S7", ":#:|:", "es-CL", "file corrupted in block at offset %p", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect\\Cache", "Failed to get create a GUID.", "546>7", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART", "ResNodesSort", "8#9/9O9", "RestoreAllData", "=;>v>", "_purecall", "WimEnterCriticalSectionWithLazyInitialization", "9 9C9':=:\\:f:", ";4;<;T;", "=y>}>", "y VWh", "WIMCreateFile", "040904B0", "Microsoft Time-Stamp Service0", "t;j#j", "hi-IN", "yKVh_", "HeapFree", "GatherVolumeInfo did not succeed (hr = 0x%X); trying legacy path...", "0=0H0T0z0i1u1", ";/<@=V=w=", ".?AVCDepCopyManager@@", "4&4C4Z4a4", "y,Who", "8@9K9k9", "1 1Y1", "hy-AM", "\\Windows\\System32\\drivers\\wof.sys", "RtlDosPathNameToNtPathName_U", "384?4Q4X4t4~4", "8r SW", "5?@ABCDEFGHIJKLMNOP", "A", "RestoreHardlinks", "6>6X6k6y6", "D$,W3", "fr-SN", "en-ZW", "The mount entry %s is corrupt.", "1&1{1", "xM9sdtF", "_vscwprintf", "T$DQQ", "Incorrect filesize. Could be corrupted", "Microsoft Corporation1", "\\VarFileInfo\\Translation", "D$@j(P3", "0\"0D0", "=&><>a>", "en-AE", "9h:o:", "GetDisk: Finished querying VDS providers.", "1h2r2", "93:h:", "WQhtH", ">5>>>H>W>a>", ".?AVIDepWIMFile@@", "= =(=0=@=H=P=T=X=\\=p=", "959c9j9|9", "tR<'tN<", "ReorderContextInsert", "230865+4584940", ".?AV?$CAutoCleanupBase@PBG@RAII@@", "VERSION", "^<9^A>R>e>", "616>6K6g6q6", "TotalBytes", ">@?r?", "EnumHashListCallback", "4\"4)4b4", "EtwEventWrite", "9w0uz", "9q\\t7", "8$9F9^9v9", "Xj\\Yf9", ".?AVIDepImageInfo@@", "4&4o4", ";(;0;7;R;Y;v;", "Failed to delete the applied path.", "8;8B8O8V8p8.9D9", "WdsImgOpenBootImageGroup", "L$4PV", "|%s|%d|%I64d", "t$(QRP", "ControlSet???", "tOf97tJh", ":$WIMMOUNTDATA", "t)j\\V", "D$8!t$ !t$$", ">:>H>", "iu-Latn", "tzm-Tfng-MA", "t9f91t4", ";3rU;", ".?AVIDepImageSetContainerSplittable@@", "WaitForSingleObjectEx", "3K3^3", "Windows", "EnumeratePathEx: Failed search path is >= MAX_PATH!", "Version\\Minor", "Unable to apply image for WIM boot; could not find recovery folder [%s]", ">.>7>@>J>N>_>e>u>", "IDREF", "8_8s8", "ka-GE", "3.4K4", "WIM\\IMAGE[*]\\TOTALBYTES", "AllocateReadChunk", ":L:Y:", "3O3Y3x3", "9)9g9", "LastModificationTime\\HighPart", "6=6b6t6", "Cleanup failed [0x%08x]; some data may not be cleaned up.", "RpcCommRemoveImage", ">6>i>p>", "Failed to build path to ci.dll inside GUID folder.", "L$t_^[3", "SetSysVolInfoPath", "jZhP2", ".vhdx", "~(9~0t", "7/7Q7", "~09~$t", "=.=Y=", "Failed to set SD", "424;4m4", "WPVhPO", "VDiskLoadVirtDiskAPI: Unable to dynamically bind to VirtDisk.dll APIs; hr = 0x%X.", "t'j\\W", "CDepWIMImage::ResolveDependencies found invalid WIM info: PartNumber = %u, PartCount = %u", "=V>t>", " Extracting %s...", "1H2Z2t2", ".?AVCDepXMLData@@", "cs-CZ", ".text$x", "7C7P7", "ff-Latn-SN", "Unable to find DOS path for volume; found volume GUID instead: [%s]", "9%:<:", "5!5d5v5", ";C1D1K1R1^1o1{1", "VDiskSurface: SurfaceVirtualDisk failed; hr = 0x%X.", "\\$0", "FIOIsDirectoryEmpty", "WimGetPathFromHandle", "WimAtExitReserve", "encoding", "pa-Arab", "Failed to get img event", "080c0", "Unable to apply image; could not find temp folder [%s]", ";);>;T;h;s;y;", "_WSWf", "#wXsA", "D$0PQ", "0T1[1", "SVWj@3", "InitVDSServiceNoStatic: Failed to load VDS service; hr = 0x%x.", "quz-PE", ":9:@:[:b:", "t$2E2X2", "l.sys", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "ProductSuite", "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x", "es-SV", "9':2:F:Q:y:", "fr-CD", "IdnToAscii", "5H6O6p6", "5(5F5L5n5", "3H3O3e3y3", "Fail to read WIM header", "WIMMountExtractFileToHandle", "t$(VW", "?+?9?", "Journaling is disabled on the applied volume.", "9!9+9", "(SVW3", "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x", "WofMob", "PWj@Z", "BCryptCloseAlgorithmProvider", "StateStoreSetMountedImageWimbootEntries", ">%>5>b>", "232:2P2W2m2t2", ":B;m;", "%wLtC", "^h9^lt", "Failed to remove wim entry when image apply failed.", "%s: VHD for metadata ('parent' of metadata) must be given.", "msvcrt.dll", "7'8:8)909J9r9y9", "^[w!QRW", "SVh8c", "GetCurrentThreadId", "^\\9^`t", "BBBBPj(", "This system's wimmount.sys does not support spare mounting.", "gsw-FR", "6;6Z6z6", "=>=U=i=p=", "WdsImgGetProductName", "sma-NO", "Wait for work queue abandoned!", "iswspace", "5>5H5c5{5", "quc-Latn", "Failed to build path to GUID folder.", "memmove_s", "FreeLibrary", "=!>,>Z>", ">#?-?8?e?", "`.data", "VhdPopulateOSMetadata: Calling OsInformationLoadEx...", "WofAdk", "InitVDSService:Successfully launched service.", "en-HK", "ELEMENT", "Unable to mount image; could not find temp folder [%s]", "@\\;B\\t", "WVhXo", "\\Registry\\Machine", "I_RpcMapWin32Status", "Failed to query SD", "GatherDiskInfo_ThreadFunc:Unable to determine if the Host OS is Server 2003 WinPE.", "T$DW3", "ReadChunk", "%s%u.swm", "ChunkWriterEnqueue", "WIM_Skip_WIMBoot_Check", "sd-Arab", "WdsImgAssignPredefinedImageIdentifier", "!E\\H4", "7$767=7E7N7t7", ".?AVIDepObject@@", "G>l>z>", ":9:?:", "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z", "FX;GXu", ":3:f:", "UuidFromStringW", "Parallel chunk decode queue empty; switching to synchronous decode", "t=jPj", ".?AV?$CAutoCleanupBase@PAUIWbemClassObject@@@RAII@@", "km-KH", "9/:P:", ".CRT$XCA", "BCryptOpenAlgorithmProvider", "5>5O5", "=G>l>", "5%606S6", "233F3U3", "FLTLIB.DLL", "FveGetAuthMethodInformation", "73888=8B8G8L8Q8W8", "9 989>9_9", "GetFileSizeEx", "CreateVolumeAccessPath: No free drive letters to use!", ">&>C>l>x>", "WIMGetMountedImageHandle", "SetFilePointer", "=G>s>", "0=1D1j1q1", "fr-MA", "WdsImgGetHalName", ".?AVCDepImageOSXMLInfo@@", "or-IN", "= =+===J=Q=", "SVWjP", ".?AVCDepImageSet@@", ":&:R:", "ExportChunkedRegionWrite", "ha-Latn-NG", "_91$[bS", ",*~_i", "SYSTEM\\CurrentControlSet\\Control\\MiniNT", "8$898@8", ">O?{?", "5)5?5", "GetSystemDiskNumber: Couldn't query NT dir [%s]; status = 0x%x", "ReadDirEntry", ".?AVIDepImageResolved@@", "9\\$Lt", "WdsImgGetSecurity", "RegQueryInfoKeyW", "XkZu=", ";k<}6", "StateStoreLoadMountEntryFromKey", "250701214655Z0|1", "6D7}7", "WdsImgIsBootImage", "GetVolumePathNameW", ";3;D;g;", "VerifyIntegrityChunk", ">?>F>D?_?", ":0;X;s;", "Failed to convert GUID to string.", "PSWVVh", "PSSSSSS", "2f;0u", "bs-Latn", "3H3k3q3", "0[1q1", "\\\\?\\PhysicalDrive%u", "4T5^5v5", "VhdSafeWriteMetadata: Failed to unlock %s [0x%08x]", "7%7,7>7I7~7", "FveGetSecureBootBindingState", "<)=/=u=", "&>?>I>Z>.?", "9 919;9J9Q9\\9", "WIM\\IMAGE", "111E1a1h1o1}1", "CompressCaptureNode", "Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}", "tzm-Arab-MA", "bs-Cyrl", ".?AVCDepVHDInfoFormat@@", "NtOpenDirectoryObject", "7%8E8", "819u9", "T$@Ph@", "WdsImgApplyImage", "30B0I0[0b0t0{0", "Washington1", "QPQQQQh$", "%hs: Can't set IsReadOnly param ( 0x%08x )", "2/292I2S2", "=)>?>", "WdsImgExtractFiles", "T$TSSSSSh", "FormArcPathName:Couldn't form NT path for disk %d (part %d)", "2/262K2r2", "CompressChunk", "ci.dll", "There are no more images. %n", "T$$RPQQ", "|$L9M", "GatherVolumeInfo: Unable to determine if volume is dynamic; hr = 0x%X.", ">C?s?", "RegLoadKeyW", "ReleaseMutex", ";,<+t=<,t9:", "_wcsrev", "GetModuleHandleExW", ">!>c>", ".tls$ZZZ", "FilterConnectCommunicationPort", "F_[Qj", "WIM\\IMAGE[*]\\HARDLINKBYTES", "pUnattend", "wimmount", "VDiskUnsurface: Successfully unsurfaced virtual disk", "t}j\\V", "D$LSP", "ScanDirNodeTree", "9\\$,t", "Pj8QS", "WWWVt", "Converting to NT filename failed", "te-IN", "FormArcPathName:Could not find ARC path for disk; NtPath = [%s], GLE = [%d]", "header version mismatch", "pEnumAndDeleteWimExternalFilesProc", "FileDescription", "262Z2w2", "; hash = ", "GetSysDir", "9^Xv,", "yVWhI", "GatherVolumeInfo: Unable to retrieve FS properties; hr = 0x%X", "f9XBt", "SWj43", "_XcptFilter", "1+1X1b1x1", "zupkfb^ZVSOLIEB@=:7520-+)&$\" ", "7,767N7m7}7", "yo-NG", "1.2D2", "<$", "@&0_DM", "MSFT_Disk.Online()", "WIMMountExtractDirToHandle", "PrepopulateList", "WDSParseImageInformation", "7>8E8m8t8", "8F9|9", "StateStoreSetMountedImageTime", "IMAGE\\LASTMODIFICATIONTIME\\HIGHPART", "pWindows Foundation", "wcschr", "WIM_MetaData_Queue_Length", "7?7T7^7g7m7y7", "VhdSafeWriteMetadata: Failed to write file %s [0x%08x]", "Fd;Ad", "D$0PS", "8#8>8L8h8", ">\">K>R>", "PVVh\\@", "; ;,;8;D;P;\\;h;t;", ">3>a>", "9s v5", ".?AVIDepImageSetContainerBootable@@", "CI EA is only supported on hosts Windows 8 and higher.", "Same-volume move failed for source %s dest %s [0x%08x]", "3#4k4", "6 7*7B7", "QjhQQj", "FreeSid", "9?:X:i:", "Local\\wimmount_ready_event_%s", "The specified compression type is invalid. %n", "SaveOffset failed", "545O5", "ms-MY", "Getting WMI Bool property %s: unexpected VARIANT type %d", "%s: Failed to generate new metadata for %s: 0x%08x", "9/9Z9", "AllocChunkInfo", "3)364Z4y4", "WdsImgGetCompressionType", "RtlRaiseStatus", "=\\=c=", "4%4B4_4|4", "UuidCreate", "WimInitXmlInfo", "?,?3?Y?", "WIMSetBootImage failed; hr = 0x%X.", "Control\\ProductOptions", "http://www.w3.org/2000/09/xmldsig#", "9Z9l9", "DuplicateFileNode", "\\System Volume Information\\FVE.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp", "CreationTime\\LowPart", "is-IS", "788x8", "RpcBindingFree", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "444Q4", "UCS-2", "jBh`]", "Microsoft Corporation", "RollbackTransaction", "9&:Q:X:b:i:", "4!4C4N4_4", ":,:3:T:t:", "<&<;<", "K{mL>q>x>", "%s_%s", "GWVVP", "D$HPj", "3$5?5p5z5", "RpcCommAddImage", ">)>`>", "\\Windows\\Microsoft.NET\\", "6#7x7", "reparse point tag too short in filestream", "uS!D$", "8,8>8W8l8", "ARM64", "GetProcessHeap", "WofCompressFileWithHandle", "=X>n>", "FIOGetVolumeFlags", "WdsImgGetPath", "Unable to open resolved image handle; hr = 0x%X", "_ftol2", "LoadLibraryExW", "848D8K8\\8c8", "FIOOpenStreamById", "*Q`L]", "=4=W=^=", "1)101", ":/:R:g:}:", "StateStoreGetMountedImagePath", "3(3=3D3r3", "WdsImgGroupCanImportImage", ">&?S?", "GatherDiskInfo_ThreadFunc:Host OS is Server 2003 WinPE. Not waiting for pending device installs.", "Failed to mark image for compact state.", "WIM_Chunk_Size", "SetEndOfFile", "xh-ZA", "GetSecurityDescriptorControl", "WimCopyStream failed", "EtwEventRegister", "0Q0[0q0w0", "UtilGetMountingEvent", "pt-PT", ";e;p;|;", "ExportChunkedPortion", "WIMCommitImageChanges", "Failed to enumerate and delete wimboot entries.", "Failed to close image handle; GLE = 0x%X", "Version\\SPBuild", ">;>O>T>^>x>", "< <$<(<,<0<4<8<<<@I>", "<4<><", "SVWj43", "=2=u=", "MINOR", "EtwEventEnabled", ":O;^;n;u;", "6%6+6E6O6h6p6v6", "sL9sPt", "=C=J=c=", "L$,QP", "hSVW3", "\\lL\\q", "CreateVirtualDisk", "yJVhe", "GetSecurityDescriptorSacl", "4t4}4", "6B6I6", ">'>0>E>p>", "The specified image does not support apply operation. %n", "mt-MT", "GetMountedPath: Unable to prepare access path for disk [%u] offset [0x%I64x]", "UD;UD", "??1exception@@UAE@XZ", "9\":8:U:`:", "2I2w2", "<;7`7F;", "GetDisk: Querying unallocated disks...", "0!040=0H0o0y0", "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...", "bitlocker ", "WdsLibEnumCallback", "+0:0K0R0c0j0", "VWj j", "^l9^pt", "`V@Pj", "1,161", "7#737P7Y7h7", "G;|$(r", "1,101H1X1\\1l1p1t1x1|1", "Successfully surfaced virtual disk (virtdisk flags = 0x%X)", "2I2Y2", "ar-SA", "GetTempPathW", "VWShP", "et-EE", "my-MM", "IMAGE\\LASTMODIFICATIONTIME\\LOWPART", "8A9W9^9", "ReleaseDataRange", "WideCharToMultiByte", "C;X`s", ":K:[:e:", "Thales TSS ESN:0A56-E329-4D4D1%0#", "\"Microsoft Window", "bo-CN", "The image file specified contains invalid data. %n", "9_Xtp", "021d1k1", "RestoreSecurityDescriptor", "RegEnumKeyExW", "IsSecureBootBound", "4\\6t6", "1+1[1", "@>J>", "ExportResourceCallback", "CLSIDFromString", "9%9,979M9", "ImageStubMountDirectory", "EventUnregister", "3/363B3{3", "1$181x1", "?\"?D?u?|?", "t$ RP", "FBf;E", "7Y8`8", "ExportContextCopy", ">;>l>", ">'>1>Q>i>", "= >_>f>q>", ".?AVCDepVHDFile@@", "pa-Arab-PK", ":::F:", "RtlReleaseResource", "=0=C=P=c=", "CreationTime", "\\$4YY", "D$@QQPQQQQ", "MSFT_Disk.SetAttributes()", "sr-Latn-CS", "Volume", "3,fTidTq ,>gEB;", "CDepVHDInfoFormat: image is not unsurfaced: 0x%08x", "SYSTEMROOT", "fr-RE", "Base.VHD", "@*93u", "D$TVP", "9S0vmR", ">*?R?Y?l?", "Mount Path: [%s]", ".text$mn$01", "GetOverlappedResult", "An invalid handle type was specified. %n", "t4Shh", "ControlSet%03u", "999Q9r9", "9\"9E9V9i9", "20272A2T2", "RtlAllocateHeap", ":#;6;L;h;n;", "='=,=3=E=", "|d-Vk", "QQSVW3", "Integer overflow after WriteData", "040[0b0u0|0", "GetStorageDependencyInformation", "20201008050501Z", ";6;[;,<", "1/0-0", "9r t1", ")sJUK", "t&f;E", "WimBoot capture failed because wimbootcompress.ini is not available!", "4,4d4|4", "System\\CurrentControlSet\\Services\\WofMob", "F0C;X", "1>2I2q2", "8X9y9", "NtClose", "0\"0)0?0F0Z0a0", "9\"9)999@9", "ta-LK", "Volume{", "t$ WV", "D$TPRRh", "20201008071949.058Z0", "879<9A9K9P9U9_9d9i9p9u9z9", "TlsSetValue", "%wOtF", "464B4c4", "PPPVh", "tb9t$", "8$8H8e8o8", "InstallLanguage", ".?AVbad_alloc@std@@", "UuidToStringW", ":3:::D:[:b:", "<+=8=?=E=L=S=Y=`=g=n=z=", "NMTOKENS", "RestoreMountStub: error creating destination file", "t&jPj", "Continue to apply the image without setting CI EA.", "GetVolumeRootFromPath", "Microsoft\\Windows NT\\CurrentVersion", "f9:tD", "VDiskOnlineSurfacedDiskUsingVds: Surfaced disk [%u] is marked read-only; changing attributes...", "Wmi::OpenNamespace: Too late to initialize COM security (0x%08x)", "SVWj2", "_onexit", "G^{P&a", "\\\\?\\GlobalRoot", "6(7>7v7", ":QVEE", "%s: Could not generate metadata file name: 0x%08x", "%s", "L$|_^[3", "0.1\\1", "RtlGetVersion", "WdsImgGroupSetName", "7 7A7I7P7V7\\7", "n>", "$filehashes$.dat", "InitializeCriticalSectionAndSpinCount", "2'3.3v3", "t$ Sj", "vswprintf_s", "v PWh", "eu-ES", "quz-BO", "$>@>Z>", "LegalCopyright", "WdsImgGetDependantFiles", "b>i>", "??1type_info@@UAE@XZ", "0<0G0", "qps-plocm", "<8=b=m=", "6;7W7e7l7Z8a8", "|hK,_", ";B;I;", "$rGSV", "GetMountedPath: Unable to find volume for disk [%u] offset [0x%I64x]", "wimserv.exe", "IMAGEREFERENCE\\ContainerReference", "PVVj@Wh", "uz-Latn", "\\Device\\HardDisk%d\\Partition%d", "EventRegister", "RegGetValueW", "LookupPrivilegeValueW", "wcsncat_s", "FIOVolumeOpen", "1%252K2p2", "G;~Xr", "415q5", ".rdata$zETW1", ".edata", "Wow64RevertWow64FsRedirection", "8^9c9y9", "1:2B2/3C3I3\\3j3", "7$7+797@7\\7", "7!7E7L7", "Wim: [%s]", "PVVhd", "=3=:=", "PWh g", "?2?P?", "9*:>:I:", "GetFileInformationByHandleEx", "7.858;8C8M8V8\\8", "5b5n5", "7-747<7T7k7", "OpenVirtualDisk", "-040Y0q0", "sd-Arab-PK", "FveGetStatusBasicW", "es-EC", "nso-ZA", "Failed to clean up partially copied piece: %s [0x%08x]", "394q4", "L0S0b0x0", "= =K>", "RegOpenKeyExW", "Microsoft Corporation1)0'", "8Q8[8i8x8", "3$3<3a3{3", "2!21272?2F2K2", "setting hardlink failed", "j.Xj:f", "CDepWIMFile found 0 images in WIM", "RestoreMountStub: Could not move hardlink stub to prepopulate location", "ResExtractToFile failed", "IMAGEREFERENCE\\OriginalContainerPath", "6&;.;8;>;I;P;U;[;a;f;m;t;", "F4QQS", "=\"=G=", ".00cfg", "9N9f9|9", "Current", "RegDeleteKeyExW", "PPPPW", "WIM_FileData_Number_Workers", "7&717c7n7", "D$L9A", "39HPt", "0E0d0j0z0", "VhdPopulateOSMetadata: Sleeping for 30 sec to let volumes arrive/mount...", "he-IL", "ar-LY", "7<7b8r8", "Failed to set CI EA on temporarily extracted ci.dll.", "\\system32\\kernel32.dll", "PSSSSSSh ", "F;w$r", "WimStrDupe", "1%1,1", "QPQPj", "yNVjE", "GetCurrentThread", "WIMCreateFile failed to open [%s]; hr = 0x%X", "#Vx\"&6", "ar-QA", "AddCaptureNodeToImage", "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART", ".data$brc", "?4?A?}?", "CoCreateInstance", "RestoreAllFiles", "EventWriteTransfer", "1 1/1<1C1", "PreparePack:Found offline foreign dynamic disk pack [%s].", "Microsoft Time-Stamp PCA 2010", "j\\Zj:", "Fail to update WIM header", "VhdSafeWriteMetadata: Failed to write entire buffer. Read %u of %I64u bytes.", "D$3]3", "<9;E;T;", "__CxxFrameHandler3", "_wcsnicmp", "nl-NL", "pa-IN", "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x", "8O8T8z8", "WdsImgGroupGetName", "jfh0j", "FindVolumeClose", "uz-Latn-UZ", "dv-MV", "6+6@6S6Z6m6{6", "9Y; GLE = 0x%X.", ".?AVCDepObject@@", "CDepWIMFile found invalid boot image index; BootIndex = %u, ImageCount = %u", "WINDOWS", "WdsImgFindFirstImageGroup", "WriteData failed during NULL block copy", "t$@B1", "Failed to get img buf", "PreparePack:Found disk pack [%s] with unknown status 0x%x", "0\"0,060F0V0\\0g0m0y0", "<.=@=[=", "1;2N2o2", "u.FAB;", "0i0v0", "%w't%", "<%<9N>Z>h>", ";!4P4Z4", "9$929m9", "4'4?4t4", "T$@WP", "st-ZA", "7&8S8", "CreateRestoreInfo", ".CRT$XIZ", "=V=`=", "364=4", "WdsImgGetImageFormat", "4:4X4v4", "PWSWWWh", ";<;A;T;e;k;", "Unable to set reference to dependent file [%s]; hr = 0x%X", "HighPart", "CompanyName", "#D$ P", "yHVh]", "1\"2-282C2T2", "9t$Pt", ";&;3;:;b;i;w;", "NtUnloadKey2", "=#>;>\\>o>", " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "NtOpenSymbolicLinkObject", ":#:=:D:_:f:", "EditionId", "VVVWh", "WdsImgFindNextImage", "?'?H?Y?f?r?", ";2;T;x;", "Getting WMI String property %s: unexpected VARIANT type %d", "de-LU", ">@?J?f?x?", "T$TQQ", "D$hPW", "20201009050501Z0w0=", "0123456789abcdef", "7E7L7[7b7o7v7", "WIMLoadImage failed to load image [%s :: #%u]; hr = 0x%X", "http://www.w3.org/2000/xmlns/", "@\\WjdPQ", "WimCreateWorkerThreads", "virtdisk.dll", ".?AV?$CAutoRelease@PAUIWbemServices@@@RAII@@", ".?AV?$CAutoRelease@PAUIEnumWbemClassObject@@@RAII@@", "9K:f:", "ReleaseVolumeAccessPath: Released access path '%c:\\'", "4;4J4P4z4", "6,6B6", "StateStoreGetMountedImageTime", "Sparse mount enabled via override", "4,4j4", "CreateFileW", "WimBootCompress.ini", "t~j?Yf;", "SetFilePointerEx", "Unable to create destination WIM [%s]; hr = 0x%X.", "3'3q3x3", "tcjCj", "525k5", "ExportInResourceOrder", "The specified image already exists at the target location. %n", "j\\^f9tB", "sk-SK", "WIMExtractToHandleFromMountReparseData", "WdsImgGetUnattendFilePresent", "The image group is empty. %n", "8f9v9", ".winmd", "IMAGE\\WIMBOOTENTRIES", "wcsrchr", ".text", "CreateProcessW", ":MdSpt", "?O?f?", "es-CO", "en-PH", "LogSharingViolationErrorInfo", "RestoreFileMetadata", "fr-CI", "dSVW3", "GetSecInfo failed", "?-?;?A?", "0f1m1", "WIMExportImage", "6\\7|7", "2@2D3(4g4}4", "8 8/8", "GetDiskFreeSpaceW", "8 9I9", "ba-RU", "GetVirtualDiskInformation", "f=H@=", "2]3p3", "", "9Kdt_", "WdsImgSetDescription", "N+@:81J", "config", "9P9z9", "FindNextVolumeW", "=I=t=", "|$HSQ", "7!7(7", "9%:=:", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "RtlSetThreadErrorMode", "WriteFile() failed or short write", ">A>T>b>~>", "10.0.19041.572", "7,73787K7", ";o;u;", "IMPLIED", "tn8^\\t", "Online", "RtlReAllocateHeap", "8,8B8", ";;;J;b;", "Couldn't find split WIM part %u (at [%s])", "t$T+t$", "j:^f9", ":%:,:E:", "L$$_^[3", "6,6f6m6", "=7>|>", "_9^6r6", "th-TH", "=Q=w=", "sms-FI", "jth`]", "919R9", "VhdSafeReadMetadata: File size invalid: %I64u", "j\\Xf9", "sd-Deva-IN", "WIMSendFileInfoMessage", ";\";N;[;b;", "pt-BR", ".CRT$XCZ", "WIM\\IMAGE[*]\\DIRCOUNT", "_FC;]", "<* >*>", "5(606H6_6|6", "303L3l3", "L$@VP", "1M1X1n1", "\\Program Files\\WindowsApps\\", "3.4J4", "8K9_9i9", "CurrentMajorVersionNumber", "de-DE", "49=pG", "D$|PQ", "WIM %s, offset %.8x%.8x, length %x", "~PhXx", "A\\;B\\u", "0X0j0", ":};t=+?", "636U6c6r6", "Harddisk", "D$d9C", "ti-ET", "InitVDSService:Creating VDS loader...", "es-419", "sa-IN", "N?`?", "%I64d", "454<4G4z4R5-676t6", "9*9o9", "[SQVV", "Vj.^f;1u", "xHj1^", ";%;g;", "=L=S=v=", "wPf92tK", "12191>1a1", "ar-SY", "CacheDisable", "GetSecurityDescriptorOwner", "RestoreFileInfo", "WdsImgGetImageIdentifierPresent", ".text$yd", "AuthUsesFlags", "5X6^6x6", "WriteData failed", "GetMountEntry", ".CRT$XIAA", "E$j$Z", "select * from MSFT_Disk where Number = %u", ">e?l?z?", "quc-Latn-GT", "ar-YE", "DeletePath: Cannot delete .", "1F1n1", ";%;4;>;N;a;", "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x", "CreateVolumeAccessPath: Successfully assigned (temp) drive letter [%c:] to [%s]", "GatherRegionInfo:Found partition matching extent offset but not size; disk [%u] extent ", "u+jKh0", "tMhH\"", "97u\"3", "__PATH", "j\\Zf;Ty", "WdsImgVerifyImageFile", "1&1Q1", "E|SOCWE", "=)=2===J=h=", "878M8[8w8", "PVVVVh", "767f7", "WIMCheckExistenceFromMountReparseData", "PrepareVolumeAccessPath: Successfully created access path '%c:\\' for volume '%s'", "?L>y>", "NtQuerySecurityObject", "7+7m7", "DeleteFileW", "7S7Z7j7", "2<2H2N2U2\\2h2y2", "WmiObject::BeginCall: Couldn't get the class object for %s (0x%08x)", "8&8,8]8d8s8z8", "j\\Zf9TA", "Failed to get the host OS version.", "GXhl^", "8l9m<", "RtlAcquireResourceShared", "ApplyReparseFixup", "858J8", "Languages\\Default", "9+959O9U9[9", "Could not disable journaling (to restore original state) on the applied volume.", "ReleaseSemaphore", "435=5S5x5", "3/3>3W3l3y3", "?$?S?n?u?", "<+<2\">8>", "FAT32", "96:=:L:S:", "A group with the same name already exists. %n", "EqualSid", "4&4=4", "6%6;6", "VhdSafeReadMetadata: Failed to acquire shared lock on %s [0x%08x]", ";(;p;", "SWFVh", "UTF-16", "gd-GB", "ImageEndImpersonation", ":(:/:=:D:M:z:", "Version\\Build", "210303182929Z0t1", "VhdSafeWriteMetadata: Failed to open %s [0x%08x]", "1 1,181D1P1\\1h1t1", "L$pWVP", ".?AVexception@@", "WriteDataCallback", "\\pipe\\wimfltr", "4%464Z4", "? ?p?", "ncacn_np", ";);?;F;q;x;", "CoTaskMemFree", ":$;L;b;r;x;~;", ".data", "?V?f?|?", ";B;L;", "y'Vj1", "5%6l6z6", "UncompressFile", "RestoreFileMetadata: RestoreFileStorageTierClass failed", "?N?X?", ".?AVIDepVHDImage@@", "<3<=7", "4&5<5b5~5", "0QhdH", ":#:0:7:H:O:", "j YWPS", "7(8F8V8\\8", "9$:<:C:", "*41;D$p>", "919?9[9m9", "626]6", "es-AR", "SetSecurityInfo() failed", "InstallationType", "xJj&Y", "RtlAcquireResourceExclusive", "LaunchWimserv", "y/VhV", "rw-RW", "wcsncmp", "hu-HU", "Cabinet.dll", "Failed to set wof data", "3$4*40464<4I4P4V4`4f4q4w4", ":T;v;", "%s[*]", "EnumImageFiles", "WdsImgClose", "NtQueryDirectoryFile", "252M2", "GetDiskSMARTStatus: Disk does not support SMART failure detection.", "2d3z3", "[ybVh", "7H>U>", "IMAGE\\WINDOWS\\VERSION\\MAJOR", "GatherVolumeDriveLetters: Querying drive letters...", "< =V=r=", "Version\\SPLevel", "haw-US", "Global\\SetupLog", "WdsImgGetLastModifiedTime", "header type/size mismatch", "CDepWIMFile found invalid WIM info: PartNumber = %u, PartCount = %u", "5%515>5O5W5]5l5r5", "\\StringFileInfo\\%04x%04x\\%s", "293q3", "az-Cyrl", "x8!D$", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "=&=:=A=", ">'>J>w>", "6<7@7H7P7h7", "1A1O1U1", ".?AVIDepSubImageFilePath@@", "Unmounting WIM image (%s)...", "RestoreFileMetadata: RestoreHardlinks failed", "6H6O6l6", "WdsImgGetSize", "9 9,9", "zh-Hans", "0f1t1", "FIOGetFileId", "_^[+P", "CreateFileMappingW", "8w9(:", "1&1G1[1i1", "Version\\Major", "AhN~%", "ff-Latn-NG", "=3>a>", "CloseEncryptedFileRaw", "9 9$9(9,9094989<9@9D9H9\\9`9d9|9", "%hs: Can't read MSFT_Disk.IsReadOnly ( 0x%08x )", "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x", "3:3@3U3h3", "=;=m=s=x=", "3Q5j5", "Sleep", "2Q2W2", ".permission", "tg-Cyrl-TJ", "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x", "4P5y5", "LegacyGatherVolumeInfo: Couldn't determine if disk [%d] region [0x%I64x] is online/offline; hr = 0x%X.", "zh-HK", "RegEnumValueW", "7\"7?7I7_7", "An invalid handle was specified. %n", "250706205017Z0~1", "9X\\t93", "MountDeletePathCallback", "iscsiprt", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0h0l0p0|0", "2%3/3G3^3h3", "sr-Cyrl-CS", "GetCurrentProcessId", "WdsImgGetArchitecture", "333S3X3]3b3", "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x", "565=5J5Q5", "Can't apply an unresolved image", "VerQueryValueW", "100706204017Z", "H9D$0t&h", "ru-RU", "LocalFileTimeToFileTime", ";D$g?|?", "0 141B1", "GetFileSecurityW", "676>6N6", "0(0M0", "Substitute name string copy failed", "CDepVHDImage: image is not surfaced", "lv-LV", "RtlGetLastNtStatus", "se-NO", "8r ,Y", "D$XWPj", "ks-Arab", "Status", "CI EA is not supported due to mismatched versions of host OS and applied image.", "081B1", "RestoreFileCompression", "PRODUCTNAME", "br-FR", "BCryptDestroyHash", ".idata$4", "5 5,585D5P5\\5h5t5", "CurrentMinorVersionNumber", "t$4)D$`", "1:2R2q2}2", "3g4v7", ">)>O>", "\\\\?\\UNC", "ga-IE", "%hs: IEnumWbemClassObject::Next() failed (0x%08x)", "j?Xf;", "PWhp$", "en-GB", "RSDS%", "D$,90t/", "VDiskSurface: Confirmed surfaced disk is online", "ks-Deva-IN", "bn-BD", "ExportDirTree", "D$pSV3", "Enabling sparse mount.", "2.3k3", "Mounting new image.", "L$0P3", "Microsoft Corporation0", "PPPhP", "KnILk", "D2J5A", "base\\eco\\wds\\wdslib\\wim\\wdswimfile.cpp", "9*:;;^<", "Control\\Nls\\Language", "hr-BA", "There are no more image groups. %n", "el-GR", "5g6n6", "VhdSafeReadMetadata: Failed to allocate buffer for data [0x%08x]", "failed transaction commit", "FIOFileOpenRelative", "D$$hP", "es-PR", "C\\;G\\u", "NtYieldExecution", "354<4", "GetVolumePathNamesForVolumeNameW", ">8???", ">2>8>", "ImageIsFileOwned", "1%212:2A2Z2a2q2", "NtQueryInformationFile", "NDATA", "#,|6d", ".CRT$XIA", "6 7;7I7R7^7e7l7x7", "1 1<1X1x1", "WdsImgGetEnabled", "5)5@5S5", "_wcsupr", "NtQueryObject", "L$DQh", "tIVS3", "WdsImgGetCreationTime", "pap-029", "ko-KR", "WIMMOUNT_SPARSE", "zh-CN", "TlsAlloc", ">'>=>y>", ">$>0><>H>T>`>l>x>", "7B8J8Y8_8r8", "InitLZMSDecompression", "?K?f?q?x?", " [%s]", ".rdata", "FindOtherMountsForWimCallback", "D$pSVW", "> >8>H>X>h>l>p>x>", "9(9>9J9V9b9", "=V>]>", "4(5c5", "base\\eco\\wds\\wdsimage\\src\\enumimagegroups.cpp", "%s: Not resolved parent", ";D$4uV", "WINDOWS\\SystemRoot", ".text$di", "u6VVh", "strcpy_s", ".?AVCDepVHDSubImageFilePath@@", "GetFileTime", "4/5O5Z5k5", "'", "_wcstoui64", "D$A>", ";6<<j.W", "RtlInitializeCriticalSection", "WimSetSecurityDescriptor", "RtlFreeHeap", "6\\6s6z6", "si-LK", ":-:9:C:", "9(9,9@9D9H9L9P9T9h9l9|9", ";x4sz", "toj@j", "tiPQP", "SSh ", "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x", "728J8k8", "4/5@5", "bin-NG", "MdSpu", "8D8x8", "MapViewOfFileEx", "bn-IN", "3U3k3", "<0A0b0", "GetDisk: Finished querying unallocated disks", "t4f97t", "InitializeAcl", "Driver", "=$=(=,=D=T=d=h=l=p=t=x=", "SOFTWARE", "ru-MD", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "T$HQQ", "tn-ZA", "prs-AF", "= =>=J=j=", "%s\\ControlSet%03u", "Calling WIMApplyImage (flags = 0x%X)...", ">@.6Y", "tmj\\W", "The flags specified to an imaging function are invalid. %n", "Select", "GatherDiskInfo_ThreadFunc:Successfully reenumerated disks...", "PQQQQh", "wprintf", "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d", "Unable to register WIM callback; hr = 0x%X.", "MultiByteToWideChar", "en-NZ", ">7>o>", "828`8v8", "RevertToSelf", "ValidateFileAndSetEACallback", "@.rsrc", "memcmp", "AddAccessAllowedAce", "0(0K0l0", "az-Latn-AZ", "chr-Cher-US", "GetVolumeFileCountCallback", "909N9U9p9", ";0;G;U;^;e;", "SPhXR", "6)696C6^6l6v6", "Microsoft Time-Stamp PCA 20100", "RQRRR", "sl-SI", "u'QQQ", "526H7^7", "IVhdInfoInterface::CreateInterface: Win32 VHD API is not available", "fr-BE", ".?AV_WmiProperties@WMI@@", "%s\\Select", "3#3+383P3o3w3", "D$tHP", "5F6X6", "3 3$3(3,30343@3L3X3d3p3|3", "6]7d7", "w2t,-L", "wimserv.exe %s", "Control\\Windows", "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]", "333D3K3", "445M5]5m5w5", ":=:S:x:", "Restored moved piece %s to original location %s", "9\\$X}", ":L;\\;i;p;", "%s: Parent for differencing disk %s is NULL.", ".idata$2", ".?AVIDepImageXMLInfoFormat@@", "AttachVirtualDisk", "0x%08x", "FH;A8", "WdsImgIsValidImageFile", "GetFileStorageTierClass", "%s: Failed to use existing metadata for %s: 0x%08x", "WdsImgReplaceImage", "384P4", "ObjectLength", "CDepVHDInfoFormat: failed to release volume access paths: 0x%08x", "1e1s1", "IMAGE\\WIMBOOT", ">-?7?@?F?R?`?k?", "EditionID", "WIMLoadImageInternal", "8#8(8.8D8R8", "L$8WW", "InitLZMSCompression", "Failed to remove directory", "Failed to allocate copy data buffer [0x%08x]", "2,2P2l2", ".?AVIDepImageSet@@", "GatherProviderInfo:PreparePack failed; trying to proceed anyway (HRESULT = 0x%x)", "LeaveCriticalSection", "252m2", "en-ZA", "LANGUAGE", ">j?o?", "GetEnvironmentVariableW", "SETUPAPI.dll", "%s%s%s", ">G?N?", "CVhdInfoInterface::GetFileInfo", ">*>I>Y>", ")`yJb", "768@8V8", "C(;C$", "3[3x3", ".rdata$T$brc", "Could not move source file", "{7ebc3661-e661-4943-95a5-412378cb16d1}", "y&Sjq", ";-;7;L;U;_;y;", "ReadEncryptedFileRaw", "D$DPj", "WIM Path", ":l;H;>T>", "PrepareVolumeAccessPath: Found existing access path NOT assigned by AccessPaths: '%c:\\' for volume '%s'", "The image group contains images that depend on the image being deleted. %n", "ProductVersion", "=c>z>", "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x", "%s.swm", ";4;O;\\;|;", "GetVolumeInformationW", "6)6O6j6}6", "4_4s4", "5 6>6Y6`6", "<(<4<@?Q?", "PrepareVolumeAccessPath: Found existing access path assigned by AccessPaths: '%c:\\' for volume '%s'", "2A2g2", "__CLASS", "9*949d9", "1#2*2O2V2", "u#;H4s", "8(8M8u8", "80Z0r0;1S1x1", "en-ID", "?J?Z?d?|?", "VhdPopulateOSMetadata: Attempting to use IOCTL to wait for volume arrival", "PWhl+", "RtlVerifyVersionInfo", "IMAGE\\FILECOUNT", "Removing surfaced VHD image (disk %u)...", "PPPPPPP", "tU9q0uPV", "134N4", ":+:B:]:i:u:", "", "VWhlC", "<^9L9h9", "6 6$646D6H6X6h6l6|6", "=7=>=W=g=n=", "2\"2q2x2", "60676", "%s-%u.%s", "mn-MN", "WimBoot", "RestoreEncryptedFile", "CMP_WaitNoPendingInstallEvents", "^`9^ht", "5D5`5i5q5", "=0>D>[>", ".?AV?$CAutoHeapFree@PAG@RAII@@", "WdsImgAssignImageIdentifier", "1N2W2`2y2", "9(:l:}:", "Multithreaded chunked decoding disabled via environment variable; will skip!", "979>9_9f9s9~9q;v;", "4<5u5|5", "2(323O3u3", "?5?@?", "VERSION.dll", "LANGUAGES", "7=7U7", "Default", ".rdata$r$brc", "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!", "IMAGE", "DeviceIoControl", "ChunkWriterInit", "D$lSP", ".?AV?$CAutoCleanupBase@PAUIWbemServices@@@RAII@@", "CreateDestinationFileEx", "Failed to get decoder context", ">)>_?f?", "WimCopyResource", "PWWWQ", "%s: Set cached metadata for %s.", "GetMetadataPadding", "IsOsPreRS1", " %s] %s", "WimExchangeFiles", "GatherDiskInfo_ThreadFunc:Querying disk information...", "202X2", "2p3<4C4", "RPRRj", "\\IA64", "SYSTEM", "y2WhE", "=*=4=", "ProcessDirectory", "GUID:%s", "Failed to set directory extended attribute", "RestoreDirMetadata", "so-SO", ":[;};", "607D7U7\\7x7", "WdsImageId", "mn-Mong", "jaYjz_j:Z", "7a7k7", "trPWQ", "ReadMetaDataFile", ";A3J3", "IDREFS", "WIMApplyImage failed; hr = 0x%X", "_unlock", "GatherDiskInfo_ThreadFunc:Reenumerating disk devices...", "<16R6f6z6", ":;:Q:X:p:", ".rsrc$02", "NtSetSecurityObject", "GetLastError", "memcpy_s", "DeleteFileEx: Unable to allocate hardlink path buffer", "%I64u", "2*242E2M2e2~2", "x69T$", ";\";*;4;E;U;", "GetTempFileNameW", "en-JM", "535=5c5m5", "Failed to set wof data for file backed by wim file", ">(>a>", "4\"5F5", "8*868>8", "se-SE", "en-BZ", "1)131C1L1", "GetLongPathNameW", "=I=`=l=", "D$ hx/", "CDepCopyManager::AddOperation: Destination %s cannot be changed (user changed to %s).", "0L0S0", "&040D0K0V0", "NMTOKEN", "ntdll.dll", "Normaliz.dll", "WorkerStateDuplicate", "WriteDirImage", "1(141i1}1", ",8LtEl1ZtYqTW+JQYevCwr25g9fzSRFL/x5ZpH/d82g4=0Z", "wimgapi.dll", "CDepVHDImage::Copy: VHD with associated metadata %s skipped but metadata not skipped.", ":S;V<", "%s:%s", "ReleaseVolumeAccessPath: Access path '%c:\\' is not ref-counted, skipping release.", "= =8={=", ">+?A?e?", "0+0n0", "6,6T6", "?MdDlu", "_amsg_exit", "\\Device", "Unable to apply image; could not find dest folder [%s]", "Failed to restore moved piece %s to original location %s [0x%08x]", ">2?H?", ";|$@r", "506X6", "es-CU", "WIM_FileData_Queue_Length", "The image store is empty. %n", "es-GT", "9L9b9", "da-DK", "Wimboot entries", "GetDiskSMARTStatus: Disk shows a SMART failure.", "WDS_TRACING_CONSOLE_OUTPUT", "ta-IN", "EstimateProgressForChunkedExport", "The specified image type does not support the append operation. %n", "base\\eco\\wds\\wdsimage\\src\\DepCopyConnector.h", ":R:`:", "y-Vh ", "uz-Cyrl", "<%s>%s", "j:Yf9H", "CopyFileDataCallback", "WdsImgGetPartitionStyle", "w|PPP", "8D8J8", "EnumResourcesForExport", "ImageGetFileCount", "VRQPh ", "3/3G3d3", "090D0T0[0", "GetAclInfo failed", "+T$\\+", ";V3>X>", "failed", "WdsImgGetExFlags", "7<7A7q7", "PinningFolderList", "011;1S1p1", "6(646@6L6X6d6p6|6", "Unable to set temporary path [%s]; hr = 0x%X.", "\\system32\\ntoskrnl.exe", "HSVW3", "Failed to apply privileges!", "t 9X$t", "?(?4?@?L?X?d?p?|?", "L$4_^[3", "?$?(?@?P?T?X?p?", ")Microsoft Root Certificate Authority 20100", "FilterAttach", "PartitionOffset", "\\I386", "LastModificationTime", "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x", "Wmi::ExecQuery: Query [%s] failed (0x%08x)", "uG>}>", "WIMExtractImagePathAndGetFileHandle", "en-IN", "VhdSafeWriteMetadata: Failed to truncate file %s [0x%08x]", "T$(94", "ENTITY", "9$9,949<9D9P9", "The image file specified is empty. %n", "RaiseException", "5.5D5o5", "GetVirtualDiskPhysicalPath", "t/QSV", "MALLOC failed", ":S;^;v;", "7E7n7", "WdsImgGroupGetSecurity", "SetEnvironmentVariableW", "GatherDiskInfoWorker: Unable to find disk's number.", ";&;2;<;I;o;", "L$8PW", "fy-NL", "2.2j2", ",SVWj", "fo-FO", "WdsImgDeleteImage", "FindFirstImage", "!0K0\\0c0u0|0", "445;5P5g5n5", "Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData", "t'Wj\\V", "D$,_^[3", "99:Y:p:", "=H=R=p=w=", "Query %s succeeded, but couldn't enumerate results (0x%08x)", "Mount Path", "4$4u4", "728h8", "L$hQS", "9K(tV", ";\"<,y>", "-Tz4q", "4?4L4_4h4s4", "D$(PW3", "0,0?0z0", "WdsImgGetProductFamily", "<:X>i>", "WimBoot apply failed because the wim file has to be local!", "<^=e=", "4!4,434:4e4", "WimFindClose", "2*3D3", ">/???", "8P8f8", "RestoreDirMetadata: RestoreFileInfo failed", "F(QPj", "WIM_Enumerate_Directory_Reparse_Point", "WDSInitializeEmptyImageInformation", "\\\\?\\PhysicalDrive%d", "_wcstoi64", "oeY<9", "2(3/3", "rm-CH", "VhdSafeWriteMetadata: Failed to write entire buffer. Wrote %u of %I64u bytes.", "LegacyGatherVolumeInfo: Couldn't get size of [%s]; hr = 0x%X", ".?AV?$CAutoCleanupBase@PAUIEnumWbemClassObject@@@RAII@@", "SVh`e", "2G3Q3", "ar-AE", ";);R;n;x;", "7&7p7", "base\\eco\\wds\\wdsimage\\src\\imageapis.cpp", ".?AV?$CAutoRelease@PAUIWbemLocator@@@RAII@@", "FileTimeToSystemTime", "CountChunkedByteCallback", "t$4WV", "7\"7,7k7", ">'>c>z>", "WimbootProcessBeforeApply", "RestoreMountStub", "towupper", "gu-IN", ";|$Xt", "?2?n?", "2'3\\3", "KERNEL32.dll", "GetDriveTypeW", "Insufficient resources for multithreaded chunked decoding; will skip!", "mn-Mong-MN", "j\\Zf;P", "t(9\\$", "PPPPP", "base\\eco\\wds\\wdsimage\\src\\image.cpp", "CharUpperBuffW", "tKf9>tF", "smj-NO", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp", "WdsImgOpenImageGroup", "UpdateHardlinkDir", "L$8;U", "CopyFileW", "9x\\tCW", "%s: Failed to set cached metadata for %s: 0x%08x", "MoveCaptureNode", "8U8}8", "8G8S8]8c8p8", "SetEvent", "WimLazyInitialize", "= >*?E?`?v?", "> >,>8>D>P>\\>h>t>", "2)3.3m3w3", "Expected [%u] contiguous parts, but missing part number [%u] for [%s]!", "GetVolumeNameForVolumeMountPointW", "IMAGE\\WINDOWS\\VERSION\\MINOR", "7-7K7Q7", "!~<9~@t", "8=9]9v9\":>:", "WIMApplyImageInternal", ".rdata$zETW2", "\\ArcName", "T$PRP", "base\\eco\\wds\\wdsimage\\src\\imagestore.cpp", "uM9xXu", "1C1N1o1", "=:>R>X>", "QQSVW", "CopyFileExW", "wof.sys", "SVWj8j", ".?AV?$CAutoRelease@PAVWmiCollection@WMI@@@RAII@@", ":%:.:3:G:O:[:c:|:", "ReadData reparse tag from filestream failed", "ff-Latn", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect", "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x", "#text", "8>8`8x8", "5-5Z5e5~5", "RtlAdjustPrivilege", "y VSh ", "GetSystemDiskNumber: Couldn't open NT dir [%s]; status = 0x%x", "fil-PH", ".text$mn", "3\"3g3", "uD9pXu", ":U;};", "7,767", "SetThreadIdealProcessor", "RpcStringFreeW", "Compact apply failed because wof driver doesn't support it!", "% moa", "j\\Xf9DN", "QQQh(h", "0$000<0H0T0`0l0x0", "292C2}2", "FIOSetAttributesByHandle", ";Khttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", ":&:3:::G:N:Y:^:h:|:", "qps-ploca", "ImageRecaptureDirectory", "210317011459Z0", "4)4/4D4J4`4", "MatchingDeviceId", "\\FVEAPI.DLL", "Setup", "DWord:%u", "IMAGEREFERENCE\\ImageIndex", "FveDetectTelemetry", "CDepVHDImage::Copy: Failed to duplicate existing info.", "D$4PQ", "232P2", "p SSW", "0a1t1", "SetLastError", "sah-RU", "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x", "D$TPh", ">MdDtu", ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0", "5S6`6g6}6", ">W>e>r>}>", "0\"1w1", "WimCreateDirectory", "oK0D$\"<", "_lock", "%s: Incompatible flags on input.", "$Kernel.", "7X8r8", ".rdata$brc", "3_4|4", "ImageGetMountGuid", "5;5T5f5", ".?AVWmi@WMI@@", "1%1N1b1g1", "2 3*3P3q3", "Found non-null hash in file node", "GetMountedImagesKey", "Microsoft Code Signing PCA 2010", "\\Windows\\Assembly\\", "UtilGetReadyEvent", "DEFAULT", "011v1", "BCryptFinishHash", "1h1o1", "it-IT", "z.9Wv", "ProcessWimQueueNode", "687H7\\7c7", "9w9):_:", "1$1+181?1", ":):N:k:r:", "3G4Y4_4", "ReleaseVolumeAccessPath: Undefined access path '%c:\\'", "t3!D$", "D$0;D$(", "4<4A4 565y5", "3;4\\4X6", "293G3", "RestoreRefNode", "The specified image does not support extraction of files. %n", "ImageMarshallHandle", "CreateFile failed", "1>1E1}192", "?", "ValidateAndClearWriteInProgressFlag", "=W=c={=", "4@5G5[5q5", "StateStoreGetMountedImageWimbootEntries", "Caller requested sparse mount", "pSaveMountedImageWimbootEntries", ";_!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!", "\\Windows\\System32\\WimBootCompress.ini", "6#6;6B6H6O6d6n6", ";X5>j>t>", "? ?/?6?E?X?", "&", "\\\\?\\GLOBALROOT", "Source image or destination WIM is not WIMBoot compliant", "vi-VN", "t49C8u", "= =|=", "GatherDiskInfoWorker: Found disk with an invalid name.", "Failed to get NTFS version on volume [%s]. DOS path is [%s] Error code is [%d]", "<47", "; ;(;,;4;8;H;l;x;", "kl-GL", "5$5H5d5", "ResAddFromFileAndHandle", "93:t:{:", "EventWrite", "8<8D8L8T8\\8d8l8t8|8", ".rdata$sxdata", "7C7J7W7m7", ":3:=:b:", "RestoreReparsePoint", "SVWjD", "_f9.>>>", ";-<8<", "mn-Cyrl", "-FVE-FS-", "2?2g2", ":U:e:", " !\"\"\"#$ &&&%%%%%%%", "id-ID", "5Fz<|", "6%7^7", ".?AVCDepWIMSubImageFilePath@@", "BuildEndpointHandle", "\\PFPort", "LocalFree", "768X8", "VhdPopulateOSMetadata: Populating metadata for OS at [%s] (region offset = 0x%I64x)", "GetFileInformationByHandle failed", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "9%:,:", "", "9(9I9d9s9", "RpcStringBindingComposeW", "292n2s2", "ParseChunkRegionInternal", "ProductName", "=-=>=O=j=|=", "2'2.2=2D2", "> >,>8>D>P>\\>", "D$,t V", "sr-Latn-BA", "^@[Y]", "VerifyFileByHandle", ";;;_;u;", "WIM\\Image[Index=%u]", "Xf9ABt", "VHD\\IMAGE", "=+>2>]>", "Failed to load WofAdk!", "=\"=L=S=", "%s\\%s", "_except_handler4_common", "9S:Z:k:r:6;g;", "WIM\\IMAGE[*]\\WIMBOOTENTRIES", "8M8V8", "636[6", "8B8I8", "", "MAJOR", "Getting WMI Uint32 property %s: unexpected VARIANT type %d", "8$8+8b8{8", "VDiskSurface: Virtual disk was successfully discovered. ", "? ?7?=?r?", ":#;2;U8O8", "?5?H?", "fa-IR", "425<5H5L5Q5[5k5r5", "GatherDiskInfo_ThreadFunc:Wait for pending device installs failed. Error code is [0x%X]", ":H:_:k:", "<(=K=|=", "\\WINNT", "RestoreRefNodeCallback", "GetSysVolInfoPathFromMountPath", "=h>v>", "_wtoi", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "2(2I2S2k2", "LoadFilterLibPointers", "j?_f9|B", "UnmarshallImageHandleFromId", ";@(>M>i>", ">i?p?y?", "=4=;=V=\\=l=s=", "Process PID %d is accessing file wim %s", ".?AVIDepImage@@", "I0G1-0+", "kk-KZ", "StateStoreInsertMountedImage", ",020k0u0,1", "9&9K9_9f9", "GetPrivateProfileSectionW", "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x", "1~3+5#7l7<8", " Microsoft Corporation. All rights reserved.", "The specified image type is not supported for Boot Image groups. %n", "F0M0d0", "5'5=5[5e5C8Y8c8i8s8y8", ";C;n;", "QSVj j", "FilterGetMessage", "[0x%.8x] ", "EtwEventUnregister", "uC9XXu", "626G6L6Q6x6", "WimMoveFile", "MoveFileWithProgressW", "4K5v5", "^j?[;", "283E3]3", "FlushFileBuffers", "0;1/2", "< <$<(<,<0<4<8<<<@::GetBuffer(int) const", "9(9,909D9H9`9p9", "keyname exceeds maximum name length", "?StreamWrite@Version@UnBCL@@UBEXAAVSerializationStream@2@@Z", "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6B01@@", "?Copy@?$ArrayList@G@UnBCL@@SGXPBV12@HPAV12@HH@Z", "989P9W9^9e9l9s9", "545C5K5n5", "??_DDelegate@UnBCL@@QAEXXZ", "SystemTimeToFileTime", "?Dispose@Process@UnBCL@@UAEXXZ", "Invalid offset to MemoryStream#Seek", "??_7Char@UnBCL@@6B@", "void __stdcall UnBCL::_::HTEnumerator::TableKey,int,struct UnBCL::Hashtable::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array *,int)", "RtlNtStatusToDosError", "attempt to set value on key opened read-only", "?DefaultLoad@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB", "838W8|8", "?get_Handle@WaitHandle@UnBCL@@UBEPAXXZ", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(int &)", "??4StringPtr@UnBCL@@QAEAAV01@ABV01@@Z", "??_8?$Array@E@UnBCL@@7BISerializable@1@@", "uAVj ", "989\\9w9", "::IndexOf(const class UnBCL::Array *,class UnBCL::String *,int,int)", "??_7?$SerializableStackBase@H@_@UnBCL@@6BObject@2@@", "?GetNextString@MultiSz@UnBCL@@ABEPBGPBG@Z", "?AddNamespace@XmlNamespaceManager@UnBCL@@QAEXPAVString@2@0@Z", "void __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "null str to String::IsInterned", "DuplicateHandle", "516C6U6", "??0?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@IAE@XZ", "?get_Count@StreamCounter@UnBCL@@QBE_KXZ", "1$1H1T1`1l1x1", "7 8;8a8s8", "?SetRef@HeapMemoryManager@UnBCL@@UAEXXZ", "??_8FileStream@UnBCL@@7BIDisposable@1@@", "?get_OSVersion@OperatingSystem@UnBCL@@QBEPBVVersion@2@XZ", "", "??4?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "int __thiscall UnBCL::ArrayList >::IndexOf(class UnBCL::SmartPtr,int,int) const", "?get_Length@BufferedStream@UnBCL@@UBE_JXZ", "void __thiscall UnBCL::Array >::InitLarva(class UnBCL::ArrayList > *)", ">$>(>,>0>8>@>X>h>x>|>", ":*;Z;", "?ContainsValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z", "?get_OwnerDocument@XmlNode@UnBCL@@QAEPAVXmlDocument@2@XZ", "?IsDigit@Char@UnBCL@@SGHG@Z", "VirtualProtect", "??0ArgumentException@UnBCL@@QAE@PBG@Z", "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", ".?AVXmlAttributeCollection@XmlLite@UnBCL@@", "u\"Vj 9q", "?Nullify@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ", "too many pieces in string to Version constructor", "< <$<(<,<0<4<8<<<@::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "6+7s7", "??_7?$Stack@H@UnBCL@@6B?$SerializableStackBase@H@_@1@@", "ExpandEnvironmentStringsW", "?get_IsReadOnly@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "?get_BiosReleaseDate@SystemInfo@UnBCL@@QBEPBVString@2@XZ", ">K>]>l>", ";*<<::CopyTo(class UnBCL::Array *,int) const", "3M4t4", "?Seek@FileStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z", "??0?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@IAE@XZ", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(float)", "= =0=4=D=H=X=\\=t=", "=C=c=", ".data$r$brc", "5\"5q5", "0A0c0}0", "saw incorrect type of object for panthom read.", "Redmond1", "UnBCL::StreamReader::~StreamReader", "__thiscall UnBCL::Hashtable::Hashtable(int)", "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "int __thiscall UnBCL::ArrayList::LastIndexOf(unsigned char,int,int) const", "?ToArray@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAV?$Array@PAVString@UnBCL@@@2@XZ", "??0PathTooLongException@UnBCL@@QAE@$$QAV01@@Z", "?4?S?w?", "5+5M5f5", "?Validate@HeapMemoryManager@UnBCL@@UAEXXZ", "??_7Encoding@UnBCL@@6B01@@", "void __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "source and destination for move paths must be different", "??4Win32Exception@UnBCL@@QAEAAV01@ABV01@@Z", "??0AbandonedMutexException@UnBCL@@QAE@PBVString@1@@Z", "void __stdcall UnBCL::Environment::SetEnvironmentVar(const class UnBCL::String *,const class UnBCL::String *)", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABV01@@Z", ":H:Z:l:", "??4?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "null path to Path::IsShortCompliant", "?IndexOf@String@UnBCL@@QBEHGH@Z", "?RemoveAt@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z", "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7BISerializable@1@@", "void __stdcall UnBCL::File::Delete(const class UnBCL::String *)", ">4>U>t>", "?DeleteRange@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEXHH@Z", "?get_NodeType@XmlNode@UnBCL@@QAE?AW4XmlNodeType@2@XZ", "int __stdcall UnBCL::Array::LastIndexOf(const class UnBCL::Array *,unsigned char,int,int)", ">#>P>u>", "int __stdcall UnBCL::MP::OperatorCompare<__int64>::Compare(__int64,__int64)", "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@PAVXmlNamespaceManager@1@@Z", "?Assign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXPAVXmlNamespaceManager@2@@Z", "?get_ProcessorArchitecture@SystemInfo@UnBCL@@QBEKXZ", "??_8?$Stack@H@UnBCL@@7B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "?StreamWrite@?$SerializableArrayBase@H@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", "8%878E8f8", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", "StringFileInfo", "null str to Int32Ops::Parse", "3)4]4", "N0L0J", "??0Mutex@UnBCL@@QAE@$$QAV01@@Z", "?get_Rank@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "?Nullify@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV12@XZ", "??4HeapMemoryManager@UnBCL@@QAEAAV01@ABV01@@Z", "int __thiscall UnBCL::StreamReader::Peek(void)", "null array to Array::Sort", "??_7?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@6B@", "void __thiscall UnBCL::Array::Insert(int,int)", "??0InvalidOperationException@UnBCL@@QAE@PBG@Z", "t>Wj ", "null value to String#Insert", "?'?C?", ";#;6;b;{;", "> >.>x>", "??4XmlSchemaSet@UnBCL@@QAEAAV01@ABV01@@Z", "int __thiscall UnBCL::String::LastIndexOf(unsigned short,int,int) const", "??4?$ArrayList@G@UnBCL@@QAEAAV01@ABV01@@Z", "?RetrieveEntry@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KG?AV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z", ".?AVFileSystemEnumerator@UnBCL@@", ";4;D;H;L;P;T;X;l;|;", "t/Vj$", "??4?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAEAAV012@$$QAV012@@Z", "t+Vj$", "2J2Y2", "?/?>?c?", "=L9o<", "353<3C3k3q3~3", ";4;H;h;p;x;", "void __thiscall UnBCL::Array::Insert(int,unsigned short)", "uBSj ", "Current retrieved on enumerator before MoveNext()", "??C?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@1@XZ", "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@PAVSerializationStream@1@@Z", "3$3,343@3`3h3p3x3", "??0OutOfMemoryException@UnBCL@@QAE@PBG@Z", "3$3,383X3d3", "??0OverflowException@UnBCL@@QAE@ABV01@@Z", ";?;L;R;[;", "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@", "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@HH@Z", "__int64 __thiscall UnBCL::DateTime::TimeToTicks(int,int,int)", "??BRegHandle@UnBCL@@QAEPAUHKEY__@@XZ", "3H3u3", "7(787<7P7`7d7h7|7", "?Parse@XmlDocument@XmlLite@UnBCL@@IAEXPAUIStream@@@Z", ":,:8:@:t:", "?GetBuffer@?$Array@H@UnBCL@@UAEPAHH@Z", "?get_IsReadOnly@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ", "__int64 __thiscall UnBCL::BufferedStream::Seek(__int64,enum UnBCL::SeekOrigin)", "__int64 __thiscall UnBCL::DateTime::DateToTicks(int,int,int)", "?Assign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXABV12@@Z", "void __thiscall UnBCL::RegistryKey::DeleteSubKey(const class UnBCL::String *,int)", "?GetLength@?$CSimpleStringT@G$0A@@ATL@@QBEHXZ", "memmove", "?GetTypeName@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", "?$?(?8?(const class UnBCL::Object *)", "??B?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "??0?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "?Trim@String@UnBCL@@QBEPAV12@XZ", "?DeAssign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXXZ", "void __thiscall UnBCL::ArrayList::Insert(int,class UnBCL::XmlLite::XmlAttribute *)", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBG@Z", "?CreateDir@Directory@UnBCL@@SGPAVDirectoryInfo@2@PBVString@2@@Z", "=.===h=", "void __thiscall UnBCL::Array::Insert(int,class UnBCL::XmlLite::XmlAttribute *)", "int __thiscall UnBCL::String::_StartsWith(class UnBCL::SmartPtr) const", "<*::Remove(class UnBCL::StringPtr)", "?Close@StreamWriter@UnBCL@@UAEXXZ", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "??_D?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ", "8@9t9", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", ".?AVPathTooLongException@UnBCL@@", "??0ArgumentOutOfRangeException@UnBCL@@QAE@XZ", "int __thiscall UnBCL::String::_LastIndexOfAny(class UnBCL::SmartPtr,int,int) const", "unable to create subkey", "??1SystemException@UnBCL@@UAE@XZ", "?Sort@?$ArrayList@G@UnBCL@@UAEXXZ", "6$6I6T6s6", "?LastIndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z", "8/8A8O8", "?G?f?", "??5SerializationStream@UnBCL@@QAEAAV01@AAF@Z", "8$8K8X8^8g8", "??4Object@UnBCL@@QAEAAV01@ABV01@@Z", "7$7,747<7D7L7\\7d7l7t7|7", ".?AVTimeSpan@UnBCL@@", "void __thiscall UnBCL::SerializationStream::ReadBytes(unsigned char *,int)", "f98uDWj ", "?Assign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXABV12@@Z", "memmove_s", "FreeLibrary", "`.data", "%s: %s(%S) failed", "void __thiscall UnBCL::Array::Remove(class UnBCL::XmlLite::XmlNode *)", "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@XZ", "??1Exception@UnBCL@@UAE@XZ", "??4IPoolable@UnBCL@@QAEAAU01@ABU01@@Z", "1/2H2W2v2", "7S8q8x8", "const class UnBCL::SmartPtr *__thiscall UnBCL::ArrayList >::GetBuffer(int) const", "?GetBuffer@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEPAPAVObject@2@H@Z", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "8R8u8", "?ToByteArray@MultiSz@UnBCL@@QBEPAV?$Array@E@2@XZ", "?Substring@String@UnBCL@@QBEPAV12@H@Z", "??_7Stream@UnBCL@@6BIDisposable@1@@", "UnBCL::RegSubkeyEnumerator::Init", "=#=j=|=", "??_8?$ArrayList@G@UnBCL@@7BISerializable@1@@", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,int,struct UnBCL::IComparer *)", "??4?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@$$QAV012@@Z", "??_8MultiSz@UnBCL@@7BISerializable@1@@", "??4RegSubkeyEnumerator@UnBCL@@QAEAAV01@ABV01@@Z", "?set_Chars@StringBuilder@UnBCL@@QAEXHG@Z", "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@XZ", "tmjA3", ":,;<;D;M;];e;o;t;};", "?InnerList@?$Array@E@UnBCL@@MBEPAV?$ArrayList@E@2@XZ", "?get_Hour@DateTime@UnBCL@@QBEHXZ", "??0?$Array@G@UnBCL@@QAE@ABV01@@Z", "??4ISerializable@UnBCL@@QAEAAU01@ABU01@@Z", "?Contains@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHQAVString@2@@Z", "?Assign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXABV12@@Z", "??6SerializationStream@UnBCL@@QAEAAV01@I@Z", "??_7?$Array@G@UnBCL@@6B?$SerializableArrayBase@G@_@1@@", ";,;<;L;P;T;l;p;", "??0StringPtr@UnBCL@@QAE@PAVString@1@@Z", "90949H9L9P9h9x9|9", "?CopyTo@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVString@UnBCL@@@2@H@Z", "??0ArgumentOutOfRangeException@UnBCL@@QAE@$$QAV01@@Z", "::get_Item(int)", "??0DateTime@UnBCL@@QAE@_J@Z", ":P:|:", "??D?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEAAVStream@1@XZ", "SVVVV", "??0ProcessStartInfo@UnBCL@@QAE@ABV01@@Z", "??1OverflowException@UnBCL@@UAE@XZ", "??0NotSupportedException@UnBCL@@QAE@ABV01@@Z", "?GetBytes@ASCIIEncoding@UnBCL@@UBEHPBVString@2@HHPAV?$Array@E@2@H@Z", ".?AVRegHandle@UnBCL@@", "1#2c2", "222V2z2", "Translation", "?AppendNewLine@StringBuilder@UnBCL@@QAEPAV12@XZ", "?Done@String@UnBCL@@SGXXZ", "unable to write to FileStream", "5F6T6l6w6", "memcpy", ".?AV?$Array@PAVString@UnBCL@@@UnBCL@@", "?SGetChars@UnicodeEncoding@UnBCL@@CGHPBV?$Array@E@2@HHPAV?$Array@G@2@HH@Z", "3+3N3Y3", "?CopyTo@?$Array@E@UnBCL@@UBEXPAV12@H@Z", "void __thiscall UnBCL::Array::Remove(class UnBCL::XmlLite::XmlAttribute *)", "u*Sj ", "?get_IsReadOnly@?$Array@H@UnBCL@@UBEHXZ", "null instance to Monitor::Exit", "?RemoveAt@?$Array@E@UnBCL@@UAEXH@Z", ".?AVCaseInsensitiveStringComparer@UnBCL@@", "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@XZ", "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPAUHINSTANCE__@@IG@Z", " http://www.microsoft.com/windows0", "?CloneNode@XmlNode@UnBCL@@QAEPAV12@H@Z", "ix or count out of range to StringBuilder#Append", "??_7WaitHandle@UnBCL@@6BObject@1@@", "??5SerializationStream@UnBCL@@QAEAAV01@AAH@Z", "?Remove@String@UnBCL@@QBEPAV12@HH@Z", ".?AV?$ArrayListEnumerator@PAVObject@UnBCL@@@_@UnBCL@@", "??1UnicodeEncoding@UnBCL@@UAE@XZ", "??0InvalidCastException@UnBCL@@QAE@ABV01@@Z", "??0?$SerializableArrayBase@E@_@UnBCL@@QAE@ABV012@@Z", "int __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "5#6;6B6g6s6", "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z", ".?AVXPathException@UnBCL@@", "?s_Registration@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@HH@Z", "9 :3:E:S:", "N;D$ r;", "??1XmlNode@XmlLite@UnBCL@@UAE@XZ", "7!7*787K7V7\\7d7k7~7", "8$8,848D8P8X8", "5+5H5X5o5", ":`;s;", ".?AV?$ArrayList@VStringPtr@UnBCL@@@UnBCL@@", "9(9A9c9{9", "Can't set a negative size", "saw unrecognized type/version pair '%s - %d'", "??0?$ICollection@G@UnBCL@@QAE@ABU01@@Z", "?get_IsReadOnly@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "3?3Q3`3y3", "5C6Z6q6", "Array doesn't support RemoveAt()", "ix or count out of range to UnicodeEncoding::GetString", "4G5P5i5x5", "4N5]5", "?get_P@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVDecoder@2@XZ", "6\"7.7:7F7", "class UnBCL::String *__stdcall UnBCL::Directory::GetTempPathName(void)", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<__int64>(__int64)", "??1?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", ":3;t;", "636J6", "??1TextReader@UnBCL@@UAE@XZ", "void __thiscall UnBCL::Array::InitLarva(class UnBCL::ArrayList *)", "??_8CaseInsensitiveStringComparer@UnBCL@@7B@", "979F9N9q93k>", "?get_Seconds@TimeSpan@UnBCL@@QBEHXZ", "?FromString@MultiSz@UnBCL@@SGPAV12@PBGG@Z", "int __thiscall UnBCL::ArrayList::LastIndexOf(class UnBCL::String *,int,int) const", "?InsertBefore@XmlNode@UnBCL@@QAEPAV12@PAV12@0@Z", "?BinarySearch@?$Array@H@UnBCL@@SGHPBV12@HPAU?$IComparer@H@2@@Z", "5 5d5", "?InnerList@?$Stack@PAVObject@UnBCL@@@UnBCL@@MAEAAPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ", "??0Win32Exception@UnBCL@@QAE@K@Z", "??0InvalidOperationException@UnBCL@@QAE@ABV01@@Z", "?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEPAVString@2@XZ", "??4Type@UnBCL@@QAEAAV01@ABV01@@Z", "#020@0N0\\0j0x0", "void __thiscall UnBCL::Array::RemoveAt(int)", "?Resize@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHH@Z", "??0?$SerializableArrayBase@G@_@UnBCL@@QAE@XZ", "??0?$Stack@H@UnBCL@@QAE@ABV01@@Z", "?InternalFree@HeapMemoryManager@UnBCL@@AAEXPAX@Z", "set_Capacity on nongrowable or read-only MemoryStream", "7$7+7T7c7q7", "??1?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@UAE@XZ", "RegQueryValueExW", "??1StringPtr@UnBCL@@UAE@XZ", "8c8m8z8", "?Flush@MemoryStream@UnBCL@@UAEXXZ", ".?AV?$DefaultInstanceFactory@VMultiSz@UnBCL@@@UnBCL@@", "GetProcessHeap", ";-;s;", "??3Object@UnBCL@@SGXPAXPBDH@Z", "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@PAVObject@1@@Z", ".?AVXmlAttribute@XmlLite@UnBCL@@", ":Q:c:r:", "LoadLibraryExW", "class UnBCL::String *__stdcall UnBCL::Environment::GetEnvironmentVar(const class UnBCL::String *)", "??0StringBuilder@UnBCL@@QAE@PBG@Z", "??4SEHException@UnBCL@@QAEAAV01@$$QAV01@@Z", "calloc", "??4?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "??_7?$Array@H@UnBCL@@6B?$IEnumerable@H@1@@", "SetEndOfFile", " copy to ", "??4IndexOutOfRangeException@UnBCL@@QAEAAV01@ABV01@@Z", "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@", "SelectionLanguage", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "5 5054585<5@5D5X5\\5`5t5", "0#1A1Y1y1", "RegSetValueExW", "?MIN_TICKS@DateTime@UnBCL@@0_JB", "saw incorrect header for panthom read.", "attempt to construct DateTime outside of allowed range", "void __thiscall UnBCL::Array::RemoveAt(int)", "?Insert@?$Array@G@UnBCL@@UAEXHG@Z", "3&3x3", "null buf to BufferedStream#Write", "8,8D8", ".?AV?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@", "byteix or count out of range in ASCIIEncoding#GetBytes", "int __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", ".?AVInvalidOperationException@UnBCL@@", ".?AV?$SmartPtr@U?$ICollection@H@UnBCL@@@UnBCL@@", "?get_P@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@2@XZ", "?get_Count@XmlNodeList@UnBCL@@QAEHXZ", "\"Microsoft Window", "WWWWj", ".?AVProcessStartInfo@UnBCL@@", "?GetEnumerator@?$Array@E@UnBCL@@UBEPAU?$IEnumerator@E@2@XZ", "1\"242C2g2", "131O1s1", ".?AU?$IList@PAVObject@UnBCL@@@UnBCL@@", "?GetChars@ASCIIEncoding@UnBCL@@UBEHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z", ":#:1:g:y:", "??0Thread@UnBCL@@QAE@ABV01@@Z", "?get_AutoDelete@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "4$4,444<4D4L4T4d4t4|4", "??_7?$Array@H@UnBCL@@6BISerializable@1@@", "ADVAPI32.dll", "?CopyTo@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVObject@UnBCL@@@2@H@Z", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "class UnBCL::XmlLite::XmlNode **__thiscall UnBCL::ArrayList::GetBuffer(int)", ":8:J:Y:s:", "?GetBuffer@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPBQAVString@2@H@Z", "void __stdcall UnBCL::ArrayList::Copy(const class UnBCL::ArrayList *,int,class UnBCL::ArrayList *,int,int)", "??_7XmlAttributeCollection@XmlLite@UnBCL@@6B@", "8084888<8@8H8`8d8|8", "2P2c2", "class UnBCL::SmartPtr *__thiscall UnBCL::ArrayList >::GetBuffer(int)", "??_7?$SmartPtr@VStream@UnBCL@@@UnBCL@@6B@", "??0?$Array@E@UnBCL@@QAE@HH@Z", "??1?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UAE@XZ", "?ReleaseBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z", ")null buf to FileStream#Read", "?InnerList@?$Array@PAVString@UnBCL@@@UnBCL@@MBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ", "? ?/?J?\\?k?", "?set_Item@?$ArrayList@G@UnBCL@@UAEXHG@Z", "?WaitOne@WaitHandle@UnBCL@@UAEHXZ", "??_7SyncObject@UnBCL@@6B@", "??4PathTooLongException@UnBCL@@QAEAAV01@$$QAV01@@Z", "??1?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@UAE@XZ", "t_Wj$", "QQSVW3", ":3;~;", "303X3t3", ".?AV?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(unsigned __int64)", "?FormatMessageV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAPAD@Z", "??4Process@UnBCL@@QAEAAV01@ABV01@@Z", ":,:<:@:X:h:l:|:", "??0?$Array@H@UnBCL@@QAE@PBU?$ICollection@H@1@@Z", "void __thiscall UnBCL::ArrayList::CopyTo(class UnBCL::Array *,int) const", "?CloneData@?$CSimpleStringT@G$0A@@ATL@@CAPAUCStringData@2@PAU32@@Z", "??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEAAVString@1@XZ", "0T0f0x0", "class UnBCL::String *__stdcall UnBCL::String::FromASCII(const char *)", "??4AbandonedMutexException@UnBCL@@QAEAAV01@$$QAV01@@Z", "?set_Item@?$Array@H@UnBCL@@UAEXHH@Z", "??4?$IComparer@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "2 2(202D2L2T2d2p2", "??4?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "4*4R4f4z4", "4<4h4", "??_8?$Stack@H@UnBCL@@7BISerializable@1@@", "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B01@@", "9 9'9M9Y9", "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPAUHINSTANCE__@@I@Z", "const int *__thiscall UnBCL::ArrayList::GetBuffer(int) const", "4,444<4P4X4`4p4|4", "??0MutableString@UnBCL@@QAE@ABVString@1@@Z", "?get_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z", "??4?$SerializableStackBase@H@_@UnBCL@@QAEAAV012@$$QAV012@@Z", "negative capacity to StringBuilder constructor", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", ".idata$3", "?Flush@StreamWriter@UnBCL@@UAEXXZ", ";(<5(unsigned short &)", "??0ArithmeticException@UnBCL@@QAE@ABV01@@Z", "?_Substring@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@H@Z", "??4Logging@UnBCL@@QAEAAV01@ABV01@@Z", "int __thiscall UnBCL::Array >::Add(class UnBCL::SmartPtr)", "?get_Current@RegSubkeyEnumerator@UnBCL@@UBEPBGXZ", "??4FileSystemEnumerator@UnBCL@@QAEAAV01@ABV01@@Z", ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "7*7<7S7", "??0?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "??0IDisposable@UnBCL@@QAE@XZ", "111a1", ".?AVEnumerator@MultiSz@UnBCL@@", "?get_ProcessorName@SystemInfo@UnBCL@@QBEPBVString@2@XZ", "?Equals@DateTime@UnBCL@@UBEHPBVObject@2@@Z", "??4XmlAttribute@UnBCL@@QAEAAV01@ABV01@@Z", "_IsRunning@0", "??0StringBuilder@UnBCL@@QAE@XZ", "void __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "??1WaitHandle@UnBCL@@UAE@XZ", "??4ProcessStartInfo@UnBCL@@QAEAAV01@$$QAV01@@Z", "??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UAE@XZ", "0!090Y0s0", "5$6k6", "??B?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", ":$:q:", "9(9?9S9i9t9", "??4Decoder@UnBCL@@QAEAAV01@$$QAV01@@Z", ">3>K>R>Y>`>g>n>", "8!939B9W9~9", ">9>_>s>", "5 6'6F6Z6s6}6", ">S>b>", "?get_Item@?$Stack@H@UnBCL@@UAEAAHH@Z", "??_7FileStream@UnBCL@@6BIDisposable@1@@", "?RetrieveValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KGPAVString@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z", "??4XmlAttribute@XmlLite@UnBCL@@QAEAAV012@$$QAV012@@Z", "??1XmlNodeList@XmlLite@UnBCL@@UAE@XZ", "struct UnBCL::SerializationStream::UniqueObject __thiscall UnBCL::_::HTEnumerator::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPBD@Z", "?GetFileNameExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z", "?ReadByte@Stream@UnBCL@@UAEHXZ", "??4MutableString@UnBCL@@QAEAAV01@PBG@Z", "?get_Count@?$Array@E@UnBCL@@UBEHXZ", "?CheckInvalidPathChars@Path@UnBCL@@CGXPBVString@2@@Z", "=,=0=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=", "null srcpath or destpath to File::Move", "??_7?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@6B@", "?BinarySearch@?$Array@E@UnBCL@@SGHPBV12@EPAU?$IComparer@E@2@@Z", "6O6a6t6|6", ">V>r>'?", "?get_AutoDelete@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "t:hX+", "VVVQVVVVVV", ".?AV?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", "2'2Z2", "20201008051253Z", "??6SerializationStream@UnBCL@@QAEAAV01@_J@Z", "yuj@j", "int __thiscall UnBCL::MemoryStream::get_Capacity(void) const", "empty path to Directory::CreateDirectory", "?DateToTicks@DateTime@UnBCL@@AAE_JHHH@Z", "?Preallocate@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z", "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV01@@Z", "?Compare@String@UnBCL@@SGHPBV12@0H@Z", "?Release@Mutex@UnBCL@@UAEXXZ", "?InitTarget@Monitor@UnBCL@@CGKPAVSyncObject@2@@Z", "??4ObjectDisposedException@UnBCL@@QAEAAV01@ABV01@@Z", "tBVj$", "4(4K4|4", "1C2g2", "?set_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z", "::IndexOf(const class UnBCL::Array *,unsigned char,int,int)", "2!232E2S2", "t#Vj ", ".?AVSystemInfo@UnBCL@@", "757}7", "2$2,242<2D2L2T2\\2d2l2t2|2", "invalid handle to FileStream constructor", "?Read@BufferedStream@UnBCL@@UAEHPAEHH@Z", "CreateThread failed in Thread constructor", "??4?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@$$QAV012@@Z", ".?AV?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z", "empty path to FileStream constructor", "?StartsWith@String@UnBCL@@QBEHPBGH@Z", ".PAVObjectDisposedException@UnBCL@@", "?GetOccurenceLastIndexOf@String@UnBCL@@QBEHGH@Z", ">.?_?z?", ".?AV?$SmartPtr@VMultiSz@UnBCL@@@UnBCL@@", "2d3w3", "1 1(1@1P1T1d1h1x1|1", "0!0(0/0d0r0", "??_7Encoding@UnBCL@@6BObject@1@@", "0'070S0f0s0", ".?AV?$SmartPtr@U?$IEnumerator@VStringPtr@UnBCL@@@UnBCL@@@UnBCL@@", "??_8WaitHandle@UnBCL@@7BIDisposable@1@@", "??7?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBE_NXZ", ".?AU?$IList@PAVString@UnBCL@@@UnBCL@@", "void __thiscall UnBCL::MemoryStream::SetLength(__int64)", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(long &)", "f91u.Vj", ";@;d;", "=0=o=", "SetLength on closed MemoryStream", "?Contains@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHQAVString@2@@Z", "8,888X8d8", "??_8Registry@UnBCL@@7B@", "?GetEnumerator@MultiSz@UnBCL@@UBEPAU?$IEnumerator@PBG@2@XZ", "CompanyName", "Yj\\Zf", "= >C>U>g>", "?get_Chars@String@UnBCL@@QBEABGH@Z", ".?AVRegSubkeyEnumerator@UnBCL@@", "?Clone@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ", "class UnBCL::Object *const *__thiscall UnBCL::ArrayList::GetBuffer(int) const", "??4IDisposable@UnBCL@@QAEAAU01@$$QAU01@@Z", ".?AVXmlException@UnBCL@@", ";h::CopyTo(class UnBCL::Array *,int) const", "??0Object@UnBCL@@QAE@XZ", "null bytes to ASCIIEncoding#GetBytes", "??_8?$Array@G@UnBCL@@7B?$SerializableArrayBase@G@_@1@@", "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@PAVEncoding@1@@Z", "GlobalAlloc", "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "ticks out of range to DateTime constructor", "Seek() on closed BufferedStream", "1(1L1T1\\1d1l1t1|1", "?get_Position@BufferedStream@UnBCL@@UBE_JXZ", "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B@", "?Assign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXABV12@@Z", "LSELECT * FROM Win32_ComputerSystem", "404?4i4{4", "<,<>::GetBuffer(int)", "negative offset or count to BufferedStream#Read", "??_8BufferedStream@UnBCL@@7BStream@1@@", ">:>v>", "?Close@MemoryStream@UnBCL@@UAEXXZ", "??0IPoolable@UnBCL@@QAE@$$QAU01@@Z", "UnBCL::HeapMemoryManager::InternalValidate", "MoveToElement", ".?AV?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@", "2(262", "?set_HResult@Exception@UnBCL@@MAEXJ@Z", "?QuickSort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEXPAV12@0HH@Z", "0#0r0", "GetTemporaryFileName: tempPath->Lenght > (MAX_PATH - 14).", ")null value to insert constructor", "GetVersionExW", "u\"Sj 9Y", "overflow: count too large in UnicodeEncoding::GetByteCount", "?InitLarva@?$Array@G@UnBCL@@MAEXPAV?$ArrayList@G@2@@Z", "??0Registry@UnBCL@@QAE@XZ", "??_7ASCIIEncoding@UnBCL@@6BEncoding@1@@", "int __stdcall UnBCL::ArrayList::LastIndexOf(const class UnBCL::ArrayList *,unsigned short,int,int)", "?ReadBytes@SerializationStream@UnBCL@@QAEAAV?$ArrayList@E@2@H@Z", "969I9", "1G1]1", "QueryPerformanceCounter", "1C1`1|1", ".?AV?$SmartPtr@VXmlAttributeCollection@XmlLite@UnBCL@@@UnBCL@@", "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z", "??0?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "MultiSz value is too large", "base\\ntsetup\\unbcl\\src\\monitor.cpp", "7#7?7c7|7", "??0ObjectDisposedException@UnBCL@@QAE@$$QAV01@@Z", "?get_Count@?$Array@H@UnBCL@@UBEHXZ", "GetLocalTime", "j PjZ", "??1?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@UAE@XZ", "??0?$ICollection@G@UnBCL@@QAE@XZ", "?AddRange@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXPBU?$ICollection@PAVString@UnBCL@@@2@@Z", """, "?_IndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z", "null path to Path::Combine", "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@D@Z", "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@PBV?$Array@PAVString@UnBCL@@@2@@Z", "??0ThreadStateException@UnBCL@@QAE@XZ", "CreateEventW", "?get_AutoDelete@?$Array@E@UnBCL@@UBEHXZ", "?RemoveNamespace@XmlNamespaceManager@UnBCL@@QAEXPAVString@2@@Z", "717C7c7", "4M4m4", "tZWj$", "??0BufferedStream@UnBCL@@QAE@PAVStream@1@K@Z", "null old or NEW string to String#Replace", ".?AV?$HTDictEnumBase@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@_@UnBCL@@", "?Sort@?$Array@E@UnBCL@@SGXPAV12@@Z", ":$:=:D:K:s:~:", "?Equals@?$Array@G@UnBCL@@UBEHPBVObject@2@@Z", "< =X=", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "1 10141D1H1L1T1l1|1", "class UnBCL::Array *__stdcall UnBCL::Environment::GetLogicalDriveNames(void)", ";#;N;", "??0IndexOutOfRangeException@UnBCL@@QAE@PAVString@1@@Z", "7 7$7(7<7@7P7T7X7\\7`7t7", "FreeEnvironmentStringsW", "?Remove@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@@Z", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGHPAUIAtlStringMgr@1@@Z", "??1?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UAE@XZ", "838O8s8", ":!:0:6:", "unsigned char &__thiscall UnBCL::ArrayList::get_Item(int)", ":+:=:L:c:", "??0SystemInfo@UnBCL@@QAE@$$QAV01@@Z", "?IsNumber@Char@UnBCL@@SGHG@Z", "?get_Item@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z", "566s6", "DeleteFileW", ":=:q:", "int __thiscall UnBCL::ArrayList::IndexOf(class UnBCL::XmlLite::XmlAttribute *,int,int) const", "0-0N0\\0", "2+3>3P3c3", "= =$=4=D=H=X=\\=`=d=h=l=p=t=x=|=", "0<0N0`0", "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@", "void __stdcall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array > *,int)", "?GetValue@RegistryKey@UnBCL@@QAEKPBVString@2@@Z", "??_8?$Stack@PAVObject@UnBCL@@@UnBCL@@7B01@@", "0L1o1~1", "??_7ArithmeticException@UnBCL@@6B@", "?Assign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXPAV?$ArrayList@PAVString@UnBCL@@@2@@Z", "??_7SerializationException@UnBCL@@6B@", "?GetZero@TimeSpan@UnBCL@@SG?AV12@XZ", "??_DMultiSz@UnBCL@@QAEXXZ", "class UnBCL::String *__thiscall UnBCL::Hashtable::get_Item(class UnBCL::String *) const", "??_8?$Array@G@UnBCL@@7B?$ICollection@G@1@@", "saw unrecognized object header '0x%x'", "?InnerList@?$Stack@PAVObject@UnBCL@@@UnBCL@@MBEABQAV?$ArrayList@PAVObject@UnBCL@@@2@XZ", "InitializeCriticalSection", "?Replace@String@UnBCL@@QBEPAV12@PAV12@0H@Z", "??1IDisposable@UnBCL@@UAE@XZ", "?Assign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXPAVSerializationId@2@@Z", "??_8?$Stack@H@UnBCL@@7B?$SerializableStackBase@H@_@1@@", "void __thiscall UnBCL::ArrayList::Insert(int,int)", "??_7XmlNode@XmlLite@UnBCL@@6B@", "??_7?$Stack@H@UnBCL@@6B?$ICollection@H@1@@", "int __stdcall UnBCL::ArrayList::BinarySearch(class UnBCL::ArrayList *,class UnBCL::Object *,struct UnBCL::IComparer *)", "??0ObjectDisposedException@UnBCL@@QAE@PBG@Z", "5*595S5", "?Alloc@Allocator@UnBCL@@SGPAXKI@Z", "??_DMemoryStream@UnBCL@@QAEXXZ", "<#=C=`=", "?get_InnerList@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MAEPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ", "?Insert@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z", "??0?$Array@G@UnBCL@@QAE@HH@Z", ">X?g?", "738=8J8P8", ":+:K:", ".CRT$XCU", "?Insert@?$ArrayList@G@UnBCL@@UAEXHG@Z", "?get_IsFixedSize@?$Array@H@UnBCL@@UBEHXZ", "2#2T2]2", "?EscapeXMLAndAdd@StringBuilder@UnBCL@@IAEXPBG@Z", "??_7?$Array@E@UnBCL@@6B?$ICollection@E@1@@", "Wadvapi32.dll", "void __stdcall UnBCL::Directory::DeleteInternal(const class UnBCL::String *,int,int)", "=<=`=", "4 4$4<4L4P4T4l4p4", "??0?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPBG0@Z", ".?AU?$ICollection@H@UnBCL@@", "=:=N=`=n=", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator <<(const class UnBCL::String *)", ".?AU?$IEnumerable@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@UnBCL@@", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z", "??_8?$Array@E@UnBCL@@7B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "?set_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "<\"<1:P:", ".?AV?$SmartPtr@VVersion@UnBCL@@@UnBCL@@", "3+393A3F3Z3s3", "4i4p5", ".?AV?$ArrayListEnumerator@PAVXmlAttribute@XmlLite@UnBCL@@@_@UnBCL@@", "??0TextWriter@UnBCL@@QAE@ABV01@@Z", ":%:8:G:O:r:", "?GetTypeName@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6BObject@2@@", "??B?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "?Close@BufferedStream@UnBCL@@UAEXXZ", "+class UnBCL::String *__stdcall UnBCL::Directory::GetDirectoryRoot(const class UnBCL::String *)", "overflow: parsed value too large", "??4XmlException@UnBCL@@QAEAAV01@ABV01@@Z", ":;;N;];s;", "?get_OuterXml@XmlNode@UnBCL@@QAEPAVString@2@XZ", "??5SerializationStream@UnBCL@@QAEAAV01@AAPAVString@1@@Z", "9&:;:M:", "position params out of range to ArrayList::Copy", "__thiscall UnBCL::ArrayList::ArrayList(int,int)", "?4?8?P?T?l?p?", "<(::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "8(888<8T8d8h8l8", "\\\\?\\UNC", "??1Delegate@UnBCL@@UAE@XZ", "GetFileAttributesExW", "4\"444B4t4", "?IsPathRooted@Path@UnBCL@@SGHPBVString@2@@Z", ".?AVVersion@UnBCL@@", "?ThrowLastError@Win32Exception@UnBCL@@SGXPBGPBDH@Z", "negative offset or count", ".?AU?$IList@VStringPtr@UnBCL@@@UnBCL@@", "??4Stream@UnBCL@@QAEAAV01@$$QAV01@@Z", "int __thiscall UnBCL::String::GetOccurenceIndexOf(unsigned short,int) const", "1<1N1`1s1", "??4?$IEnumerator@PBG@UnBCL@@QAEAAU01@$$QAU01@@Z", "1#1c1", "?RemoveChild@XmlNode@UnBCL@@QAEXPAV12@@Z", ".?AVExternalException@UnBCL@@", "111019184142Z", "__int64 __thiscall UnBCL::FileStream::get_Length(void) const", "?,?H>W>n>", "0i0{0", "1\"101m1", ")null path to File::Delete", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", "?GetEnumerator@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ", "void __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "<-N?]?", "??_7MultiSz@UnBCL@@6B?$IEnumerable@PBG@1@@", "class UnBCL::DirectoryInfo *__stdcall UnBCL::Directory::CreateDir(const class UnBCL::String *)", ".?AVStreamWriter@UnBCL@@", "8&8+8", "5'5c5", "append mode with access not write-only", "t?Sj$", "?IndexOf@?$ArrayList@G@UnBCL@@UBEHG@Z", "int __stdcall UnBCL::Array::IndexOf(const class UnBCL::Array *,unsigned short,int,int)", "??4XmlNode@UnBCL@@QAEAAV01@ABV01@@Z", "sAVj ", "??B?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV?$CSimpleStringT@G$00@1@XZ", "??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "3$3,383X3`3h3x3", "int __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "?FindOneOf@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z", "4)4C4i4", "?get_FirmwareType@SystemInfo@UnBCL@@QBE?AW4_FIRMWARE_TYPE@@XZ", "161i1", ">$>(>,>D>H>`>p>t>", "??_D?$Array@G@UnBCL@@QAEXXZ", "??0?$IEnumerable@G@UnBCL@@QAE@ABU01@@Z", "stream closed before read completed", "656U6j6{6", "?GetValue@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@H@Z", "null srcpath or destpath to File::Copy", "?Equals@SerializationId@UnBCL@@UBEHPBVObject@2@@Z", "?InnerList@?$Array@G@UnBCL@@MBEPAV?$ArrayList@G@2@XZ", "9I9f9", "??_DUnicodeEncoding@UnBCL@@QAEXXZ", "base\\ntsetup\\unbcl\\src\\process.cpp", "848<8H8h8p8|8", "??0?$IList@E@UnBCL@@QAE@XZ", "?EnterSection@SyncObject@UnBCL@@IAEXXZ", "int __stdcall UnBCL::String::CountChars(const unsigned short *)", "6 6$6<6L6P6T6l6|6", ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV12@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@2@PAV12@UKeyTraits@42@$1?RetrieveKey@42@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@", "__thiscall UnBCL::ArrayList::ArrayList(int,int)", "GetEnvironmentVariableW", "<*<8::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "30V0q0", "??_8?$ArrayList@G@UnBCL@@7B?$SerializableArrayListPrimitiveBase@G@_@1@@", "??_DWaitHandle@UnBCL@@QAEXXZ", "negative numchars to UnicodeEncoding::GetMaxByteCount", "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "const class UnBCL::TimeSpan *__stdcall UnBCL::Try_Cast(const class UnBCL::Object *)", "<'*?9?I?c?", "??5SerializationStream@UnBCL@@QAEAAV01@AAJ@Z", "OLEAUT32.dll", "null dictionary to Hashtable constructor", "?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPAGIPBGH@Z", "wcscoll", ".?AVASCIIDecoder@ASCIIEncoding@UnBCL@@", "int __thiscall UnBCL::FileStream::Read(unsigned char *,int,int)", "??1StreamCounter@UnBCL@@QAE@XZ", "?Equals@Object@UnBCL@@UBEHPBV12@@Z", "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ", ".?AV?$ArrayListEnumerator@G@_@UnBCL@@", "< <$<(<,<0<4<8<<::Copy", ">(?:?S?", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(class UnBCL::String *&)", "??1OutOfMemoryException@UnBCL@@UAE@XZ", ":>;E;d;", "?Clone@MultiSz@UnBCL@@UBEPAVObject@2@XZ", "class UnBCL::String *__stdcall UnBCL::Path::WithoutLongPrefix(const class UnBCL::String *,int &)", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", "t@Vj$", ">$>D>g>", "?SetLength@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z", "?ToFileTime@DateTime@UnBCL@@QBE_JXZ", "0%0C0U0g0", "unable to read on FileStream", "?get_TotalMilliseconds@TimeSpan@UnBCL@@QBENXZ", "", ".?AV?$SmartPtr@VDirectoryInfo@UnBCL@@@UnBCL@@", "RootDir", "?LoadXml@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z", "?IsDirectorySeparator@Path@UnBCL@@SGHG@Z", "?Intern@String@UnBCL@@SGPBV12@PBV12@@Z", "5?5i5", "?get_Length@MemoryStream@UnBCL@@UBE_JXZ", "??1Version@UnBCL@@UAE@XZ", "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "??0?$IList@H@UnBCL@@QAE@ABU01@@Z", "??4ISerializable@UnBCL@@QAEAAU01@$$QAU01@@Z", "?3?`?r?", "> >(>4>T>`>", "??_8?$Array@H@UnBCL@@7BISerializable@1@@", "??AStringPtr@UnBCL@@UBEGH@Z", "void __thiscall UnBCL::BufferedStream::Write(const unsigned char *,int,int)", "??0Object@UnBCL@@QAE@ABV01@@Z", "?DAYS_PER_100@DateTime@UnBCL@@0HB", ".gfids", "struct IXMLDOMDocument3 *__stdcall UnBCL::MSXmlModule::CreateDOMDocument(void)", "??4MutableString@UnBCL@@QAEAAV01@ABV01@@Z", ".rsrc$02", "memcpy_s", "GetTempFileNameW", "=/=4=f=x=", "?set_AutoDelete@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z", "?Delete@File@UnBCL@@SGXPBVString@2@@Z", "?FromMultiSz@MultiSz@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBG@Z", "707@7P7T7d7h7x7", "??0String@UnBCL@@QAE@GH@Z", "void __thiscall UnBCL::Array >::Remove(class UnBCL::SmartPtr)", "0$0,080X0`0h0p0|0", "?Close@StreamReader@UnBCL@@UAEXXZ", "?set_Position@MemoryStream@UnBCL@@UAEX_J@Z", "<.=Q=`=q=", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", ".PAVSecurityException@UnBCL@@", "_amsg_exit", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", ".?AU?$IEnumerable@PAVString@UnBCL@@@UnBCL@@", "?FormatV@String@UnBCL@@SGPAV12@PBGPAD@Z", "?TICKS_PER_D@DateTime@UnBCL@@1_JB", "??0AbandonedMutexException@UnBCL@@QAE@XZ", "??1?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAE@XZ", "??D?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEAAVSerializationId@1@XZ", "??_7MultiSz@UnBCL@@6BISerializable@1@@", "?SetValue@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@H@Z", "Microsoft", "::get_Current(void) const", "3#3`3", "7 8=8N8a8", "969C9j9", "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z", "222=2K2Y2g2", "void __stdcall UnBCL::Array::Sort(class UnBCL::Array *)", ";J;|;", "void __thiscall UnBCL::MutableString::Insert(int,const unsigned short *,int)", "??4Encoding@UnBCL@@QAEAAV01@$$QAV01@@Z", ".?AUEmptyType@MP@UnBCL@@", ">\">;>M>_>s>", "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", "?get_IsReadOnly@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "??4?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "?RemoveAt@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXH@Z", "=4=<=D=L=T=\\=d=l=t=|=", "?Clear@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ", ";*::Reset(void)", "??0?$IEnumerable@E@UnBCL@@QAE@ABU01@@Z", ".?AVWin32Exception@UnBCL@@", "??4OverflowException@UnBCL@@QAEAAV01@ABV01@@Z", "?HashFunction@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@@Z", "?SelectNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@PAVString@3@@Z", "negative start index to CopyTo", "4(4,404H4X4\\4l4p4", ">/?Y?", "??0ConsoleLogHandler@UnBCL@@QAE@XZ", "9 :Z:}:", ";(;H;P;X;`;h;p;x;", "QQSV3", "??6SerializationStream@UnBCL@@QAEAAV01@PBVString@1@@Z", "s8UY(l:wE", "?H?Z?o?", "??5SerializationStream@UnBCL@@QAEAAV01@AAK@Z", ".?AU?$ICollection@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@", "??0TextReader@UnBCL@@QAE@ABV01@@Z", "QSVW3", "6!6(6/666=6D6", "??1SystemInfo@UnBCL@@UAE@XZ", "?Steal@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEPAVVersion@2@XZ", "??_DVersion@UnBCL@@QAEXXZ", "5(5,5<5@5X5\\5t5x5", "7#7A7S7e7", "1#1F1P1Z1", "??_7?$Array@E@UnBCL@@6B?$IList@E@1@@", "??6SerializationStream@UnBCL@@QAEAAV01@PBUISerializable@1@@Z", ":-:8:F:T:b:p:~:", "?ToArray@MemoryStream@UnBCL@@UBEPAV?$Array@E@2@XZ", "unable to close WaitHandle handle", "9c9q9", "??0SecurityException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z", "??_DRegistry@UnBCL@@QAEXXZ", ">/?r?", "9P9s9", "QSVWj", "40484@4H4P4\\4|4", "__thiscall UnBCL::String::String(const unsigned short *,int,int)", "void __thiscall UnBCL::ArrayList::Insert(int,class UnBCL::StringPtr)", "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B01@@", "unable to retrieve logical drive mask", "?(?U?h?", "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "2$2(2@2D2H2L2P2d2t2x2|2", "_wcsupr_s", "??4SystemException@UnBCL@@QAEAAV01@ABV01@@Z", "0 020E0R0j0u0", "??_7ApplicationException@UnBCL@@6B@", "?CopyTo@?$Array@H@UnBCL@@UBEXPAV12@H@Z", "u'j\\Yf9O", "void __thiscall UnBCL::MemoryStream::Write(const unsigned char *,int,int)", "??_7WaitHandle@UnBCL@@6BIDisposable@1@@", "?Assign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXABV12@@Z", "?GetLocalMachine@Registry@UnBCL@@SGPAVRegistryKey@2@XZ", "9/9B9h:w:", "int __thiscall UnBCL::RegistryKey::get_ValueCount(void) const", ";(;,;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "?get_Attributes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlAttributeCollection@23@XZ", "??1ASCIIEncoding@UnBCL@@UAE@XZ", "737s7", "8C8s8", "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEHHHPAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z", "?Retrieve@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@AAPAV32@@Z", "909<9H9T9`9l9", "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@", "towupper", "KERNEL32.dll", "??0?$IList@PAVObject@UnBCL@@@UnBCL@@QAE@XZ", "??0DateTime@UnBCL@@QAE@HHHHHHH@Z", "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6BObject@1@@", "?Append@StringBuilder@UnBCL@@QAEPAV12@H@Z", "?GetMinValue@DateTime@UnBCL@@SG?AV12@XZ", "=U>i>{>", "<$<@::get_Current(void) const", "?MoveEx@File@UnBCL@@SGXPBVString@2@0K@Z", "5$5r5", "?Remove@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z", "??B?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "858`8", "CopyFileExW", "class UnBCL::String *__thiscall UnBCL::Encoding::GetString(const class UnBCL::Array *) const", "7<7N7`7s7", "base\\ntsetup\\unbcl\\src\\regsubkeyenum.cpp", "??_8MemoryStream@UnBCL@@7BIDisposable@1@@", "4$4+42494@4G4", "??0SystemException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "9#:5:G:U:v:", "?LogW@ConsoleLogHandler@UnBCL@@UAE?AW4tagLOGRESULT@@KPBDKPBG1K@Z", "8$8(888<8L8\\8`8p8t8x8", "??4XPathException@UnBCL@@QAEAAV01@ABV01@@Z", ";3;t;", "??4FileStream@UnBCL@@QAEAAV01@ABV01@@Z", "CreateDirectoryW", ".?AVDecoder@UnBCL@@", "041F1c1}1", "<(<8<<<@::Resize(int,int)", "const class UnBCL::StringPtr *__thiscall UnBCL::ArrayList::GetBuffer(int) const", "??1MutableString@UnBCL@@UAE@XZ", "?GetBuffer@StringBuilder@UnBCL@@QAEPAGH@Z", "?GetTypeName@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", ":*;q;", "??0StreamReader@UnBCL@@QAE@ABV01@@Z", "0B1K1k1", "startIndex or count out of range to IndexOfAny()", "void __thiscall UnBCL::ArrayList::set_Item(int,unsigned char)", "??0?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAE@ABV012@@Z", "5$5I5[5m5", "2'2Q2s2", "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBG@Z", "?SpanExcluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBG@Z", "unable to query key info", "?F?c?|?", "?get_Length@?$Array@H@UnBCL@@UBEHXZ", "2G2Y2k2", "??0?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "?InitLarva@?$Array@H@UnBCL@@MAEXPAV?$ArrayList@H@2@@Z", "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6BObject@2@@", "3J3t3", "base\\ntsetup\\unbcl\\src\\environment.cpp", "??_7RegHandle@UnBCL@@6B@", "?Peek@StreamReader@UnBCL@@UAEHXZ", "?set_Capacity@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z", "9?9c9u9", "null FileName to Process::Start", "??0NotSupportedException@UnBCL@@QAE@PBG@Z", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "??4DateTime@UnBCL@@QAEAAV01@ABV01@@Z", "?s_Registration@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "?Write@FileStream@UnBCL@@UAEXPBEHH@Z", "303@3D3T3X3h3l3p3", "class UnBCL::ArrayList *__stdcall UnBCL::Try_Cast*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)", "??4?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAEAAV01@ABV01@@Z", "?DAYS_PER_1@DateTime@UnBCL@@0HB", "??_7XmlSchemaSet@UnBCL@@6B@", "??1?$SerializableArrayBase@H@_@UnBCL@@UAE@XZ", ":<:N:]:", "null bytes to UnicodeEncoding::GetString", "4I4Q4]4e4z4", "4 4$4(4,4044484L4P4T4l4|4", "?LastIndexOf@?$Array@G@UnBCL@@SGHPBV12@GHH@Z", "?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHGG@Z", "__thiscall UnBCL::StreamReader::StreamReader(class UnBCL::Stream *,class UnBCL::Encoding *)", "??4?$ICollection@G@UnBCL@@QAEAAU01@$$QAU01@@Z", "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@", "?Pop@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEPAVObject@2@XZ", "?GetEnumerator@XmlNamespaceManager@UnBCL@@QBEPAU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@XZ", "??_7?$SerializableArrayBase@H@_@UnBCL@@6B@", "?DAYS_PER_4@DateTime@UnBCL@@0HB", "919C9R9s9", "?CompareNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z", "LockResource", "?Concat@String@UnBCL@@SGPAV12@PBG0@Z", "??7?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBE_NXZ", ":#;@;Y;", "RemoveDirectoryW", "6%6W6v6", "class UnBCL::XmlNodeList *__thiscall UnBCL::XmlNode::SelectNodes(class UnBCL::String *)", "9O9U9[9a9h9", "?N?z?", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:`:x:|:", "??0?$CSimpleStringT@G$0A@@ATL@@QAE@ABV01@@Z", ".?AU?$IEnumerator@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@UnBCL@@", "2#2(2<2J2R2W2k2y2", "??_7DateTime@UnBCL@@6B@", "null chars to String::CountChars", "7\"70787=7Q7_7g7l7", "??_7NotSupportedException@UnBCL@@6B@", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "9 9$94989P9T9\\9t9x9", "8 8@8L8l8t8", "??0?$SerializableArrayBase@E@_@UnBCL@@QAE@XZ", "??4?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "GetLinePosition", "?IndexOf@?$Array@G@UnBCL@@UBEHG@Z", "?get_IsFixedSize@?$ArrayList@G@UnBCL@@UBEHXZ", ">3?L?s?", "?get_P@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVStream@2@XZ", "_except_handler4_common", ";D$ r)", "??0Registry@UnBCL@@QAE@$$QAV01@@Z", ">\">;>Q>l>v>", "int __stdcall UnBCL::Array::LastIndexOf(const class UnBCL::Array *,int,int,int)", "VVVVVVQVVV", "??4Logging@UnBCL@@QAEAAV01@$$QAV01@@Z", "??_7StreamReader@UnBCL@@6BIDisposable@1@@", "0Shhl", "?get_Item@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVString@2@PAV32@@Z", "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z", "?InnerList@?$Array@H@UnBCL@@MBEPAV?$ArrayList@H@2@XZ", "attempt to delete subkey tree of key opened read-only", "1!1S1e1x1", "9#:?:c:", "? ?(?0?@?d?l?t?|?", "null name to Environment::GetEnvironmentVar", "1#1r1", ";;;_;", "??4?$SerializableArrayBase@G@_@UnBCL@@QAEAAV012@$$QAV012@@Z", ".?AVMutex@UnBCL@@", "778I8[8i8", "?RegisterStaticTypes@SbRegistrationList@UnBCL@@SGXH@Z", "?Insert@MutableString@UnBCL@@QAEXHPBGH@Z", "FlushFileBuffers", ":,:>:", "?IsEnvironmentVarSetTrue@Environment@UnBCL@@SGHPBVString@2@H@Z", "null name to SerializationStream::RegisterType", "??4?$Array@G@UnBCL@@QAEAAV01@ABV01@@Z", "909C9", ".PAVNotSupportedException@UnBCL@@", "??0ArgumentException@UnBCL@@QAE@PBVString@1@@Z", "&&1J+d", "ix or count out of range to ASCIIEncoding::GetCharCount", "?get_CString@String@UnBCL@@QBEPBGXZ", "?LastIndexOf@String@UnBCL@@QBEHPBG@Z", "??0Exception@UnBCL@@QAE@PAV01@PBG@Z", "??4ASCIIEncoding@UnBCL@@QAEAAV01@ABV01@@Z", "<==O=a=s=", "??0XmlException@UnBCL@@QAE@$$QAV01@@Z", "?get_Manufacturer@SystemInfo@UnBCL@@QBEPBVString@2@XZ", ".?AVXmlSchemaSet@UnBCL@@", "null list to ArrayList::IndexOf", "WVVVV", "?get_Count@?$ArrayList@G@UnBCL@@UBEHXZ", "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@", "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBGH@Z", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", "?get_InnerException@Exception@UnBCL@@UBEPBV12@XZ", "848Y8e8~8", "??0SerializationException@UnBCL@@QAE@ABV01@@Z", "??4?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "??4?$ICollection@E@UnBCL@@QAEAAU01@$$QAU01@@Z", "?Append@StringBuilder@UnBCL@@QAEPAV12@G@Z", "?get_Values@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$ICollection@PAVString@UnBCL@@@2@XZ", "??0String@UnBCL@@QAE@ABV01@@Z", "??0ArithmeticException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@1@@", "void __thiscall UnBCL::XmlNode::RegisterNamespaces(class UnBCL::XmlNamespaceManager *)", "class UnBCL::StringBuilder *__thiscall UnBCL::StringBuilder::Append(const unsigned short *,int,int)", "4,404@4P4`4d4h4p4", "1#111?1", "??0ISerializable@UnBCL@@QAE@XZ", "class UnBCL::SmartPtr __thiscall UnBCL::String::_Insert(int,class UnBCL::SmartPtr) const", "5#5H5m5", "??_8Version@UnBCL@@7B01@@", "1s1|1", "??4XmlDocument@UnBCL@@QAEAAV01@ABV01@@Z", "PSWVh", "1*1<1N1c1", "int __thiscall UnBCL::ArrayList::IndexOf(class UnBCL::XmlLite::XmlNode *,int,int) const", "?IndexOf@?$ArrayList@G@UnBCL@@UBEHGHH@Z", "index out of range to String#get_Chars()", "7 8I8N8", "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", "?LastIndexOf@?$ArrayList@G@UnBCL@@SGHPBV12@GHH@Z", "?StreamRead@String@UnBCL@@QAEXAAVSerializationStream@2@@Z", ".CRT$XLA", "??4InvalidOperationException@UnBCL@@QAEAAV01@ABV01@@Z", "??_7TextWriter@UnBCL@@6B@", "struct IXMLDOMSchemaCollection2 *__stdcall UnBCL::MSXmlModule::CreateDOMSchemaCollection(void)", "??4?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@ABV012@@Z", "??_7StringBuilder@UnBCL@@6B@", "8[8n8}8", "set_Position() on closed BufferedStream", "?Steal@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEPAVDecoder@2@XZ", "848C8c8t8", "?s_InternPool@String@UnBCL@@1PAV?$Hashtable@PAVString@UnBCL@@PAV12@@2@A", "?Contains@MultiSz@UnBCL@@QBEHPBGH@Z", "?Sort@?$Array@G@UnBCL@@SGXPAV12@@Z", "1?1Q1`1", "?GetHashCode@DateTime@UnBCL@@UBEHXZ", ".?AVOutOfMemoryException@UnBCL@@", "0\"0C0", "?set_AutoDelete@?$ArrayList@G@UnBCL@@UAEXH@Z", "malloc", "?_ToUpper@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ", "??5SerializationStream@UnBCL@@QAEAAV01@AAE@Z", "?\"?0?>?L?Z?h?", "int __stdcall UnBCL::Path::IsShortCompliant(const class UnBCL::String *,int)", ">'>\\>n>", "1%1c1", "class UnBCL::String *__stdcall UnBCL::Path::WithLongPrefixUNC(const class UnBCL::String *,int)", "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@000@Z", "??4ProcessStartInfo@UnBCL@@QAEAAV01@ABV01@@Z", "7-8`8", "Write() on closed MemoryStream", "?_TrimStart@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z", "?PrepareWrite@?$CSimpleStringT@G$0A@@ATL@@AAEPAGH@Z", "3 3C3`3", "?get_Item@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z", "1+2=2Z2H3T3l3w3", "??_DRegSubkeyEnumerator@UnBCL@@QAEXXZ", "6 7F7X7g7", "?Sj ", "base\\ntsetup\\unbcl\\src\\reghandle.cpp", ".?AU?$IList@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@", "1$1D1L1X1x1", "? ?$?(?,?0?4?H?L?\\?`?t?x?", "y@Sj$", "4C5f5", "??7?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBE_NXZ", "Read() on closed FileStream", "wcsstr", "?get_Second@DateTime@UnBCL@@QBEHXZ", "8/9`9r9", ";/;6;=;D;K;R;", "ms out of range to DateTime constructor", "null path to Path::GetFullPath", ".?AVArgumentException@UnBCL@@", "?StreamWrite@?$SerializableStackBase@H@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", "??4?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "??0?$Array@PAVString@UnBCL@@@UnBCL@@IAE@XZ", "?DeleteNE@Directory@UnBCL@@SGHPBVString@2@H@Z", "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::InsertBefore(class UnBCL::XmlNode *,class UnBCL::XmlNode *)", "null keyname to RegistryKey#DeleteSubKeyTree", "?DAYS_TO_10K@DateTime@UnBCL@@0HB", ">4>;>b>n>", "?get_Value@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ", "??4DirectoryInfo@UnBCL@@QAEAAV01@ABV01@@Z", ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "??_7ObjectDisposedException@UnBCL@@6B@", "?get_InnerText@XmlNode@UnBCL@@QAEPAVString@2@XZ", "??4?$Array@PAVString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "??4FormatException@UnBCL@@QAEAAV01@ABV01@@Z", "3,4K4z4", "thWh@R", "?GetThisThread@Thread@UnBCL@@SGPAV12@XZ", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", "?Dispose@MemoryStream@UnBCL@@UAEXXZ", "?Assign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXABV12@@Z", "TWMN4R", "??_8RegSubkeyEnumerator@UnBCL@@7B@", ".?AV?$SmartPtr@U?$IEnumerator@E@UnBCL@@@UnBCL@@", "HeapFree", "??_7StreamReader@UnBCL@@6B@", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "?Copy@Directory@UnBCL@@SGXPBVString@2@0HPAUICopyDelegate@12@@Z", "ix or count out of range in ASCIIEncoding#GetBytes", "t5Vj$", "?RegisterVersion@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", "5D6c6", "int __thiscall UnBCL::ASCIIEncoding::GetMaxByteCount(int) const", "?GetVersionId@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "empty srcpath or destpath to File::MoveEx", "?Add@StreamCounter@UnBCL@@QAEX_J@Z", "??0StreamWriter@UnBCL@@QAE@ABV01@@Z", "class UnBCL::Array *__stdcall UnBCL::MultiSz::FromMultiSz(const unsigned short *)", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "?Substring@String@UnBCL@@QBEPAV12@HH@Z", "?RegisterVersion@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", "void __thiscall UnBCL::ArrayList::set_Item(int,class UnBCL::XmlLite::XmlAttribute *)", "?*?N?", "s2Wj$", "??_DProcess@UnBCL@@QAEXXZ", "?(?H?P?\\?|?", "??1XmlAttribute@XmlLite@UnBCL@@UAE@XZ", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(unsigned int &)", ";6;g;", "?%?,?3?_?j?x?", ".?AU?$IEnumerator@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@", "Compare failed -- bad comparison routines?", "?GetEnumerator@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVString@UnBCL@@@2@XZ", "2 2$2<2L2P2T2l2p2t2x2|2", "3X4g4", ":?;Q;c;q;", "?GetArchitectureString@OperatingSystem@UnBCL@@SGPBGK@Z", "??4SecurityException@UnBCL@@QAEAAV01@$$QAV01@@Z", "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6BISerializable@2@@", "??4Win32Exception@UnBCL@@QAEAAV01@$$QAV01@@Z", "class UnBCL::DictionaryEntry __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "?get_FullName@Type@UnBCL@@UBEPBVString@2@XZ", "??_7?$ArrayList@G@UnBCL@@6B?$IEnumerable@G@1@@", "index out of range to ArrayList#RemoveAt", "?GetEnumerator@?$ArrayList@G@UnBCL@@UBEPAU?$IEnumerator@G@2@XZ", ".?AU?$IDictionaryEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@", "<4=G=[=}=", "Microsoft Corporation1", "??0SEHException@UnBCL@@QAE@ABV01@@Z", "=$=,=4=@=`=h=p=|=", "wcscspn", "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBG@Z", "??_8?$Array@H@UnBCL@@7B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "ia32/win64", "?Nullify@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEAAV12@XZ", "474@4s4", "const class UnBCL::String *__stdcall UnBCL::Try_Cast(const class UnBCL::Object *)", "8,8X8", "::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array *,int)", "?Flush@BufferedStream@UnBCL@@UAEXXZ", "int __stdcall UnBCL::ArrayList::LastIndexOf(const class UnBCL::ArrayList *,class UnBCL::String *,int,int)", "??0OverflowException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "5&5.535G5Q5h5p5u5", "?_Match@String@UnBCL@@SGHV?$SmartPtr@VString@UnBCL@@@2@0@Z", "6,7S7x7", "WaitForSingleObject failed in Monitor operation", "?get_Item@XmlAttributeCollection@XmlLite@UnBCL@@QAEPAVXmlAttribute@23@PAVString@3@@Z", "181D1d1p1", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBD@Z", "= =0=4=D=H=L=d=t=x=|=", "?Clone@?$Array@E@UnBCL@@UBEPAVObject@2@XZ", "??0Version@UnBCL@@QAE@PBG@Z", "??4?$SerializableStackBase@H@_@UnBCL@@QAEAAV012@ABV012@@Z", "6 6$6(6,6064686<6@6D6H6L6P6X6p6t6x6|6", "??0?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B?$IList@PAVObject@UnBCL@@@1@@", "??_DThread@UnBCL@@QAEXXZ", "?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPBG@Z", "SelectionNamespaces", ".?AUIInstanceFactory@UnBCL@@", "??_7XmlNodeList@XmlLite@UnBCL@@6B@", "unable to retrieve subkey count", "363M3d3", "?Clone@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ", "9/:A:S:a:", "?s_Manager@Allocator@UnBCL@@0PAPAUIHeapMemory@@A", "?LastIndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@HH@Z", "f90uAVj ", "??_D?$Array@PAVObject@UnBCL@@@UnBCL@@QAEXXZ", "?Add@?$Array@H@UnBCL@@UAEHH@Z", ">\\>s>z>", "1C2\\2", "??0XmlException@UnBCL@@QAE@ABV01@@Z", "sanity shortfall in comparison operators", "int __thiscall UnBCL::String::_IndexOf(class UnBCL::SmartPtr) const", "?Steal@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ", "??0String@UnBCL@@QAE@PBG@Z", "7$747@7H7p7x7", ":\";D;", "<&=P=", "void __stdcall UnBCL::Monitor::Pulse(class UnBCL::SyncObject *)", "6+6w6", "int __thiscall UnBCL::String::_IndexOfAny(class UnBCL::SmartPtr,int,int) const", "get_Capacity on closed MemoryStream", "??1Thread@UnBCL@@UAE@XZ", "void __thiscall UnBCL::RegistryKey::DeleteValue(const class UnBCL::String *)", "?get_IsAlive@Thread@UnBCL@@QAEHXZ", "?get_ProcessorCaption@SystemInfo@UnBCL@@QBEPBVString@2@XZ", "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@", ";C<`<", "??_7BufferedStream@UnBCL@@6BIDisposable@1@@", "?LastIndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@HH@Z", "?get_Month@DateTime@UnBCL@@QBEHXZ", "?Right@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator <<(const struct UnBCL::ISerializable *)", "??0?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "??0DirectoryInfo@UnBCL@@QAE@$$QAV01@@Z", "??0ApplicationException@UnBCL@@QAE@ABV01@@Z", "??_7?$Array@E@UnBCL@@6B01@@", "??4?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "int __thiscall UnBCL::Array::Add(class UnBCL::XmlLite::XmlAttribute *)", "?get_CurrentFileName@FileSystemEnumerator@UnBCL@@UBEPAVString@2@XZ", "??0?$Array@G@UnBCL@@IAE@XZ", "?RegisterVersion@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", "3\"4b4", "HeapReAlloc", ".?AV?$HTEnumerator@UUniqueObject@SerializationStream@UnBCL@@HUTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@3@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@3@UKeyTraits@53@$1?RetrieveEntry@53@KG?AV63@PBV?$CAtlMap@UTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@", "void __thiscall UnBCL::XmlNode::RemoveChild(class UnBCL::XmlNode *)", "?get_ProcessHandle@Process@UnBCL@@QBEPAXXZ", "2&3w3", "ix out of range to ArrayList#P", "?AllocSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAGXZ", "?StreamWrite@String@UnBCL@@QBEXAAVSerializationStream@2@@Z", "??0?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAE@XZ", "??_8?$ArrayList@G@UnBCL@@7B?$IList@G@1@@", "?MakeLower@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ", ";D;O;", "??4XmlAttributeCollection@UnBCL@@QAEAAV01@ABV01@@Z", "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@", "startIndex and/or value out of range", "??D?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEAAVXmlNamespaceManager@1@XZ", "808P8X8d8", "?get_BiosVersion@SystemInfo@UnBCL@@QBEPBVString@2@XZ", "int __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "?get_CanWrite@BufferedStream@UnBCL@@UBEHXZ", "?Clone@?$Array@H@UnBCL@@UBEPAVObject@2@XZ", "GetCurrentThreadId", "MoveFileExW", "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PBGPAUIAtlStringMgr@1@@Z", "iswspace", "??_8?$Stack@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@", "8#8Z8", "void __thiscall UnBCL::ArrayList::set_Item(int,class UnBCL::String *)", "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@@Z", "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@1@@", "void __thiscall UnBCL::Array::Insert(int,unsigned char)", "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z", ".?AV?$Array@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@", ";%<71>K>d>}>", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(const struct UnBCL::ISerializable *&)", "unable to create process", "tNaN to TimeSpan::Interval", ".?AVTextReader@UnBCL@@", "??0?$Stack@H@UnBCL@@QAE@XZ", ".?AV?$SmartPtr@U?$IEnumerator@PAVString@UnBCL@@@UnBCL@@@UnBCL@@", "?MatchI@String@UnBCL@@SGHPBG0@Z", "?Assign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXABV12@@Z", "bad SeekOrigin to FileStream#Seek", "class UnBCL::String *&__thiscall UnBCL::ArrayList::get_Item(int)", "uPVj$", "?WaitForExit@Process@UnBCL@@QAEXXZ", "=,=:=H=", "??4PathTooLongException@UnBCL@@QAEAAV01@ABV01@@Z", "FormatMessageW", "kernel32.dll", "GetModuleHandleW", "0!0(0/060=0D0", "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPAV12@PAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z", "u$Vj ", "GetSystemInfo", "UnBCL::RegSubkeyEnumerator::MoveNext", "??_7?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@6B@", "?get_Milliseconds@TimeSpan@UnBCL@@QBEHXZ", "?GetDwordValue@RegHandle@UnBCL@@QAEHPBGAAK@Z", "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@", "??0IndexOutOfRangeException@UnBCL@@QAE@$$QAV01@@Z", "null collection to ArrayList#AddRange", "unbcl.dll", "5#5A5{5", "?FreeExtra@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ", ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@", "?get_XMLDOMDocument@XmlDocument@UnBCL@@QAEPAUIXMLDOMDocument3@@XZ", "??4?$IEnumerable@H@UnBCL@@QAEAAU01@ABU01@@Z", "??4?$IList@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", "alpha64", "WakeAllConditionVariable", "??_8ASCIIEncoding@UnBCL@@7BEncoding@1@@", "??0?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "1$1<1@1X1h1l1|1", "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "ReleaseMutex", "?StreamRead@?$SerializableStackBase@H@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", "0&080S0q0x0", "??1?$Array@PAVString@UnBCL@@@UnBCL@@UAE@XZ", "??4?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "??4OutOfMemoryException@UnBCL@@QAEAAV01@$$QAV01@@Z", "?get_Item@?$Array@E@UnBCL@@UAEAAEH@Z", "< <)<`::InitLarva(class UnBCL::ArrayList *)", ";#<2::Compare(unsigned short,unsigned short)", "?KeyDestroy@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEXPAVString@2@@Z", "FileStream Seek() failed", "2$2(2@2D2\\2l2p2", "??0TimeSpan@UnBCL@@QAE@ABV01@@Z", "??_7Object@UnBCL@@6B@", "class UnBCL::SerializationStream::TypeFactoryList *__thiscall UnBCL::Hashtable::get_Item(class UnBCL::SerializationId *) const", "7&757R7e7t7", ".?AV?$SmartPtr@UISerializable@UnBCL@@@UnBCL@@", "??0?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "class UnBCL::Object *__thiscall UnBCL::_::ArrayListEnumerator::get_Current(void) const", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "040F0U0", "?Peek@?$Stack@H@UnBCL@@UAEAAHXZ", "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBD@Z", "?Flush@FileStream@UnBCL@@UAEXXZ", "?s_RegistrationListHead@SbRegistrationList@UnBCL@@0U_SINGLE_LIST_ENTRY@@A", "=3=~=", ">2>]>", "6U7}7", "=+=R=d=s=", "??1?$Array@G@UnBCL@@UAE@XZ", ">9?M?\\?", "?Load@XmlDocument@UnBCL@@QAEXPAUIStream@@@Z", "616S6~6", "?s_Manager_Init@Allocator@UnBCL@@0HA", ";%;3;A;", "7Z7l7", "null str to String::IndexOfAny", "null list to ArrayList::BinarySearch", "??_D?$ArrayList@G@UnBCL@@QAEXXZ", "?Load@XmlDocument@UnBCL@@QAEXPAVString@2@@Z", "<>2M2o2", "?Close@SerializationStream@UnBCL@@QAEXXZ", "?ReadObjectHeader@SerializationStream@UnBCL@@AAEHAAPAVObject@2@@Z", "?StreamRead@MultiSz@UnBCL@@UAEXAAVSerializationStream@2@@Z", "?ThrowMemoryException@?$CSimpleStringT@G$0A@@ATL@@KAXXZ", "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PAUIAtlStringMgr@1@@Z", "??_7OperatingSystem@UnBCL@@6BISerializable@1@@", "=/>>>", "?Equals@?$ArrayList@G@UnBCL@@UBEHPBVObject@2@@Z", "?Write@MemoryStream@UnBCL@@UAEXPBEHH@Z", "?2?A?~?", "=/>:>H>", "5,545<5D5L5X5x5", "??_7?$SmartPtr@VObject@UnBCL@@@UnBCL@@6B@", "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "4'4C4^4", "?get_Item@?$Array@G@UnBCL@@UBEABGH@Z", "?FormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAD@Z", "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@KW4InstallationType@1@PAVVersion@1@@Z", ".?AVFileStream@UnBCL@@", "E0C1)0'", ":#;b;t;", "2#2G2", "wcsncpy_s", "PSWVh8L", "=$=0=S=", "R!s4Z", "??4?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", "9/9J9k9y9", "3&3+3?3M3U3Z3n3w3", "void __stdcall UnBCL::Array::Sort(class UnBCL::Array *)", "?get_FirstChild@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ", "2&2c2", "null bytes to UnicodeEncoding#GetBytes", "??0TimeSpan@UnBCL@@QAE@HHHH@Z", "void __thiscall UnBCL::ArrayList::CopyTo(class UnBCL::Array *,int) const", "int __stdcall UnBCL::Array::BinarySearch(const class UnBCL::Array *,unsigned short,struct UnBCL::IComparer *)", "operator [] on null StringPtr", "3+393A3F3Z3h3p3u3", "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBE@Z", "??0SerializationException@UnBCL@@QAE@XZ", ".?AV?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "6,606H6L6d6h6|6", "7 8T8", "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@@Z", "2,2a2", "??4?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", "?InitInternPool@String@UnBCL@@KGXXZ", "RegEnumKeyExW", "??B?$CSimpleStringT@G$0A@@ATL@@QBEPBGXZ", "?Copy@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPBV12@PAV12@H@Z", "5(505H5P5`5|5", "?Contains@?$Array@E@UnBCL@@UBEHE@Z", "??0Decoder@UnBCL@@QAE@$$QAV01@@Z", "Out of memory while allocating XmlAttribute", "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ", "?(?G?", "?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGXZ", ".?AVHeapMemoryManager@UnBCL@@", "int __thiscall UnBCL::Array::Add(unsigned short)", "GetCurrentDirectoryW failed", "7[7}7", "?Close@FileStream@UnBCL@@UAEXXZ", "?Assign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXPAVSerializationStream@2@@Z", "?BinarySearch@?$ArrayList@G@UnBCL@@SGHPAV12@GPAU?$IComparer@G@2@@Z", "??1?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", "3/4Q4c4~4", "??4ArgumentException@UnBCL@@QAEAAV01@ABV01@@Z", "??0XmlNamespaceManager@UnBCL@@QAE@ABV01@@Z", "2'2I2s2", "1*191Z1l1{1", "__thiscall UnBCL::ArrayList >::ArrayList(const struct UnBCL::ICollection > *)", "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B@", "(070W0", "??0Delegate@UnBCL@@QAE@XZ", "?get_Count@XmlNodeList@XmlLite@UnBCL@@QBEHXZ", "index out of range to ArrayList#set_Item", "iswprint", "??_8MultiSz@UnBCL@@7B@", "??1ScopedObjectLock@UnBCL@@QAE@XZ", "?%?1?", "??_7Decoder@UnBCL@@6B01@@", "?get_InnerList@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MBEPBV?$ArrayList@PAVObject@UnBCL@@@2@XZ", "2<2O2^2", "?GetVersionId@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "??0ArgumentNullException@UnBCL@@QAE@$$QAV01@@Z", "1/0-0", "null bytes to UnicodeEncoding::GetCharCount", "null version to OperatingSystem constructor", "??D?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEAAVObject@1@XZ", "?Assign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXPAVObject@2@@Z", "5G5`5g5n5", "Peek() on closed StreamReader", "??4XmlException@UnBCL@@QAEAAV01@$$QAV01@@Z", "??0FormatException@UnBCL@@QAE@$$QAV01@@Z", "??0XmlNodeList@XmlLite@UnBCL@@QAE@XZ", "?get_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z", "??4?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "<(<7::LastIndexOf(const class UnBCL::Array *,class UnBCL::String *,int,int)", "_onexit", "?Empty@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ", "5H6U6", "2:2Z2", ".?AV?$ArrayListEnumerator@VStringPtr@UnBCL@@@_@UnBCL@@", "??1Registry@UnBCL@@UAE@XZ", ";%<^<", "?s_Registration@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "??0IInstanceFactory@UnBCL@@QAE@XZ", "=C=u=", ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@_@UnBCL@@", "??0MultiSz@UnBCL@@QAE@XZ", "?get_TotalMemory@SystemInfo@UnBCL@@QBE_KXZ", "??4ExternalException@UnBCL@@QAEAAV01@ABV01@@Z", "5,5=5T5[5", "?get_InnerText@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ", "?GetTypeName@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", "index or count out of range to UnicodeEncoding#GetByteCount", "9.9b9", "?GetRawBuffer@MemoryStream@UnBCL@@UAEPAEXZ", "??0SerializationException@UnBCL@@QAE@PBVString@1@@Z", "??5SerializationStream@UnBCL@@QAEAAV01@AAI@Z", "9#9/969;9A9M9Z9h9t9{9", "??0ExternalException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "6#7C7g7", "??0SystemException@UnBCL@@QAE@ABV01@@Z", "?,?8?X?d?", "171O1b1", "??4?$SerializableArrayBase@H@_@UnBCL@@QAEAAV012@$$QAV012@@Z", ".?AVSystemException@UnBCL@@", "$`2X`F", "?ToLower@Char@UnBCL@@SG?AV12@V12@@Z", "0$0,040<0D0L0T0\\0d0l0t0|0", "M0K0I", "949<9D9L9T9\\9d9l9t9|9", "8(8,8D8T8X8`8d8h8l8p8t8x8|8", "??1type_info@@UAE@XZ", "5\"5^5", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(struct UnBCL::ISerializable *&)", "?get_Rank@?$Array@E@UnBCL@@UBEHXZ", "??1?$SerializableArrayBase@G@_@UnBCL@@UAE@XZ", "8 808@8D8T8X8h8x8|8", "?MoveNext@FileSystemEnumerator@UnBCL@@UAEHXZ", "??0ProcessStartInfo@UnBCL@@QAE@$$QAV01@@Z", "?get_Position@MemoryStream@UnBCL@@UBE_JXZ", "void __thiscall UnBCL::Array::InitLarva(class UnBCL::ArrayList *)", "array of insufficient size to CopyTo", ".edata", "uASj ", "60646L6P6h6x6|6", "GetFileInformationByHandleEx", ">@>Q>", "??_7SystemInfo@UnBCL@@6B@", "__int64 __thiscall UnBCL::BufferedStream::get_Position(void) const", "void __thiscall UnBCL::Array::RemoveAt(int)", "?RegisterNamespaces@XmlNode@UnBCL@@AAEXPAVXmlNamespaceManager@2@@Z", "??4?$ICollection@G@UnBCL@@QAEAAU01@ABU01@@Z", "040A0G0P0u0", ".?AVProcess@UnBCL@@", ".00cfg", "??0InvalidCastException@UnBCL@@QAE@PBG@Z", "?InnerList@?$Stack@H@UnBCL@@MAEAAPAV?$ArrayList@H@2@XZ", "2'292G2}2", "4K4]4l4", "?Peek@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@XZ", "??1AbandonedMutexException@UnBCL@@UAE@XZ", "??1XmlAttributeCollection@XmlLite@UnBCL@@UAE@XZ", "737:7b7", "?ValueDestroy@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEXPAVString@2@@Z", "?Steal@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEPAVXmlNamespaceManager@2@XZ", "4$4(484H4L4P4h4x4|4", ":3:=:J:P:", "??_7ArgumentException@UnBCL@@6B@", "?RemoveAt@?$ArrayList@G@UnBCL@@UAEXH@Z", "686\\6", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "??0FormatException@UnBCL@@QAE@PBG@Z", "UnBCL::RegHandle::GetDwordValue", "?Append@StringBuilder@UnBCL@@QAEPAV12@PBGHH@Z", "??_8?$ArrayList@G@UnBCL@@7B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "argument(s) out of range to DateTime::DateToTicks", "030Q0X0_0", "??4IInstanceFactory@UnBCL@@QAEAAU01@ABU01@@Z", "??0?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@ABU01@@Z", "2(2H2P2X2`2h2p2x2", "?Append@StringBuilder@UnBCL@@QAEPAV12@PBG@Z", "??_8?$Array@H@UnBCL@@7B?$ICollection@H@1@@", "void __thiscall UnBCL::XmlLite::XmlDocument::Parse(struct IStream *)", "ix or count out of range to ASCIIEncoding::GetString", "??_7Mutex@UnBCL@@6BObject@1@@", "int __thiscall UnBCL::ArrayList::IndexOf(int,int,int) const", "attempt to delete \"\" subkey of hive", "int __thiscall UnBCL::String::_LastIndexOf(class UnBCL::SmartPtr,int,int) const", "??0XmlAttribute@UnBCL@@IAE@XZ", "??_DStringPtr@UnBCL@@QAEXXZ", "=K=_=q=", "?_Substring@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HH@Z", ">C>s>", "??1IndexOutOfRangeException@UnBCL@@UAE@XZ", "void __thiscall UnBCL::XmlDocument::Load(struct IStream *)", "??D?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$ArrayList@PAVString@UnBCL@@@1@XZ", "??A?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z", "void __thiscall UnBCL::ArrayList::set_Item(int,class UnBCL::StringPtr)", "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@G@Z", "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B@", "?GetAltDirectorySeparatorChar@Path@UnBCL@@SGGXZ", "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@1@@", ".?AVArithmeticException@UnBCL@@", "?GetVolumeSeparatorChar@Path@UnBCL@@SGGXZ", "??0SerializationStream@UnBCL@@AAE@ABV01@@Z", "1=1X1v1", "; ;$;(;,;0;4;8;<;@;D;H;L;`;d;h;", "?Assign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXPAVEncoding@2@@Z", "??0?$IComparer@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "??7?$SmartPtr@VString@UnBCL@@@UnBCL@@QBE_NXZ", "int __thiscall UnBCL::Array::Add(class UnBCL::StringPtr)", ".?AV?$HTEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@UKeyTraits@62@$1?RetrieveEntry@62@KG?AV72@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@PAVTypeFactoryList@SerializationStream@3@UKeyTraits@23@V?$CElementTraits@PAVTypeFactoryList@SerializationStream@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@", "??_7BufferedStream@UnBCL@@6BStream@1@@", "class UnBCL::Array *__thiscall UnBCL::RegistryKey::GetSubKeyNames(void)", "5M6R6", "737h7", "6C6z6", "?StreamWrite@?$SerializableArrayBase@E@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", ".?AV?$SmartPtr@V?$Array@G@UnBCL@@@UnBCL@@", "??0FileStream@UnBCL@@QAE@PBVString@1@W4FileMode@1@W4FileAccess@1@W4FileShare@1@K@Z", "??1Object@UnBCL@@UAE@XZ", "6$6(6@6D6\\6l6p6t6", "5$5(5,5054585<5@5D5X5h5l5p5", "??0ISerializable@UnBCL@@QAE@$$QAU01@@Z", "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@@Z", "151I1X1}1", "??_8Mutex@UnBCL@@7BIDisposable@1@@", "0\"0P0a0", "??1Char@UnBCL@@UAE@XZ", "multisz", ".CRT$XIZ", "?StreamRead@Version@UnBCL@@UAEXAAVSerializationStream@2@@Z", "?get_Item@XmlAttributeCollection@XmlLite@UnBCL@@QAEPAVXmlAttribute@23@H@Z", "?SetSize@FileStream@UnBCL@@UAEX_J@Z", "??1?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", "class UnBCL::Array *__thiscall UnBCL::Encoding::GetBytes(const class UnBCL::String *) const", "2 2$2<2@2D2H2L2P2T2\\2`2t2x2", "6$6,6`6p6|6", "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@", "5$5,585X5d5", "?get_LastChild@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ", "?Clone@?$Stack@H@UnBCL@@UBEPAVObject@2@XZ", "181_1", "9/9A9O9s9", "?UnregisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@@Z", "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$IDictionary@PAVString@UnBCL@@PAV12@@1@@", "3$343D3H3L3d3h3p3", "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "??BChar@UnBCL@@QAEGXZ", ".?AV?$ArrayList@E@UnBCL@@", "?Clear@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEXXZ", "?GetOOMHandler@Allocator@UnBCL@@SGPAUIOutOfMemoryHandler@@XZ", "?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ", "0 0H0W0v0", "CreateProcessW", "const class UnBCL::DateTime *__stdcall UnBCL::Try_Cast(const class UnBCL::Object *)", "??0RegistryKey@UnBCL@@QAE@ABV01@@Z", "Array doesn't support Remove()", ":#:@:c:", "Invalid SeekOrigin to MemoryStream#Seek", "?get_CSDVersion@Version@UnBCL@@QBEPAVString@2@XZ", "5#6G6l6~6", "9#9F9", "?AppendChild@XmlNode@UnBCL@@QAEPAV12@PAV12@@Z", "??0SystemInfo@UnBCL@@QAE@XZ", "93:s:", "??1Stream@UnBCL@@UAE@XZ", "?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@HH@Z", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "?IsLeapYear@DateTime@UnBCL@@SGHH@Z", ".?AVException@UnBCL@@", "?GetTypeName@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UBEPBVString@2@XZ", "80848L8\\8`8d8h8l8p8", "?Assign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXABV12@@Z", "576S6t6", "<3::RemoveAt(int)", "8K8{8", ";$;(;,;D;T;d;h;", "??0IndexOutOfRangeException@UnBCL@@QAE@ABV01@@Z", ".?AVObject@UnBCL@@", "attempt to load on non-loading archive", "??1?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UAE@XZ", "int __stdcall UnBCL::Array::IndexOf(const class UnBCL::Array *,int,int,int)", "??0StringBuilder@UnBCL@@QAE@PBVString@1@@Z", "??0TextWriter@UnBCL@@QAE@$$QAV01@@Z", "__thiscall UnBCL::ArrayList::ArrayList(int,int)", "??1?$IEnumerator@PBG@UnBCL@@UAE@XZ", "class UnBCL::String *__stdcall UnBCL::Path::Combine(const class UnBCL::String *,const class UnBCL::String *)", "GetNamespaceUri", "??1Win32Exception@UnBCL@@UAE@XZ", "%s [0x%08X]", ":$:,:`:p:|:", "?AllocDbg@HeapMemoryManager@UnBCL@@UAEPAXPBDHK@Z", "7!7G7Y7h7", "?Exists@File@UnBCL@@SGHPBVString@2@@Z", "negative count to String#Split()", "<$<,<4<<::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=p=t=", "void __thiscall UnBCL::ArrayList::set_Item(int,unsigned short)", "??_8?$ArrayList@G@UnBCL@@7B?$ICollection@G@1@@", "?GetEnumerator@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVString@UnBCL@@@2@XZ", "9(909H9P9h9p9x9", "??_7IndexOutOfRangeException@UnBCL@@6B@", "9T9o9A:b:f:q:", "::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "iswalpha", "null chars to ASCIIEncoding#GetBytes", ";$;4;8;<;@;H;`;p;", "233T3[3b3i3p3w3", "??1?$SerializableArrayBase@E@_@UnBCL@@UAE@XZ", "?Nullify@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV12@XZ", "null instance to Monitor::PulseAll", "?ReleaseBuffer@StringBuilder@UnBCL@@QAEXH@Z", ".PAVOverflowException@UnBCL@@", "?GetBuffer@?$Array@G@UnBCL@@UBEPBGH@Z", "??0SyncObject@UnBCL@@QAE@XZ", "?GetEnumerator@?$Array@H@UnBCL@@UBEPAU?$IEnumerator@H@2@XZ", "int __stdcall UnBCL::Array::BinarySearch(const class UnBCL::Array *,class UnBCL::Object *,struct UnBCL::IComparer *)", "?StartAddress@Thread@UnBCL@@CGKPAX@Z", "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@XZ", "<,<0::BinarySearch(const class UnBCL::Array *,class UnBCL::String *,struct UnBCL::IComparer *)", "wcspbrk", "??_7Version@UnBCL@@6B@", "??D?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEAAVVersion@1@XZ", "class UnBCL::XmlLite::XmlAttribute *const &__thiscall UnBCL::ArrayList::get_Item(int) const", "?WriteBytes@SerializationStream@UnBCL@@QAEXPBEH@Z", "??7?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBE_NXZ", "?_Replace@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@0@Z", "?terminate@@YAXXZ", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "?get_Source@Exception@UnBCL@@UBEPBVString@2@XZ", "98:G:q:", "= =P=", "?Clone@OperatingSystem@UnBCL@@UBEPAVObject@2@XZ", "?set_Item@?$Array@G@UnBCL@@UAEXHG@Z", "GetProcAddress", "?SpanIncluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBG@Z", "?Compare@String@UnBCL@@SGHPBGPBV12@H@Z", "FindClose", "?WriteLine@TextWriter@UnBCL@@UAEXXZ", "class UnBCL::XmlLite::XmlAttribute *&__thiscall UnBCL::ArrayList::get_Item(int)", "?Free@HeapMemoryManager@UnBCL@@UAEXPAX@Z", "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::AppendChild(class UnBCL::XmlNode *)", "??_DBufferedStream@UnBCL@@QAEXXZ", "0=0`0", "RegQueryInfoKey", ".?AVASCIIEncoding@UnBCL@@", "??0?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAE@XZ", "1S1a1", "void __thiscall UnBCL::ArrayList::Insert(int,unsigned char)", "void __thiscall UnBCL::ArrayList::set_Item(int,class UnBCL::Object *)", "2(2C2a2h2o2v2}2", "949D9P9p9x9", "8\"8F8j8|8", "?LockBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGXZ", "??0DirectoryInfo@UnBCL@@QAE@ABV01@@Z", "?Alloc@HeapMemoryManager@UnBCL@@UAEPAXK@Z", "?GetVersionId@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "?CreateNode@XmlDocument@UnBCL@@QAEPAVXmlNode@2@W4XmlNodeType@2@PAVString@2@1@Z", "0X0h0", "%ws.%03d", "alpha", "CreateMutexW", "??_7RegSubkeyEnumerator@UnBCL@@6B?$IEnumerator@PBG@1@@", "int __stdcall UnBCL::ASCIIEncoding::SGetCharCount(const class UnBCL::Array *,int,int)", "<. *,int) const", "6#7~7", "??0ProcessStartInfo@UnBCL@@QAE@PBVString@1@0@Z", "void __thiscall UnBCL::ArrayList >::AddRange(const struct UnBCL::ICollection > *)", "717S7v7", "??1ISerializable@UnBCL@@UAE@XZ", "Seek() on closed FileStream", "attempt to StreamRead on non-larval string", "t#j\\+", "?_Trim@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2p2t2x2|2", "Read() on closed StreamReader", "8#9?9c9", "??0Encoding@UnBCL@@IAE@H@Z", "??0Char@UnBCL@@QAE@G@Z", " Windows", "unsigned short __thiscall UnBCL::StringBuilder::get_Chars(int) const", "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "empty srcpath or destpath to File::Move", ")attempt to StreamRead on non-larval Array instance", ">$>(>@>D>\\>l>p>t>x>|>", "void __thiscall UnBCL::Array::Remove(class UnBCL::Object *)", "8'8F8s8", "??_8Version@UnBCL@@7BISerializable@1@@", "null ModuleName to Directory::GetLoadedModuleDir", "7N7s7", "result of double->TimeSpan conversion too large", "??0XmlNamespaceManager@UnBCL@@QAE@XZ", "5-6D6K6q6}6", "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@PAVVersion@1@@Z", "RegDeleteValueW", "int __stdcall UnBCL::Int32Ops::Parse(const unsigned short *)", "??1?$SmartPtr@VObject@UnBCL@@@UnBCL@@UAE@XZ", "MoveNext() called on invalidated enumerator", "?get_P@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVObject@2@XZ", "?DeAssign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXXZ", "?DAYS_TO_MONTH_365@DateTime@UnBCL@@0QBHB", "?CreateTemporaryDirectory@Directory@UnBCL@@SGPAVString@2@XZ", ";t04u", "364Q4", "?Equals@TimeSpan@UnBCL@@UBEHPBVObject@2@@Z", "?GetByteCount@UnicodeEncoding@UnBCL@@UBEHPBVString@2@HH@Z", "=5>A>M>", "class UnBCL::RegistryKey *__thiscall UnBCL::RegistryKey::OpenSubKey(const class UnBCL::String *,int)", "??_7MemoryStream@UnBCL@@6BStream@1@@", "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@G@Z", "??4?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "void __stdcall UnBCL::Path::CheckPathTooLong(const class UnBCL::String *)", "??0XmlSchemaSet@UnBCL@@QAE@ABV01@@Z", "2#3P3b3t3", ".?AV?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@", "??0XmlNodeList@UnBCL@@QAE@PAUIXMLDOMNodeList@@@Z", ":H;Z;x;", "?DeAssign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXXZ", "?set_AutoDelete@?$Array@H@UnBCL@@UAEXH@Z", "?GetBuffer@?$Array@G@UnBCL@@UAEPAGH@Z", "void __thiscall UnBCL::ArrayList::Resize(int,int)", "2<2D2L2X2|2", "?get_XMLDOMNode@XmlNode@UnBCL@@QAEPAUIXMLDOMNode@@XZ", "?TrimEnd@String@UnBCL@@QBEPAV12@PBG@Z", "attempt to delete value of key opened read-only", "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@PBU?$IDictionary@PAVString@UnBCL@@PAV12@@1@@Z", "Sleep", "??0WaitHandle@UnBCL@@IAE@XZ", "??0Version@UnBCL@@QAE@HHHPAVString@1@@Z", "RegEnumValueW", "?Clone@?$ArrayList@G@UnBCL@@UBEPAVObject@2@XZ", "??0?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "void __thiscall UnBCL::Array::Insert(int,class UnBCL::Object *)", "?Add@DateTime@UnBCL@@QBE?AV12@ABVTimeSpan@2@@Z", ")null key to Hashtable#Add()", "0$1@1`1", "class UnBCL::XmlLite::XmlNode *const *__thiscall UnBCL::ArrayList::GetBuffer(int) const", "3+4S4", "040<0D0L0T0\\0d0l0|0", "??_7?$Array@G@UnBCL@@6B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "??0OverflowException@UnBCL@@QAE@PBG@Z", "?get_Count@XmlAttributeCollection@UnBCL@@QAEHXZ", "void __stdcall UnBCL::Array::Sort(class UnBCL::Array *)", "5+5=5O5]5", "?Remove@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z", "??_7?$Array@E@UnBCL@@6BObject@1@@", "int __thiscall UnBCL::Array::Add(class UnBCL::String *)", "=+=N=y=", "attempt to create a FileStream on a non-disk file", "??1?$Array@H@UnBCL@@UAE@XZ", "??0?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "@.didat", ".CRT$XIA", "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6BISerializable@1@@", "7B7T7b7", ".?AU?$ICollection@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@UnBCL@@", "?GetValue@?$Array@E@UnBCL@@UBEEH@Z", "DtCSV", "?,?>?M?c?", ".?AU?$IEnumerator@PAVSerializationId@UnBCL@@@UnBCL@@", "??0XmlAttribute@XmlLite@UnBCL@@QAE@$$QAV012@@Z", "void __thiscall UnBCL::ArrayList::Resize(int,int)", "9)9C9Z9p9", "FindFirstFileW", "272E2S2a2o2", "4 4(4-4A4O4W4\\4p4~4", "__int64 __thiscall UnBCL::BufferedStream::get_Length(void) const", "??0Encoding@UnBCL@@QAE@$$QAV01@@Z", "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", "9,9E9g9", ">8>Q>j>", ".text$di", "?GetASCII@Encoding@UnBCL@@SGPAV12@XZ", "GetFileTime", ".?AVStringBuilder@UnBCL@@", "'", "5$54585H5L5\\5`5d5|5", "?GetVersionId@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UBEHXZ", "??_7Stream@UnBCL@@6BObject@1@@", "??4Int32Ops@UnBCL@@QAEAAU01@$$QAU01@@Z", "??4ArgumentNullException@UnBCL@@QAEAAV01@$$QAV01@@Z", "void __thiscall UnBCL::_::ArrayListEnumerator >::Reset(void)", "3 333W3", "?TICKS_PER_M@DateTime@UnBCL@@1_JB", "??4?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "?IndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@@Z", "?Peek@?$Stack@H@UnBCL@@UBEABHXZ", "?ToFileTimeUtc@DateTime@UnBCL@@QBE_JXZ", "?ThawHash@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ", ".?AV?$HTDictEnumBase@PAVTypeFactoryList@SerializationStream@UnBCL@@@_@UnBCL@@", "?Nullify@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ", "void __stdcall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array *,int)", "void __thiscall UnBCL::Array::RemoveAt(int)", "??0?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "?get_IsStoring@SerializationStream@UnBCL@@QBEHXZ", "??0ExternalException@UnBCL@@QAE@PBG@Z", "?Sort@?$Array@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z", "??4ThreadStateException@UnBCL@@QAEAAV01@$$QAV01@@Z", "9\"909", "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@KPAVVersion@1@@Z", ">4>;>B>I>P>W>", "const class UnBCL::Version *__stdcall UnBCL::Try_Cast(const class UnBCL::Object *)", "?GetVersionId@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "int __stdcall UnBCL::UnicodeEncoding::SGetCharCount(const class UnBCL::Array *,int,int)", "?Sanitize@Path@UnBCL@@SGPAVString@2@PBV32@@Z", "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@", "_callnewh", "newCapacity and sizeof(WCHAR) product overflowed in multisz#Add", "??4?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "?GetFileNameWithoutExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z", "void __stdcall UnBCL::File::MoveEx(const class UnBCL::String *,const class UnBCL::String *,unsigned long)", "??1?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", "?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ", "?Validate@Allocator@UnBCL@@SGXI@Z", "Unmanaged BCL", " 0@0l0", ">b>t>", "7<7{7", "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "505V5|5", "?ToArray@?$ArrayList@G@UnBCL@@UBEPAV?$Array@G@2@XZ", "unable to flush FileStream", ">#?5?G?", ".?AVString@UnBCL@@", "??0PathTooLongException@UnBCL@@QAE@XZ", "?Assign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXABV12@@Z", "??0?$IList@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z", ".?AV?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@", "system call returned unrecognized OS version", "??0SystemException@UnBCL@@QAE@XZ", "0>i>", "GetLocalName", "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "04080D0p0", "??0?$IList@G@UnBCL@@QAE@ABU01@@Z", ":%:3:W:", "??_7?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@6B@", "??4?$IList@G@UnBCL@@QAEAAU01@ABU01@@Z", "??_DStreamWriter@UnBCL@@QAEXXZ", ".?AV?$SmartPtr@VType@UnBCL@@@UnBCL@@", "void __thiscall UnBCL::Hashtable::Add(class UnBCL::String *,class UnBCL::String *)", "??4MemoryStream@UnBCL@@QAEAAV01@ABV01@@Z", "2*282F2T2b2p2", ".?AU?$IDictionary@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@", "??_DRegHandle@UnBCL@@QAEXXZ", ".?AV?$SerializableArrayBase@H@_@UnBCL@@", "??0XmlNode@UnBCL@@IAE@PAUIXMLDOMNode@@@Z", "??1DirectoryInfo@UnBCL@@UAE@XZ", "5C7s7y7", "424;4", "?GetAt@?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "ProductVersion", "?_IndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z", "void __stdcall UnBCL::Win32Exception::ThrowLastError(const unsigned short *,const char *,int)", "??0?$IEnumerator@PBG@UnBCL@@QAE@XZ", "=C=\\=", "??0Char@UnBCL@@QAE@ABV01@@Z", "3T3c3|3", "Seek() on closed MemoryStream", "t@Vh::LastIndexOf(class UnBCL::XmlLite::XmlAttribute *,int,int) const", "??0SystemException@UnBCL@@QAE@PBG@Z", "??1SerializationException@UnBCL@@UAE@XZ", "?get_Build@Version@UnBCL@@QBEHXZ", "void __stdcall UnBCL::File::DeleteInternal(const class UnBCL::String *)", "142\\2p2", "O0M0K", "??0TimeSpan@UnBCL@@QAE@_J@Z", "__thiscall UnBCL::String::String(unsigned short,int)", ".?AV?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@", ".?AV?$SmartPtr@U?$IEnumerator@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@", "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@PAVString@1@@Z", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@GH@Z", "?Trim@String@UnBCL@@QBEPAV12@PBG@Z", "??0ExternalException@UnBCL@@QAE@PBGPAVException@1@@Z", "?DumpDelta@HeapMemoryManager@UnBCL@@UAEIPAUILogHandler@@@Z", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDHPAUIAtlStringMgr@1@@Z", "?GetDatePart@DateTime@UnBCL@@ABEHW4DatePart@12@@Z", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "void __stdcall UnBCL::ArrayList::Sort(class UnBCL::ArrayList *)", "?DeleteInternal@Directory@UnBCL@@CGXPBVString@2@HH@Z", "?Push@?$Stack@H@UnBCL@@UAEXH@Z", "=C>`>q>", "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", "Deserialized non ISerializable object: %s", "?get_FirstChild@XmlNode@UnBCL@@QAEPAV12@XZ", "?SetValue@?$Array@E@UnBCL@@UAEXEH@Z", "='>9>S>", "?GetFullPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z", "5 5$545D5H5X5h5x5|5", "?ThrowLastError@Win32Exception@UnBCL@@SGXPBVString@2@PBDH@Z", "7\"888D8Z8}8", "class UnBCL::TimeSpan __stdcall UnBCL::TimeSpan::Interval(double,int)", "?GetValue@?$Array@H@UnBCL@@UBEHH@Z", "?Assign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXABV12@@Z", "?GetVersionId@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6BObject@1@@", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,class UnBCL::StringPtr,struct UnBCL::IComparer *)", "<,<: *__thiscall UnBCL::MultiSz::ToByteArray(void) const", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "??1?$CSimpleStringT@G$0A@@ATL@@QAE@XZ", "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@XZ", "??0?$IEnumerator@PBG@UnBCL@@QAE@ABU01@@Z", "??1?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@UAE@XZ", "?SetLength@MemoryStream@UnBCL@@UAEX_J@Z", "null stream or encoding to StreamWriter constructor", "wait handle abandoned", "t!hpB", "??4SerializationId@UnBCL@@QAEAAV01@ABV01@@Z", "unable to retrieve value name", "?ASCII_CODEPAGE@ASCIIEncoding@UnBCL@@0HB", "3'353=3B3V3d3l3q3", "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B01@@", "??0Exception@UnBCL@@QAE@ABV01@@Z", "unable to retrieve subkey name", "??4StringBuilder@UnBCL@@QAEAAV01@ABV01@@Z", ")null instance to Monitor::Pulse", ".PAVAbandonedMutexException@UnBCL@@", "7h7m7", "3$3,343H3P3X3h3t3|3", "__thiscall UnBCL::FileSystemEnumerator::FileSystemEnumerator(const unsigned short *,const unsigned short *) throw(...)", "7#7G7Y7h7", "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@W4InstallationType@1@PAVVersion@1@@Z", ")xmlns:%s=\"%s\"", "2 2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "u Sh ", "??1?$Stack@H@UnBCL@@UAE@XZ", "int __thiscall UnBCL::Hashtable::ContainsKey(class UnBCL::SerializationId *) const", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "??4SecurityException@UnBCL@@QAEAAV01@ABV01@@Z", "void __thiscall UnBCL::ArrayList >::set_Item(int,class UnBCL::SmartPtr)", "?set_AutoDeleteValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXH@Z", ".PAVSerializationException@UnBCL@@", "??4?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "<$::Sort(class UnBCL::ArrayList *)", "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", "u9Vj ", "0!131B1S1k1r1", "??1ApplicationException@UnBCL@@UAE@XZ", "?set_Source@Exception@UnBCL@@UAEXPBVString@2@@Z", "void __stdcall UnBCL::Monitor::Exit(class UnBCL::SyncObject *)", "7>8W8", "void __thiscall UnBCL::ArrayList::Resize(int,int)", ":%;2;@;N;\\;j;x;\"<6) const", "??4?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "RaiseException", ">'???e?w?", "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBVString@1@@Z", "?Contains@?$ArrayList@G@UnBCL@@UBEHG@Z", "??0ProcessStartInfo@UnBCL@@QAE@PBVString@1@@Z", "position set before beginning of MemoryStream", "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$SerializableArrayListBase@PAVString@UnBCL@@@_@1@@", "?get_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z", "?get_DefaultLangID@SystemInfo@UnBCL@@QBEGXZ", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "::MoveNext(void)", "627D7V7s7", "??0PathTooLongException@UnBCL@@QAE@PBVString@1@@Z", "261019185142Z0", "2;3`3", "??4InvalidOperationException@UnBCL@@QAEAAV01@$$QAV01@@Z", "394P4s4", "?Contains@?$Array@H@UnBCL@@UBEHH@Z", "?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPAGIPBGH@Z", "??4ApplicationException@UnBCL@@QAEAAV01@$$QAV01@@Z", "6-6?6S6t6", "??_7PathTooLongException@UnBCL@@6B@", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "?Clear@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXXZ", ".?AV?$SerializableArrayListPrimitiveBase@E@_@UnBCL@@", ".?AU?$IEnumerator@PAVString@UnBCL@@@UnBCL@@", "?get_ThreadID@Thread@UnBCL@@QAEKXZ", ">!>*>0>Q>Y>`>f>l>", "?IndexOfAny@String@UnBCL@@SGHPBG0HH@Z", "0%1Q1", "?Dump@Allocator@UnBCL@@SGIPAUILogHandler@@I@Z", "??0Version@UnBCL@@QAE@ABV01@@Z", "??0ObjectDisposedException@UnBCL@@QAE@ABV01@@Z", ">&>H>x>", "int __thiscall UnBCL::ArrayList::IndexOf(unsigned char,int,int) const", "?CreateSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@@Z", "?IndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@HH@Z", ".?AV?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", ".?AU?$IComparer@PAVString@UnBCL@@@UnBCL@@", "??1?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@XZ", "8(8,8D8T8d8h8l8p8t8x8|8", "?get_LineNumber@XmlException@UnBCL@@UAEHXZ", "?Add@XmlNodeList@XmlLite@UnBCL@@IAEXPAVXmlNode@23@@Z", "??4Thread@UnBCL@@QAEAAV01@ABV01@@Z", "??0ApplicationException@UnBCL@@QAE@$$QAV01@@Z", ".PAVArithmeticException@UnBCL@@", ".?AVSerializationId@UnBCL@@", "??1ArgumentException@UnBCL@@UAE@XZ", "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", "void __thiscall UnBCL::StringBuilder::set_Chars(int,unsigned short)", "?UNICODE_CODEPAGE@UnicodeEncoding@UnBCL@@0HB", "??0XmlAttribute@XmlLite@UnBCL@@QAE@ABV012@@Z", "null path or encoding to StreamReader constructor", "??_DOperatingSystem@UnBCL@@QAEXXZ", "??1ArgumentNullException@UnBCL@@UAE@XZ", "SetEvent", "??0?$Array@E@UnBCL@@QAE@PBU?$ICollection@E@1@@Z", "?get_Hours@TimeSpan@UnBCL@@QBEHXZ", "int __thiscall UnBCL::_::ArrayListEnumerator >::MoveNext(void)", "??B?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "class UnBCL::Array *__thiscall UnBCL::RegistryKey::GetValueNames(void)", "Write() on closed FileStream", ";';9;G;|;", "class UnBCL::XmlNode *__thiscall UnBCL::XmlDocument::CreateNode(enum UnBCL::XmlNodeType,class UnBCL::String *,class UnBCL::String *)", "??0XmlNode@UnBCL@@QAE@ABV01@@Z", "??_7?$ArrayList@G@UnBCL@@6B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "?Clear@?$ArrayList@G@UnBCL@@UAEXXZ", "void __thiscall UnBCL::StreamWriter::Write(const class UnBCL::String *,int,int)", "??B?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "??1TimeSpan@UnBCL@@UAE@XZ", "?get_NextSibling@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ", "int __stdcall UnBCL::Monitor::Wait(class UnBCL::SyncObject *)", "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@PAVXmlNamespaceManager@2@@Z", "<(=4=@=L=X=d=", "null key to Hashtable#Remove", "??4IPoolable@UnBCL@@QAEAAU01@$$QAU01@@Z", ":);U;d;", ">,><>@>D>H>L>P>d>h>", "4\"575O5e5", "121D1", "?Append@MutableString@UnBCL@@QAEXG@Z", "747<7D7P7p7x7", "8 8$8(808L8h8l8p8t8x8", "??_7XmlAttribute@XmlLite@UnBCL@@6B@", ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "??_7StreamWriter@UnBCL@@6B@", "??_8?$Array@E@UnBCL@@7B?$SerializableArrayBase@E@_@1@@", "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBG@Z", "7 8W8", "191219011458Z", "?ToString@Exception@UnBCL@@UBEPAVString@2@XZ", "tBUGBUG method not implemented", "??0Stream@UnBCL@@QAE@$$QAV01@@Z", "saw header for panthom object, use ReadPhantomObject method.", "?ReadLine@TextReader@UnBCL@@UAEPAVString@2@XZ", "Canceled: ", "??0InvalidCastException@UnBCL@@QAE@PAVString@1@@Z", "20D0V0", ";$;C;", ".?AVWaitHandle@UnBCL@@", "int __thiscall UnBCL::Array::Add(class UnBCL::XmlLite::XmlNode *)", "??_7?$ArrayList@G@UnBCL@@6B?$IList@G@1@@", "void __thiscall UnBCL::ArrayList::CopyTo(class UnBCL::Array *,int) const", "??4XmlAttribute@UnBCL@@QAEAAV01@$$QAV01@@Z", "??4?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "=8=J=c=", "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(unsigned long)", "?Sort@?$Array@PAVObject@UnBCL@@@UnBCL@@SGXPAV12@@Z", ";$;,;<;D;L;T;d;l;t;|;", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(unsigned int)", "?s_PoolLock@String@UnBCL@@1VObject@2@A", ".?AV?$SmartPtr@U?$IEnumerator@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@@UnBCL@@", "?GetBytes@Encoding@UnBCL@@UBEPAV?$Array@E@2@PBVString@2@HH@Z", "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,int)", "5M6T6", ".?AV?$ArrayListEnumerator@PAVString@UnBCL@@@_@UnBCL@@", "0$0(0,000D0T0X0h0l0", "?ReAlloc@Allocator@UnBCL@@SGPAXPAXKI@Z", "3-3A3f3", "??0NotSupportedException@UnBCL@@QAE@$$QAV01@@Z", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", ".?AV?$SmartPtr@V?$Array@VStringPtr@UnBCL@@@UnBCL@@@UnBCL@@", "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B@", "_initterm", "??4?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "0*090U0g0v0", "3%3C3a3s3", "1'1.151]1j1x1", "?GetDirectorySeparatorChar@Path@UnBCL@@SGGXZ", "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6B@", "?get_NamespaceURI@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ", "??0String@UnBCL@@QAE@PBGHH@Z", "?FlushBuffer@BufferedStream@UnBCL@@AAEXXZ", "??_7?$Stack@H@UnBCL@@6BISerializable@1@@", "??0DateTime@UnBCL@@IAE@_JH@Z", "??_8RegistryKey@UnBCL@@7BIDisposable@1@@", "oK0D$\"<", ".?AV?$SerializableArrayBase@G@_@UnBCL@@", ".rdata$brc", ":#:x:", "int __thiscall UnBCL::UnicodeEncoding::GetMaxByteCount(int) const", "?Dispose@TextReader@UnBCL@@UAEXXZ", "??1HeapMemoryManager@UnBCL@@UAE@XZ", "?_EndsWith@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z", ":):5:A:j:", "void __thiscall UnBCL::XmlDocument::Load(class UnBCL::String *)", "1$141D1T1d1h1x1", "??0InvalidOperationException@UnBCL@@QAE@$$QAV01@@Z", "??_7TextReader@UnBCL@@6BIDisposable@1@@", "??4RegistryKey@UnBCL@@QAEAAV01@ABV01@@Z", "=P=`=l=", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(double)", "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@", "?,?0?H?X?h?l?p?t?x?|?", "?get_NamespaceURI@XmlNode@UnBCL@@QAEPAVString@2@XZ", "1=1B1~1", "?Contains@?$Stack@H@UnBCL@@UBEHH@Z", ":h:w:", " >s>", ".?AU?$ICollection@VStringPtr@UnBCL@@@UnBCL@@", ".?AV?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@", "<$<,<4@>O>s>", "?ToString@DateTime@UnBCL@@UBEPAVString@2@XZ", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "3 383<3@3D3H3L3P3T3h3l3p3t3x3", "NtSetInformationFile", "0&1U1y1", "Exception while moving %s to %s", "?GetTypeName@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", "?!?C?", "&", "7*787", ";U;v;", "?:?W?", "?Clear@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXXZ", "?GetVersionId@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "?MakeSureDirectoryExists@Directory@UnBCL@@SGKPBGPAH@Z", "=1=R=u=", "?StreamWrite@?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", ";C;_;", "000:0", "unable to set value on key", "class UnBCL::SerializationStream::TypeFactoryList *__thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "class UnBCL::String *__stdcall UnBCL::Path::WithLongPrefix(const class UnBCL::String *,int)", "GetSystemTimeAsFileTime", "memset", "20201008071948.152Z0", "??0MutableString@UnBCL@@QAE@GH@Z", "?Dispose@WaitHandle@UnBCL@@AAEXH@Z", "?GetMaxByteCount@UnicodeEncoding@UnBCL@@UBEHH@Z", "CoInitializeEx", "??2Object@UnBCL@@SGPAXII@Z", "??4TextReader@UnBCL@@QAEAAV01@$$QAV01@@Z", "__RTtypeid", "??0MultiSz@UnBCL@@QAE@PBG@Z", "6$64686H6L6P6h6l6", "0.0C0a0", "?LastIndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z", "??0OperatingSystem@UnBCL@@AAE@XZ", "void __thiscall UnBCL::ArrayList::set_Item(int,class UnBCL::XmlLite::XmlNode *)", "??_7?$SerializableArrayBase@H@_@UnBCL@@6B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@", "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "?Combine@Path@UnBCL@@SGPAVString@2@PBV32@0@Z", "negative bucket count to Hashtable constructor", "030R0", "MultiSz element value cannot be empty string", "?get_Item@?$ArrayList@G@UnBCL@@UAEAAGH@Z", "class UnBCL::String *__thiscall UnBCL::String::Insert(int,const unsigned short *) const", "?ExpandEnvironmentVariables@Environment@UnBCL@@SGPAVString@2@PBV32@@Z", "const int &__thiscall UnBCL::Stack::Peek(void) const", "<85S5^5", "\\$ YY", "?Remove@?$Array@E@UnBCL@@UAEXE@Z", "?Peek@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@XZ", "??1?$Stack@PAVObject@UnBCL@@@UnBCL@@UAE@XZ", "?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPAGPBGH@Z", "D$(PS", "??0MutableString@UnBCL@@QAE@ABV01@@Z", "unsigned short __thiscall UnBCL::_::ArrayListEnumerator::get_Current(void) const", " Microsoft Corporation. All rights reserved.", "void __thiscall UnBCL::Array::RemoveAt(int)", "??0?$ArrayList@G@UnBCL@@QAE@XZ", "1'161I1j1", "PWWWWWWW", "?Reallocate@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABUtagVARIANT@@@Z", "?Merge@MultiSz@UnBCL@@QAEXABV12@H@Z", "6#616?6M6[6i6w6", "\"<>|*?:", "5<5s5", "??1?$ICollection@PAVObject@UnBCL@@@UnBCL@@UAE@XZ", ".?AUISerializable@UnBCL@@", "??4?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "9/9`9r9", "=E=W=i=&>C>", "??6SerializationStream@UnBCL@@QAEAAV01@F@Z", ":-:a:s:", ";A$uG9w", "__thiscall UnBCL::Encoding::Encoding(int)", "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@2@@", "?get_Current@FileSystemEnumerator@UnBCL@@UBEPAVString@2@XZ", "?GetEnvironmentVar@Environment@UnBCL@@SGPAVString@2@PBV32@@Z", "?T?f?x?", "set_Position() on closed MemoryStream", "5*5S5", "WriteFile", "1*2C2f2s2", "??4BufferedStream@UnBCL@@QAEAAV01@ABV01@@Z", "void __thiscall UnBCL::ArrayList::Insert(int,unsigned short)", "const class UnBCL::OperatingSystem *__stdcall UnBCL::Environment::GetOSVersion(int)", "?ReverseFind@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHG@Z", "__thiscall UnBCL::DateTime::DateTime(__int64)", ".?AU?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@", "??0FileSystemEnumerator@UnBCL@@QAE@PBG0@Z", "??_D?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@IAEXXZ", "FileVersion", "??0Process@UnBCL@@QAE@ABV01@@Z", "??0OutOfMemoryException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z", "__thiscall UnBCL::OperatingSystem::OperatingSystem(enum UnBCL::PlatformID,unsigned long,enum UnBCL::InstallationType,class UnBCL::Version *)", "void __thiscall UnBCL::ArrayList::Resize(int,int)", "int __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "9$9<9L9P9T9l9|9", "??5SerializationStream@UnBCL@@QAEAAV01@AAN@Z", ".?AV?$SmartPtr@U?$IEnumerator@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@@UnBCL@@", "??6SerializationStream@UnBCL@@QAEAAV01@G@Z", "void __thiscall UnBCL::RegistryKey::DeleteSubKeyTree(const class UnBCL::String *)", "-fQf-", "int __stdcall UnBCL::UnicodeEncoding::SGetChars(const class UnBCL::Array *,int,int,class UnBCL::Array *,int,int)", "??1?$Array@PAVObject@UnBCL@@@UnBCL@@UAE@XZ", "??_7RegSubkeyEnumerator@UnBCL@@6B@", "2K2i2", "int &__thiscall UnBCL::ArrayList::get_Item(int)", "?ShouldEnumerateReparsePoint@Directory@UnBCL@@SGHPBVString@2@@Z", "?get_ValueCount@RegistryKey@UnBCL@@QBEHXZ", "?PulseAll@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z", "??_8UnicodeEncoding@UnBCL@@7B01@@", "void __thiscall UnBCL::XmlDocument::LoadXml(class UnBCL::String *)", "?IndexOf@String@UnBCL@@QBEHPBGH@Z", "?ReadPhantomObject@SerializationStream@UnBCL@@QAEXAAPAVObject@2@@Z", ".?AV?$SmartPtr@U?$IEnumerator@G@UnBCL@@@UnBCL@@", "null buf to BufferedStream#Read", "6&646B6", "=6=Z={=", "??_7?$Array@G@UnBCL@@6B01@@", "?get_TypeName@SerializationId@UnBCL@@QBEPBGXZ", "??4?$SerializableArrayBase@E@_@UnBCL@@QAEAAV012@$$QAV012@@Z", "7&7C7", "?Close@Process@UnBCL@@QAEXXZ", "454@4N4u4", "??_8Delegate@UnBCL@@7B@", "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@HH@Z", "??_7UnicodeEncoding@UnBCL@@6BObject@1@@", "??_7FileStream@UnBCL@@6BObject@1@@", "8 8'8.8g8s8", "invalid platform to OperatingSystem constructor", ".?AU?$IEnumerable@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@", ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "RegCreateKeyExW", "?MAX_MS@TimeSpan@UnBCL@@0_JB", "??_7CaseInsensitiveStringComparer@UnBCL@@6BObject@1@@", "304X4", "??0RegSubkeyEnumerator@UnBCL@@QAE@AAVRegHandle@1@@Z", "??_7Version@UnBCL@@6B?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "?StreamRead@?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", "3*3<3J3c3j3q3", "::GetBuffer(int)", "_UnBCLReleaseResources@0", ".?AVAbandonedMutexException@UnBCL@@", "??1?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", "ix or count out of range to Encoding#GetBytes", "Array doesn't support Insert()", "?IndexOfEndOfLongPrefix@Path@UnBCL@@SGHPBVString@2@@Z", ":!;u;", "??0ObjectDisposedException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "class UnBCL::String *__stdcall UnBCL::Directory::GetLoadedModuleDir(const class UnBCL::String *)", "void __stdcall pGetDirectoriesAndFiles(const class UnBCL::String *,const class UnBCL::String *,enum UnBCL::Directory::EnumerationType,int,class UnBCL::String *,class UnBCL::ArrayList *)", "?get_ChildNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@XZ", "1C1x1", "1$1,141<1D1P1p1x1", ".?AVXmlNodeList@UnBCL@@", "??4?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAU01@ABU01@@Z", "?get_Days@TimeSpan@UnBCL@@QBEHXZ", "373`3i3", "?WithLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@H@Z", "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@PBG@Z", ";(;L;T;X;\\;`;d;l;", "GetWindowsDirectoryW failed", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "9(9,9D9T9X9h9x9|9", "424C4Q4", "??0OutOfMemoryException@UnBCL@@QAE@ABV01@@Z", "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "?GetUnicode@Encoding@UnBCL@@SGPAV12@XZ", ">D?V?h?v?", ":C:_:", "434s4", ")Failed to allocate hard link file path", "??_7?$SerializableArrayBase@E@_@UnBCL@@6BObject@2@@", "<'::Insert(int,class UnBCL::XmlLite::XmlNode *)", ".?AU?$ICollection@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@", "int __thiscall UnBCL::Array::Add(unsigned char)", "class UnBCL::String *__thiscall UnBCL::String::Remove(int,int) const", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "null value to String#StartsWith", "?Equals@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z", "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ", ":5:@:N:u:", "??_7Type@UnBCL@@6B@", "8,9S9t9", ".?AVThread@UnBCL@@", "|CSj ", "__thiscall UnBCL::XmlDocument::XmlDocument(struct IXMLDOMDocument3 *)", "0T0X0`0h0", ".xdata$x", "?Dispose@WaitHandle@UnBCL@@UAEXXZ", "40444D4T4X4\\4t4", "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6BObject@1@@", "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@@Z", "??0CaseInsensitiveStringComparer@UnBCL@@QAE@ABV01@@Z", "?get_Name@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ", "??_DStreamReader@UnBCL@@QAEXXZ", "??4SerializationException@UnBCL@@QAEAAV01@ABV01@@Z", "class UnBCL::Object *&__thiscall UnBCL::Stack::Peek(void)", "??6SerializationStream@UnBCL@@QAEAAV01@H@Z", "attempt to store on non-storing archive", "??4?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAEAAV012@$$QAV012@@Z", "?GetCallingModule@SerializationStream@UnBCL@@SGPAUHINSTANCE__@@XZ", "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@XZ", "?GetSystemDir@Directory@UnBCL@@SGPAVString@2@XZ", "??0XPathException@UnBCL@@QAE@PAVString@1@PAVException@1@J@Z", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(short)", "??4TextWriter@UnBCL@@QAEAAV01@ABV01@@Z", "??D?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEAAVDecoder@1@XZ", "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAE@ABV01@@Z", "131F1]1", "0,000@0P0T0d0t0", "]oB\"y", "3A3q3", "8E9T9", "?ToString@Object@UnBCL@@UBEPAVString@2@XZ", "<85a5z5", "?Match@String@UnBCL@@SGHPBG0@Z", "??4ArithmeticException@UnBCL@@QAEAAV01@$$QAV01@@Z", ";!;3;E;c;", "??_8?$Array@E@UnBCL@@7B@", "?MoveNext@RegSubkeyEnumerator@UnBCL@@UAEHXZ", "?Close@StreamWriter@UnBCL@@IAEXH@Z", " hResult = 0x%x, Line = %d, Position = %d; %s. ", ":8:`:q:", "??4?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "??4StreamCounter@UnBCL@@QAEAAV01@ABV01@@Z", ".?AVNotSupportedException@UnBCL@@", "?Format@String@UnBCL@@SAPAV12@PBGZZ", "VarFileInfo", "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBG@Z", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,class UnBCL::XmlLite::XmlAttribute *,struct UnBCL::IComparer *)", "const struct _WIN32_FIND_DATAW &__thiscall UnBCL::FileSystemEnumerator::get_FindData(void) throw(...)", "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABUtagVARIANT@@@Z", "DeleteCriticalSection", "767|7", ">\">U>", "516q6", "?SetHandler@Logging@UnBCL@@SGXPAUILogHandler@@@Z", "?Reset@FileSystemEnumerator@UnBCL@@UAEXXZ", "5;5`5", "??1ArgumentOutOfRangeException@UnBCL@@UAE@XZ", "??C?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@1@XZ", "?SetMessage@Exception@UnBCL@@MAEXPAVString@2@@Z", "?MAX_KEYNAME_LEN@RegistryKey@UnBCL@@0HB", "??_7FileStream@UnBCL@@6BStream@1@@", "=4>x>", "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B01@@", "??4?$IList@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "class UnBCL::ArrayList *__stdcall UnBCL::Try_Cast*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)", "??_7?$SerializableArrayBase@G@_@UnBCL@@6B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@", "VirtualQuery", "??_8Monitor@UnBCL@@7B@", "yEWj$", "class UnBCL::String *__thiscall UnBCL::String::Replace(const unsigned short *,const unsigned short *,enum UnBCL::String::StringCasing) const", ":1;8;", "0 0]0o0~0", ".?AVMonitor@UnBCL@@", "class UnBCL::String *__stdcall UnBCL::Environment::ExpandEnvironmentVariables(const class UnBCL::String *)", "??0StringPtr@UnBCL@@QAE@XZ", "int __thiscall UnBCL::String::EndsWith(const unsigned short *,int) const", "?get_IsFixedSize@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "??_DCaseInsensitiveStringComparer@UnBCL@@QAEXXZ", "?get_NumLogicalCPU@SystemInfo@UnBCL@@QBEKXZ", "index and count do not denote a valid range of elements in ArrayList#BinarySearch", "??0XmlSchemaSet@UnBCL@@QAE@XZ", "?WriteLine@TextWriter@UnBCL@@UAAXPBGZZ", ".?AVStream@UnBCL@@", "?Subtract@DateTime@UnBCL@@QBE?AVTimeSpan@2@ABV12@@Z", "void __thiscall UnBCL::Array::Remove(class UnBCL::String *)", "5%505x5", "?Clear@?$Array@G@UnBCL@@UAEXXZ", "?Close@RegHandle@UnBCL@@QAEXXZ", "; ;%;R;", "??0ObjectDisposedException@UnBCL@@QAE@XZ", "??_7?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@6B@", "??0Win32Exception@UnBCL@@QAE@KPBGPAVException@1@@Z", ">)?H>W>w>", "??1?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@UAE@XZ", "negative value to Version constructor", "??4ConsoleLogHandler@UnBCL@@QAEAAV01@ABV01@@Z", "4I5l5{5", "int __thiscall UnBCL::String::IndexOf(unsigned short,int) const", "??4?$ICollection@H@UnBCL@@QAEAAU01@$$QAU01@@Z", "u'Sj$", "?Steal@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ", "class UnBCL::Object *const &__thiscall UnBCL::Stack::Peek(void) const", "RegDeleteKeyW", ".?AVSyncObject@UnBCL@@", ".didat$4", "250701214655Z0|1", "void __thiscall UnBCL::Array::InitLarva(class UnBCL::ArrayList *)", "SerializationId::SerializationId: typeName is NULL.", "??1StreamReader@UnBCL@@UAE@XZ", "?get_ComputerName@SystemInfo@UnBCL@@QBEPBVString@2@XZ", "??0?$Array@H@UnBCL@@QAE@HH@Z", "?get_EnumError@RegSubkeyEnumerator@UnBCL@@QAEHXZ", "??_7StreamWriter@UnBCL@@6BIDisposable@1@@", "??4?$ICollection@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "??0ThreadStateException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "?DeAssign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXXZ", "??0MemoryStream@UnBCL@@QAE@ABV01@@Z", ".?AU?$IEnumerable@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@UnBCL@@", "??0String@UnBCL@@QAE@AAVSerializationStream@1@@Z", "3$3,383X3`3h3p3x3", "?InitLarva@?$Array@PAVString@UnBCL@@@UnBCL@@MAEXPAV?$ArrayList@PAVString@UnBCL@@@2@@Z", ".PAVArgumentNullException@UnBCL@@", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "?Add@MultiSz@UnBCL@@QAEXPBG@Z", "??5SerializationStream@UnBCL@@QAEAAV01@AA_J@Z", ".?AV?$KeyCollection@PAVString@UnBCL@@PAV12@@_@UnBCL@@", "?Concat@String@UnBCL@@SGPAV12@PBG00@Z", "??6SerializationStream@UnBCL@@QAEAAV01@J@Z", "?DefaultHigh@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB", "??_7String@UnBCL@@6B@", "6#6B6b6s6", "Seek() before beginning of MemoryStream", "??1ProcessStartInfo@UnBCL@@UAE@XZ", "??4?$IComparer@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", "??0MutableString@UnBCL@@QAE@PBVString@1@@Z", "?MakeLower@MutableString@UnBCL@@QAEXXZ", "??4RegHandle@UnBCL@@QAEAAV01@ABV01@@Z", "<:=L=[=l=", "??0OutOfMemoryException@UnBCL@@QAE@$$QAV01@@Z", "??4OutOfMemoryException@UnBCL@@QAEAAV01@ABV01@@Z", "Washington1", "??6SerializationStream@UnBCL@@QAEAAV01@UEmptyType@MP@1@@Z", "5:5W5", "7-7j7", ";$;D;P;p;|;", "class UnBCL::DictionaryEntry __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "??0ArithmeticException@UnBCL@@QAE@XZ", "u,Vj$", "?GetParentPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z", "??0?$ICollection@E@UnBCL@@QAE@ABU01@@Z", "??0SystemInfo@UnBCL@@QAE@ABV01@@Z", "7(7,707H7X7\\7`7x7|7", "?DeAssign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXXZ", ";HWj ", "??0BufferedStream@UnBCL@@QAE@ABV01@@Z", "?GetHashCode@Object@UnBCL@@UBEHXZ", "attempt to expand buffer in nongrowable MemoryStream", "??0DirectoryInfo@UnBCL@@QAE@XZ", "PQSVW", "??4Registry@UnBCL@@QAEAAV01@ABV01@@Z", "%s: unexpected value type: %S=%lu", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@DH@Z", "=C=U=g=~=", "51585?5g5u5", "file too large--length > INT64_MAX", "?RegisterNamespaces@XmlDocument@UnBCL@@QAEXPAVString@2@@Z", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "Microsoft Corporation", "5'5L5^5p5", "=8>`>", "233G3l3", "class UnBCL::MultiSz *__stdcall UnBCL::MultiSz::FromString(const unsigned short *,unsigned short)", "null key to Hashtable#ContainsKey()", "?SleepFor@Thread@UnBCL@@SGXI@Z", "2)3*4A4H4n4z4", "??0?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAE@ABV012@@Z", "5D6V6e6", "__thiscall UnBCL::ArrayList::ArrayList(int,int)", "void __thiscall UnBCL::StringBuilder::set_Length(int)", "??B?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ", "cannot convert DateTime before 1601 to filetime", "?0?P?", ".PAVExternalException@UnBCL@@", "?get_Capacity@MemoryStream@UnBCL@@UBEHXZ", "?get_NextSibling@XmlNode@UnBCL@@QAEPAV12@XZ", "??_8?$Array@E@UnBCL@@7B?$ICollection@E@1@@", "?$>,>4><>H>h>p>x>", "xmlns=\"%s\"", "7U7s7", "?set_Item@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@0@Z", "??0?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAE@ABV012@@Z", "negative index or count to ArrayList#BinarySearch", "const unsigned char &__thiscall UnBCL::ArrayList::get_Item(int) const", "??4CaseInsensitiveStringComparer@UnBCL@@QAEAAV01@ABV01@@Z", "j\\Xf;", "int __thiscall UnBCL::ArrayList::LastIndexOf(int,int,int) const", ".?AV?$Array@H@UnBCL@@", "> >$>(>,>@>P>T>d>h>|>", "?set_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z", "0/0>0", ">?uVf9V", "??4?$ICollection@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", ">O?`?r?", "null srcpath or destpath to File::MoveEx", "??4FormatException@UnBCL@@QAEAAV01@$$QAV01@@Z", "??1?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAE@XZ", "?get_Chars@StringBuilder@UnBCL@@QBEGH@Z", "int __thiscall UnBCL::_::HTEnumerator::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "??1exception@@UAE@XZ", "8!838B8c8", "1 1$1(1,101D1H1L1d1t1", "??4TextReader@UnBCL@@QAEAAV01@ABV01@@Z", "4$4,444<4D4P4p4x4", "__thiscall UnBCL::MemoryStream::MemoryStream(class UnBCL::Array *,int,int)", "9J9U9c9", "9*989@9E9Y9j9", "int __thiscall UnBCL::ArrayList::LastIndexOf(class UnBCL::Object *,int,int) const", "GetTempPathW", "int __thiscall UnBCL::String::LastIndexOfAny(const unsigned short *,int,int) const", "?Sort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z", "set_Position() on closed FileStream", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ", "?Start@Thread@UnBCL@@QAEXXZ", ".?AV?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@", "?set_Item@?$Array@E@UnBCL@@UAEXHE@Z", "void __thiscall UnBCL::ArrayList >::Insert(int,class UnBCL::SmartPtr)", "?GetManager@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAUIAtlStringMgr@2@XZ", "1 1C1d1k1r1y1", "void __thiscall UnBCL::XmlDocument::RegisterNamespaces(class UnBCL::String *)", ">??N?s?", "?StreamRead@?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", ">P>k>", "?GetFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z", "??_7?$Array@E@UnBCL@@6B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", ".?AU?$IEnumerable@E@UnBCL@@", "9\":_:v:", "?RemoveTail@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ", "??4?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(double &)", "<3<:::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array *,int)", "?Remove@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@@Z", ";$;d;v;", "?CompareTo@DateTime@UnBCL@@QBEHABV12@@Z", "1/161^1i1", "trj\\Zf;", "??1RegHandle@UnBCL@@UAE@XZ", "?get_Version@SerializationId@UnBCL@@QBEHXZ", "negative length to StringBuilder#Length", ":/:p:", "??_7Exception@UnBCL@@6B@", ";R;p;", "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,const class UnBCL::Array *)", "?StreamRead@?$SerializableArrayBase@G@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", "?SetRef@Allocator@UnBCL@@SGXI@Z", "?ToString@StringBuilder@UnBCL@@UBEPAVString@2@XZ", "??1StreamWriter@UnBCL@@UAE@XZ", "??0StreamWriter@UnBCL@@QAE@PAVStream@1@H@Z", "int __thiscall UnBCL::Array::Add(int)", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,unsigned char,struct UnBCL::IComparer *)", ".?AUIHeapMemory@@", "2>2U2", ".?AV?$ArrayListEnumerator@E@_@UnBCL@@", "__thiscall UnBCL::FileStream::FileStream(void *,enum UnBCL::FileAccess)", "}&h >::ArrayList(int,int)", ")null name to SerializationStream::UnregisterType", "??1XmlAttributeCollection@UnBCL@@UAE@XZ", "?MIN_MS@TimeSpan@UnBCL@@0_JB", "??0XmlNodeList@XmlLite@UnBCL@@QAE@ABV012@@Z", "?name@type_info@@QBEPBDXZ", ".didat$7", "??4Encoding@UnBCL@@QAEAAV01@ABV01@@Z", "??4DirectoryInfo@UnBCL@@QAEAAV01@$$QAV01@@Z", "939[9", "<\"=1=;=", "?set_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z", "?SanitizeTypeName@SerializationStream@UnBCL@@SGPAVString@2@ABV32@@Z", "?_LastIndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z", "class UnBCL::XmlLite::XmlNode *const &__thiscall UnBCL::ArrayList::get_Item(int) const", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", "??_7SerializationStream@UnBCL@@6B@", "??4?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "void __thiscall UnBCL::StreamWriter::Flush(void)", "9'9:9n9", "9$909<9X9m9", ".?AU?$ICollection@UUniqueObject@SerializationStream@UnBCL@@@UnBCL@@", "?Construct@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@SAXPAV12@@Z", "GetLineNumber", "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ", "?DefaultBins@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0IB", "??6SerializationStream@UnBCL@@QAEAAV01@K@Z", "?s_Handler@Logging@UnBCL@@0PAUILogHandler@@A", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "?Assign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXPAVVersion@2@@Z", "int __thiscall UnBCL::ArrayList::LastIndexOf(unsigned short,int,int) const", "?MemAllocFailed@Allocator@UnBCL@@SGHXZ", "?GetVersionId@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "void __thiscall UnBCL::Array::InitLarva(class UnBCL::ArrayList *)", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(unsigned char)", "?MS_PER_S@TimeSpan@UnBCL@@0HB", "8%878S8{8", "??1?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", ")null buf to FileStream#Write", "?Nullify@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEAAV12@XZ", "get_Position() on closed FileStream", "??_7?$Array@H@UnBCL@@6B?$SerializableArrayBase@H@_@1@@", "??1SerializationStream@UnBCL@@UAE@XZ", ".?AVInvalidCastException@UnBCL@@", "Flush() on closed BufferedStream", "?get_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z", ".?AVUnicodeEncoding@UnBCL@@", "??_8?$Stack@H@UnBCL@@7B01@@", "??4?$IEnumerable@PBG@UnBCL@@QAEAAU01@$$QAU01@@Z", "?DefaultLow@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB", ".?AVStreamReader@UnBCL@@", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "void __thiscall UnBCL::Hashtable::Add(class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *)", "8(8H8h8", "??1FormatException@UnBCL@@UAE@XZ", "8O8^8k8z8", "??0XmlAttributeCollection@UnBCL@@QAE@PAUIXMLDOMNamedNodeMap@@@Z", ".?AU?$IList@E@UnBCL@@", "838>8N8Y8z8", "??0MutableString@UnBCL@@QAE@XZ", "void __thiscall UnBCL::Array::Remove(int)", " move to ", "?get_IsFixedSize@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ", ":4:8:<:@:D:T:\\:x:", "null stream or encoding to StreamReader constructor", "__CxxFrameHandler3", "_wcsnicmp", ">$>,>4><>D>L>T>\\>d>l>t>|>", "7S7v7", "??_7ThreadStateException@UnBCL@@6B@", ".?AU?$ICollection@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@", "3(3,3<3@3D3H3P3h3x3|3", ".?AV?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@", "1(0&0", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "int __stdcall UnBCL::Directory::IsDirectoryEmpty(const class UnBCL::String *)", "6&757r7", "tuVj$", "??0ObjectDisposedException@UnBCL@@QAE@PBVString@1@@Z", "unsigned long __thiscall UnBCL::RegistryKey::GetValue(const class UnBCL::String *)", "??0SystemException@UnBCL@@QAE@$$QAV01@@Z", ".?AU?$IDictionaryEnumerator@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@", ".?AVFormatException@UnBCL@@", ".PAVOutOfMemoryException@UnBCL@@", "4H4W4v4", "?SetString@?$CSimpleStringT@G$0A@@ATL@@QAEXPBG@Z", "??_7TextReader@UnBCL@@6B@", ".?AV?$Stack@H@UnBCL@@", "??D?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$Array@PAVString@UnBCL@@@1@XZ", "?Assign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXPAVStream@2@@Z", "void __stdcall UnBCL::Monitor::Enter(class UnBCL::SyncObject *)", "??_7?$SerializableArrayBase@E@_@UnBCL@@6BISerializable@2@@", "uCSj$", "?S?t?", "class UnBCL::ArrayList *__stdcall UnBCL::Try_Cast*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)", "void __thiscall UnBCL::Array >::RemoveAt(int)", "int __stdcall UnBCL::ArrayList::IndexOf(const class UnBCL::ArrayList *,unsigned short,int,int)", "?Dispose@RegistryKey@UnBCL@@UAEXXZ", "7R7d7v7", "?get_Count@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "2.2G2b2", "??_7Process@UnBCL@@6BIDisposable@1@@", "??_7XmlException@UnBCL@@6B@", ">(>`>r>", "??0UnicodeEncoding@UnBCL@@QAE@XZ", "Flush() on closed StreamWriter", "void __thiscall UnBCL::ArrayList >::QuickSort(class UnBCL::ArrayList > *,class UnBCL::ArrayList > *,int,int)", "?CheckImplicitLoad@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AAE_NPBX@Z", "??4File@UnBCL@@QAEAAV01@ABV01@@Z", "void __thiscall UnBCL::Array::InitLarva(class UnBCL::ArrayList *)", "CreateFileW", "?get_Type@OperatingSystem@UnBCL@@QBE?AW4InstallationType@2@XZ", "null byteArray to MemoryStream constructor", ".?AVXmlNode@XmlLite@UnBCL@@", "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$ICollection@PAVString@UnBCL@@@1@@", ".?AVUnicodeDecoder@UnicodeEncoding@UnBCL@@", ".?AVXmlDocument@UnBCL@@", "??D?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEAAVEncoding@1@XZ", "empty srcpath or destpath to File::Copy", "?Equals@Version@UnBCL@@UBEHPBVObject@2@@Z", "8\"848", "8E8W8v8", "2;2k2", "const unsigned char *__thiscall UnBCL::ArrayList::GetBuffer(int) const", "??4Monitor@UnBCL@@QAEAAV01@ABV01@@Z", ">0>X>|>", "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@XZ", "=-=Q=t=", "const unsigned short &__thiscall UnBCL::ArrayList::get_Item(int) const", "tASj ", "5+5:5X5j5y5", "??1XmlNode@UnBCL@@UAE@XZ", "444<4D4X4`4h4x4", "??D?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEAAVSerializationStream@1@XZ", ".?AV?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "??6SerializationStream@UnBCL@@QAEAAV01@E@Z", "null name to Environment::SetEnvironmentVar", "4(4:4H4j4~4", "CreateXmlReader", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "??_7?$Array@G@UnBCL@@6B?$IList@G@1@@", "??0ArgumentNullException@UnBCL@@QAE@XZ", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", "int __thiscall UnBCL::UnicodeEncoding::GetBytes(const class UnBCL::String *,int,int,class UnBCL::Array *,int) const", "The delimiter argument cannot be null character", "??_7ASCIIEncoding@UnBCL@@6BObject@1@@", "??4ExternalException@UnBCL@@QAEAAV01@$$QAV01@@Z", "393d3", ">8>@>L>l>t>|>", "int __thiscall UnBCL::StreamReader::Read(void)", "??_7AbandonedMutexException@UnBCL@@6B@", "5$5@5M5p5", "??_7?$SmartPtr@VString@UnBCL@@@UnBCL@@6B@", "??_8?$Array@H@UnBCL@@7B?$SerializableArrayBase@H@_@1@@", "1 191", "class UnBCL::String *__thiscall UnBCL::FileSystemEnumerator::get_CurrentFileName(void) throw(...) const", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(float &)", "s>Vj ", "??0ArgumentNullException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", ":9;x;", "2.2@2O2`2w2", "u{>K?", "?Reverse@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ", "8)9v9", "2<2[2u2", ".?AU?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@", "?Free@Allocator@UnBCL@@SGXPAXI@Z", "??0exception@@QAE@XZ", "null list to ArrayList::Sort", "??0TimeSpan@UnBCL@@QAE@HHHHH@Z", "?CompareTo@DateTime@UnBCL@@UBEHPBVObject@2@@Z", ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAV12@@UnBCL@@", ".PAVArgumentOutOfRangeException@UnBCL@@", "??B?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", ":>:w:", "void __stdcall UnBCL::ArrayList::Sort(class UnBCL::ArrayList *)", "?GetTypeName@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", "=)=^=", ".text$yd", "??1Monitor@UnBCL@@EAE@XZ", "?CreateXmlNode@XmlNode@UnBCL@@SGPAV12@PAUIXMLDOMNode@@@Z", ".CRT$XIAA", "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", ".?AV?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "??_7XPathException@UnBCL@@6B@", "int __stdcall UnBCL::Array::LastIndexOf(const class UnBCL::Array *,unsigned short,int,int)", "??1?$IList@PAVString@UnBCL@@@UnBCL@@UAE@XZ", "?GetHandler@Logging@UnBCL@@SGPAUILogHandler@@XZ", "?LastIndexOf@String@UnBCL@@QBEHG@Z", "??_7OverflowException@UnBCL@@6B@", "??0IDisposable@UnBCL@@QAE@ABU01@@Z", ".?AVMemoryStream@UnBCL@@", ".?AV?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "??_7?$Array@E@UnBCL@@6BISerializable@1@@", "ReleaseSemaphore", "??0ArithmeticException@UnBCL@@QAE@$$QAV01@@Z", "1?2|2", ": ;x;", "??0XmlDocument@UnBCL@@QAE@XZ", "0(1S1X1", "2)2d2}2", "?get_Item@?$Stack@H@UnBCL@@UBEABHH@Z", "&?)VS", "?INVALID_PATH_CHARS@Path@UnBCL@@0VString@2@B", ".?AV?$SmartPtr@U?$IEnumerator@H@UnBCL@@@UnBCL@@", "Seek() before beginning of FileStream", "?IndexOfAny@String@UnBCL@@QBEHPBGH@Z", "?set_Arguments@ProcessStartInfo@UnBCL@@QAEXPBVString@2@@Z", "??0ExternalException@UnBCL@@QAE@PBVString@1@@Z", "??0WaitHandle@UnBCL@@QAE@ABV01@@Z", "?get_TotalDays@TimeSpan@UnBCL@@QBENXZ", "??0IDisposable@UnBCL@@QAE@$$QAU01@@Z", "class UnBCL::", "index out of range to ArrayList#CopyTo", "Microsoft Corporation1&0$", "??_8Mutex@UnBCL@@7BWaitHandle@1@@", ".?AVOperatingSystem@UnBCL@@", "?get_Architecture@OperatingSystem@UnBCL@@QBEKXZ", "?NumBlocksAllocated@HeapMemoryManager@UnBCL@@UAEIXZ", "?ReAllocDbg@Allocator@UnBCL@@SGPAXPAXKPBDHI@Z", ">->C>a>h>o>v>}>", "bad allocation", "??4MultiSz@UnBCL@@QAEAAV01@ABV01@@Z", "?Steal@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEPAVEncoding@2@XZ", "ReleaseSRWLockExclusive", "unable to set environment variable", "??_8StreamWriter@UnBCL@@7B@", "?Truncate@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z", "?get_Position@FileStream@UnBCL@@UBE_JXZ", "?IsValid@Path@UnBCL@@SGHPBG@Z", ":$:,:4:<:H:h:p:|:", "??4?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "NumberOfProcessors", "?get_Item@?$ArrayList@G@UnBCL@@UBEABGH@Z", "saw negative index in stream", "??1Encoding@UnBCL@@UAE@XZ", "??_7?$SerializableArrayBase@G@_@UnBCL@@6B@", "??_7WaitHandle@UnBCL@@6B01@@", "tb9{pt]Wj,", "overflow in SerializationStream#ReadBytes", "startIndex or count out of range to Remove()", "1@1L1", "?Clone@Object@UnBCL@@UBEPAV12@XZ", "?get_Count@?$Stack@H@UnBCL@@UBEHXZ", "??4?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "??1?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ", "?get_FindData@FileSystemEnumerator@UnBCL@@QAEABU_WIN32_FIND_DATAW@@XZ", "?Seek@BufferedStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z", "??0?$IComparer@PAVString@UnBCL@@@UnBCL@@QAE@XZ", ".?AV?$ArrayList@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "?Contains@XmlSchemaSet@UnBCL@@QAEHPAVString@2@@Z", "??1String@UnBCL@@UAE@XZ", "??0String@UnBCL@@QAE@XZ", "?GetDictionaryEnumerator@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$IDictionaryEnumerator@PAVString@UnBCL@@PAV12@@2@XZ", "??0HeapMemoryManager@UnBCL@@QAE@ABV01@@Z", "?$?G?Y?k?y?", "6%6C6g6", "??C?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVSerializationId@1@XZ", "?Wait@Monitor@UnBCL@@SGHPAVSyncObject@2@@Z", "??0HeapMemoryManager@UnBCL@@QAE@XZ", "?set_Counter@Stream@UnBCL@@QAEXPAVStreamCounter@2@@Z", "??0?$IList@PAVString@UnBCL@@@UnBCL@@QAE@XZ", "??0ArgumentException@UnBCL@@QAE@ABV01@@Z", ".?AV?$HTDictEnumBase@H@_@UnBCL@@", "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "??4?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@ABV012@@Z", "?s_Registration@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", ".?AV?$SmartPtr@U?$IEnumerator@PAVObject@UnBCL@@@UnBCL@@@UnBCL@@", "?SetOOMHandler@Allocator@UnBCL@@SGXPAUIOutOfMemoryHandler@@@Z", "??4AbandonedMutexException@UnBCL@@QAEAAV01@ABV01@@Z", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@@Z", "??0Version@UnBCL@@QAE@XZ", "J +J$", "000S0", "2$2,242<2D2L2T2\\2d2p2", "6%7d7", "null chars to ASCIIEncoding#GetByteCount", "637S7Z7a7", "startIndex out of range to IndexOf()", "1T2|3", "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@", ")null collection to ArrayList constructor", "??1OperatingSystem@UnBCL@@UAE@XZ", "0 0(00080D0d0l0x0", "??0SecurityException@UnBCL@@QAE@ABV01@@Z", "??0OverflowException@UnBCL@@QAE@$$QAV01@@Z", "~FVj ", "empty path to Path::GetFullPath", "?GetLogicalDriveNames@Environment@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@XZ", "??0?$Stack@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "?GetBinaryValue@RegistryKey@UnBCL@@QAEPAV?$Array@E@2@PBVString@2@@Z", "source file to File::Move not found", "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z", "?get_LinePosition@XmlException@UnBCL@@UAEHXZ", "??4Mutex@UnBCL@@QAEAAV01@ABV01@@Z", "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$ICollection@H@2@@", "1*181", "0 0004080@0H0`0p0t0x0|0", "717}7", "?_LastIndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z", "null version string to Version constructor", "??0?$IList@H@UnBCL@@QAE@XZ", "class UnBCL::Object **__thiscall UnBCL::ArrayList::GetBuffer(int)", "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "??0?$ArrayList@G@UnBCL@@QAE@PBU?$ICollection@G@1@@Z", "1B2P2^2l2z2", "??0?$SerializableArrayBase@H@_@UnBCL@@QAE@XZ", ")null stream to StreamWriter constructor", "?FromSeconds@TimeSpan@UnBCL@@SG?AV12@N@Z", ">J?u?", "?GetCurrentDir@Directory@UnBCL@@SGPAVString@2@XZ", "int __stdcall UnBCL::MP::OperatorCompare::Compare(unsigned char,unsigned char)", "??4Environment@UnBCL@@QAEAAV01@$$QAV01@@Z", "??4Directory@UnBCL@@QAEAAV01@ABV01@@Z", "??4OverflowException@UnBCL@@QAEAAV01@$$QAV01@@Z", "6$60686P6X6|6", "4P4b4t4", "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "?get_Item@?$Array@H@UnBCL@@UAEAAHH@Z", "??4Directory@UnBCL@@QAEAAV01@$$QAV01@@Z", "??0OperatingSystem@UnBCL@@QAE@ABV01@@Z", "class UnBCL::String *__thiscall UnBCL::_::ArrayListEnumerator::get_Current(void) const", "?GetBuffer@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPBQAVObject@2@H@Z", "int __stdcall UnBCL::ArrayList::BinarySearch(class UnBCL::ArrayList *,int,struct UnBCL::IComparer *)", "210303183038Z0p1", ">(>S>t>{>", "ResumeThread", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(unsigned char &)", "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "int __thiscall UnBCL::String::StartsWith(const unsigned short *,int) const", "t!h@t", "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@", "__thiscall UnBCL::Hashtable::Hashtable(const struct UnBCL::IDictionary *)", "??_8?$Array@G@UnBCL@@7BISerializable@1@@", "?s_Registration@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "??_7OutOfMemoryException@UnBCL@@6B@", "null chars to UnicodeEncoding#GetByteCount", "9(9H9a9f9p9", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABUtagVARIANT@@PAUIAtlStringMgr@1@@Z", "?E?R?X?a?", "__thiscall UnBCL::StringBuilder::StringBuilder(int)", "?DeleteRange@?$ArrayList@G@UnBCL@@AAEXHH@Z", "OriginalFilename", "4!4(4/464=4", ".?AVBufferedStream@UnBCL@@", "Model", "98u;;M", "6D7x7", "<9=B=P=", "= =(=\\=l=x=", "9(9M9_9q9", ".?AVXmlAttributeCollection@UnBCL@@", "7$7<7L7P7T7h7l7p7", "@.reloc", "PPPPPW", "::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array > *,int)", "int __stdcall UnBCL::Path::IndexOfEndOfLongPrefix(const class UnBCL::String *)", "?Steal@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEPAVStream@2@XZ", "get_Position() on closed BufferedStream", "?GetBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QAEPAGH@Z", "6#6-6:6@6|6", ".?AU?$IEnumerable@UUniqueObject@SerializationStream@UnBCL@@@UnBCL@@", "8>8Y8", ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV12@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@2@UKeyTraits@42@$1?RetrieveEntry@42@KG?AV52@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@", "5 5.5<5J5X5f5", "?get_Item@?$Array@H@UnBCL@@UBEABHH@Z", "??0Mutex@UnBCL@@QAE@XZ", "??4?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "8\\t&j", "??0?$SerializableStackBase@H@_@UnBCL@@QAE@XZ", "void __thiscall UnBCL::_::ArrayListEnumerator::Reset(void)", "8'8L8]8f8~8", "??0?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "UnBCL::HeapMemoryManager::InternalFree", "3h4s4", "=h=u=", "?ToMultisz@MultiSz@UnBCL@@SGPAGABU?$ICollection@PAVString@UnBCL@@@2@@Z", "MultiByteToWideChar", "9E9e9k9", "9(:L:l:", "??0UnicodeEncoding@UnBCL@@QAE@ABV01@@Z", "ix, cout, or byteix out of range to ASCIIEncoding#GetBytes", "int __thiscall UnBCL::String::_IndexOf(class UnBCL::SmartPtr,int) const", "null path to Path::WithLongPrefix", "Microsoft Time-Stamp PCA 20100", ">5>S>", "__int64 __thiscall UnBCL::MemoryStream::get_Length(void) const", "_SetRunningFlag@4", "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@0H@Z", "<\"<=<^::TableKey,int,struct UnBCL::Hashtable::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", "??1XmlDocument@UnBCL@@UAE@XZ", "??7?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBE_NXZ", "??_7?$Array@H@UnBCL@@6B?$ICollection@H@1@@", "?Contains@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z", "unable to start thread", "j!Yf;", "int __stdcall UnBCL::Array::LastIndexOf(const class UnBCL::Array *,class UnBCL::Object *,int,int)", ".CRT$XCL", "attempt to delete nonexistent subkey tree", "=<=H=h=t=", "4!5n5", "??4ThreadStateException@UnBCL@@QAEAAV01@ABV01@@Z", "??_8FileSystemEnumerator@UnBCL@@7B@", "??4?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "7#7C7k7", "0$0,0@0P0\\0|0", ".?AU?$IEnumerable@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@", "u&Sj ", "??0RegHandle@UnBCL@@QAE@XZ", "int __thiscall UnBCL::ArrayList::LastIndexOf(class UnBCL::StringPtr,int,int) const", "Type is not comparable", ";$;,;8;@;X;h;", ";(;M;_;q;", ":!:R:s:", "??_7Mutex@UnBCL@@6B@", "4\"4q4", ">7>n>", ".?AVArgumentOutOfRangeException@UnBCL@@", "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "?LoadXml@XmlDocument@UnBCL@@QAEXPAVString@2@@Z", "8D8^8", "0K0g0", "4>5W5", "=5=G=b=l=", "??7?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBE_NXZ", "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6BISerializable@1@@", "?Join@Thread@UnBCL@@QAEXXZ", "VS_VERSION_INFO", "??0?$Array@H@UnBCL@@IAE@XZ", "unable to get DWORD value on key", "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PBGHPAUIAtlStringMgr@1@@Z", "?LeaveSection@SyncObject@UnBCL@@IAEXXZ", "u%f9O", "__thiscall UnBCL::Version::Version(int,int)", "void __thiscall UnBCL::ArrayList::AddRange(const struct UnBCL::ICollection *)", "?Equals@?$Array@E@UnBCL@@UBEHPBVObject@2@@Z", "null keyname to RegistryKey#CreateSubKey", ".?AU?$IEnumerable@PAVSerializationId@UnBCL@@@UnBCL@@", "Array doesn't support Add()", "?IsDirectoryEmpty@Directory@UnBCL@@SGHPBVString@2@@Z", "758w8", "?get_Count@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "?get_AutoDeleteValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ", "4R4v4", "7#8B8c8", "unable to open subkey", "?Dispose@BufferedStream@UnBCL@@UAEXXZ", "?get_P@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@2@XZ", "int __thiscall UnBCL::ArrayList::LastIndexOf(class UnBCL::XmlLite::XmlNode *,int,int) const", "??1RegistryKey@UnBCL@@UAE@XZ", "_wcsncoll", "void __stdcall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array > *,int)", "?Copy@String@UnBCL@@SGPAV12@PBV12@@Z", "1=1`1t1", " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBVString@2@@Z", "0Shtl", "?GetWindowsDir@Directory@UnBCL@@SGPAVString@2@XZ", "?Nullify@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEAAV12@XZ", "?Assign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXPAVDecoder@2@@Z", "??_8StreamWriter@UnBCL@@7BTextWriter@1@@", "??_7?$ArrayList@G@UnBCL@@6BObject@1@@", "?get_ProcessorMaxClock@SystemInfo@UnBCL@@QBEKXZ", "5D5g5", "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$ICollection@PAVString@UnBCL@@@1@@", "unsigned short __thiscall UnBCL::StringPtr::operator [](int) const", "?DeAssign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXXZ", "7 7(70787H7l7t7|7", "j:Xf9F", "6\"6E6", "=M=w=", "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ", "??1FileStream@UnBCL@@UAE@XZ", "DebugBreak", "??_8Process@UnBCL@@7B01@@", "_unlock", "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$ICollection@G@2@@", "tnull value to String#IndexOf", "?StreamWrite@MultiSz@UnBCL@@UBEXAAVSerializationStream@2@@Z", "?Move@File@UnBCL@@SGXPBVString@2@0@Z", "0(0A0H0O0w0", "void __thiscall UnBCL::ArrayList::RemoveAt(int)", ";(;4;T;\\;h;", "4;6l7", "??_7?$Array@H@UnBCL@@6BObject@1@@", "9'929=9I9b9i9p9", "const int &__thiscall UnBCL::ArrayList::get_Item(int) const", "GetLastError", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@E@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "?get_Year@DateTime@UnBCL@@QBEHXZ", ".?AU?$IEnumerator@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@", "?$?4?8?P>e>{>", ":x: ;", "void __thiscall UnBCL::MultiSz::Add(const unsigned short *)", "?$?2?@?N?", "??_7?$Array@G@UnBCL@@6BISerializable@1@@", "?LastIndexOfAny@String@UnBCL@@QBEHPBGHH@Z", "ntdll.dll", "??4Registry@UnBCL@@QAEAAV01@$$QAV01@@Z", "?Subtract@DateTime@UnBCL@@QBE?AV12@ABVTimeSpan@2@@Z", "attempt to set bad MemoryStream position", "7\"7K7", "??0ISerializable@UnBCL@@QAE@ABU01@@Z", ";c;m;z;", "8#9@9h9w9", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,unsigned short,struct UnBCL::IComparer *)", "nbase\\ntsetup\\unbcl\\src\\streamreader.cpp", "?TICKS_PER_H@DateTime@UnBCL@@1_JB", "?GetByteCount@Encoding@UnBCL@@UBEHPBVString@2@@Z", "?get_IsFixedSize@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "7E7Q7", ":c:q:|:", "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "?get_Major@Version@UnBCL@@QBEHXZ", "?Sort@?$ArrayList@G@UnBCL@@SGXPAV12@@Z", "StreamReader::Close throw an Win32Exception", "?get_Root@XmlDocument@XmlLite@UnBCL@@QBEPAVXmlNode@23@H@Z", "?s_Registration@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@0UStaticTypeRegistration@12@A", "<#<*::Insert(int,class UnBCL::String *)", "??0ArgumentException@UnBCL@@QAE@$$QAV01@@Z", "363K3k3", "?*???^?p?", ";4;C;K;n;", "?FixupPath@RegistryKey@UnBCL@@AAEXAAVStringBuilder@2@@Z", "uCVj$", "1(1H1P1X1`1h1t1", "303|3", "WaitForSingleObject", "??0SyncObject@UnBCL@@QAE@ABV01@@Z", "5#6B6", "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z", "656P6g6~6", "??_7OperatingSystem@UnBCL@@6B@", "??1Type@UnBCL@@UAE@XZ", ".?AVSEHException@UnBCL@@", ";3;w;", "3-4<4S4", "??0?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAE@ABV012@@Z", "??4?$IList@E@UnBCL@@QAEAAU01@$$QAU01@@Z", "??_DMonitor@UnBCL@@AAEXXZ", "?get_Capacity@?$ArrayList@G@UnBCL@@UBEHXZ", "index and/or count out of range to ArrayList#IndexOf", "??_DSEHException@UnBCL@@QAEXXZ", "??0XmlDocument@XmlLite@UnBCL@@QAE@ABV012@@Z", "null value to RegistryKey#SetValue", "??1?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UAE@XZ", "?Push@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z", "??0XmlAttribute@UnBCL@@QAE@$$QAV01@@Z", "?'?:?F?N?", "??0Monitor@UnBCL@@QAE@ABV01@@Z", "2,3>3P3c3", "?get_TotalSeconds@TimeSpan@UnBCL@@QBENXZ", "?TrimStart@String@UnBCL@@QBEPAV12@PBG@Z", "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,const class UnBCL::String *,int)", "null path to Path::IndexOfEndOfLongPrefix", "?StreamRead@?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", "??1?$ICollection@E@UnBCL@@UAE@XZ", "??1SecurityException@UnBCL@@UAE@XZ", "?DeleteSubKey@RegistryKey@UnBCL@@QAEXPBVString@2@@Z", ".?AVXmlAttribute@UnBCL@@", "??4StreamReader@UnBCL@@QAEAAV01@ABV01@@Z", "?set_NewLine@TextWriter@UnBCL@@UAEXPBVString@2@@Z", "9,9<9L9P9X9\\9`9d9h9l9p9t9x9|9", "5/6A6c6", ")null list to ArrayList::LastIndexOf", "?DeleteInternal@File@UnBCL@@CGXPBVString@2@@Z", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "??0Win32Exception@UnBCL@@QAE@$$QAV01@@Z", "_wcsicmp", "8D8V8h8", "0*0<0K0", "??_8UnicodeEncoding@UnBCL@@7BEncoding@1@@", "??4Stream@UnBCL@@QAEAAV01@ABV01@@Z", ":(:J:g:", "7$7(787H7L7`7d7|7", ".?AV?$SmartPtr@VStringBuilder@UnBCL@@@UnBCL@@", "??_8?$Array@H@UnBCL@@7B?$IList@H@1@@", "536P6W6^6", "??4?$ICollection@E@UnBCL@@QAEAAU01@ABU01@@Z", "null path to Directory::CreateDirectory", "?WithLongPrefixStd@Path@UnBCL@@SGPAVString@2@PBV32@H@Z", ";0;`;", "?get_IsFixedSize@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "int __thiscall UnBCL::ArrayList >::LastIndexOf(class UnBCL::SmartPtr,int,int) const", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDPAUIAtlStringMgr@1@@Z", ".?AV?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@UnBCL@@", "?CompareTo@Char@UnBCL@@UBEHPBVObject@2@@Z", "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "FindResourceExW", ".?AV?$SmartPtr@U?$IEnumerator@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@@UnBCL@@", "GetLogicalDrives", "?Left@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z", "4 434W4", "??_7?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@6B@", "?get_NewLine@TextWriter@UnBCL@@UBEPBVString@2@XZ", "?InnerList@?$Array@PAVObject@UnBCL@@@UnBCL@@MBEPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ", "unable to get current thread's handle", "int __thiscall UnBCL::Object::CompareTo(const class UnBCL::Object *) const", "?SetEnvironmentVar@Environment@UnBCL@@SGXPBVString@2@0@Z", "class UnBCL::Object *const &__thiscall UnBCL::ArrayList::get_Item(int) const", "??0ArithmeticException@UnBCL@@QAE@PBG@Z", "%s: %s [0x%08X]", "int __stdcall UnBCL::ASCIIEncoding::SGetChars(const class UnBCL::Array *,int,int,class UnBCL::Array *,int)", "?TrimRight@MutableString@UnBCL@@QAEXPBG@Z", "?IndexOf@?$Array@G@UnBCL@@SGHPBV12@GHH@Z", "?DeAssign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXXZ", "MoveToFirstAttribute", "5)52575=5G5Q5a5q5w5", "??1SerializationId@UnBCL@@UAE@XZ", "283Z3q3", "686[6", ">I>d>", "?get_Win32ErrorCode@Win32Exception@UnBCL@@QBEKXZ", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(class UnBCL::SmartPtr &)", ")null array to Array::LastIndexOf", " Microsoft Operations Puerto Rico1", "??0AbandonedMutexException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z", "??_7CaseInsensitiveStringComparer@UnBCL@@6B?$IComparer@PAVString@UnBCL@@@1@@", ">/?o?", "5#5<5c5", "= =$=(=,=0=8=P=T=l=p=", ";#;x;", "8*8C8u8", "3%373c3", "??4?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z", "source and destination for move must have same root", "?FromMultiSzEx@MultiSz@UnBCL@@SG?AV?$SmartPtr@V?$Array@VStringPtr@UnBCL@@@UnBCL@@@2@PBG@Z", "?Load@XmlDocument@XmlLite@UnBCL@@QAEXPAUIStream@@@Z", "?IndexOf@?$Array@E@UnBCL@@SGHPBV12@EHH@Z", "??0FileSystemEnumerator@UnBCL@@QAE@ABV01@@Z", "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B01@@", ".?AV?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@", "2D2h2", "??4SystemInfo@UnBCL@@QAEAAV01@ABV01@@Z", "void __thiscall UnBCL::ArrayList >::Resize(int,int)", "??4Version@UnBCL@@QAEAAV01@ABV01@@Z", "??0ConsoleLogHandler@UnBCL@@QAE@ABV01@@Z", "QQSVW", "int __stdcall UnBCL::String::IndexOfAny(const unsigned short *,const unsigned short *,int,int)", "?Nullify@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEAAV12@XZ", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDH@Z", "??0ArgumentNullException@UnBCL@@QAE@PBVString@1@@Z", "vMVj ", "??0Encoding@UnBCL@@QAE@ABV01@@Z", "class UnBCL::SmartPtr &__thiscall UnBCL::ArrayList >::get_Item(int)", "= =(=0=8=D=L=d=t=", ".text$mn", "void __thiscall UnBCL::_::HTEnumerator::TableKey,int,struct UnBCL::Hashtable::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "??5SerializationStream@UnBCL@@QAEAAV01@AAPBUISerializable@1@@Z", "??_8?$Array@H@UnBCL@@7B@", "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBVString@2@@Z", "4)4/4@4E4c4k4q4v4", "??0Version@UnBCL@@QAE@HHH@Z", "null path to Path::GetShortName", "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@XZ", "8,8=8U8g8", "??0MutableString@UnBCL@@QAE@PBG@Z", ":0:8:@:H:P:\\:|:", "9&:P:[:q:", "__thiscall UnBCL::ArrayList::ArrayList(int,int)", ".?AV?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@", "tJhX+", "?DAYS_TO_MONTH_366@DateTime@UnBCL@@0QBHB", ".?AVSecurityException@UnBCL@@", "const unsigned short *__thiscall UnBCL::RegSubkeyEnumerator::get_Current(void) const", ";,;<;@;X;h;l;p;", "ExitProcess", ".?AV?$Array@PAVObject@UnBCL@@@UnBCL@@", "__thiscall UnBCL::StreamWriter::StreamWriter(class UnBCL::Stream *,class UnBCL::Encoding *,int,int,int)", ".?AVRegistry@UnBCL@@", "class UnBCL::String *__stdcall UnBCL::File::Copy(const class UnBCL::String *,const class UnBCL::String *,int)", "%s: %s Inner Exception: %s", "?GetType@Object@UnBCL@@UBEPAVType@2@XZ", "070V0", "0L0^0p0", ".?AV?$Array@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@", "2\"343F3c3", "__int64 __thiscall UnBCL::FileStream::Seek(__int64,enum UnBCL::SeekOrigin)", ".?AU?$IEnumerable@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@", "?RemoveAt@?$Array@G@UnBCL@@UAEXH@Z", "?CompareTo@TimeSpan@UnBCL@@UBEHPBVObject@2@@Z", "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6BISerializable@2@@", "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@PBG@Z", "??_8MemoryStream@UnBCL@@7BStream@1@@", "1H1k1z1", "6%7+7Z7", "??0?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAE@ABV01@@Z", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "??4Mutex@UnBCL@@QAEAAV01@$$QAV01@@Z", "?s_Registration@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "SetLastError", "class UnBCL::Array *__thiscall UnBCL::Encoding::GetBytes(const class UnBCL::String *,int,int) const", "??4XmlNodeList@UnBCL@@QAEAAV01@ABV01@@Z", "_lock", "void __thiscall UnBCL::String::StreamRead(class UnBCL::SerializationStream &)", "3!3C3d3k3r3", ")ix or count out of range to UnicodeEncoding::GetCharCount", "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$SerializableArrayBase@PAVString@UnBCL@@@_@1@@", "??_7?$Array@G@UnBCL@@6BObject@1@@", ".?AVXmlNamespaceManager@UnBCL@@", "??0Environment@UnBCL@@AAE@XZ", "negative offset or count to FileStream#Read", "?set_Context@SerializationStream@UnBCL@@QAEXPAVObject@2@@Z", "?GetData@?$CSimpleStringT@G$0A@@ATL@@ABEPAUCStringData@2@XZ", ".?AV?$SerializableArrayListPrimitiveBase@H@_@UnBCL@@", "?get_Count@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "??0PathTooLongException@UnBCL@@QAE@ABV01@@Z", "__int64 __thiscall UnBCL::FileStream::get_Position(void) const", "??_7StringPtr@UnBCL@@6B01@@", "?Equals@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z", "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6BObject@1@@", "?Clone@Version@UnBCL@@UBEPAVObject@2@XZ", "8#9<9c9", "index or count out of range to ASCIIEncoding#GetByteCount", "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$IDictionary@PAVString@UnBCL@@PAV12@@1@@", "?get_CanWrite@FileStream@UnBCL@@UBEHXZ", "?get_BiosName@SystemInfo@UnBCL@@QBEPBVString@2@XZ", "?get_Capacity@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "?get_HResult@Exception@UnBCL@@UBEJXZ", "?PrepareWrite2@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z", "1(1?1X1f1", "?get_IsPrintable@String@UnBCL@@QBEHXZ", "1A2T2f2", "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$IList@PAVString@UnBCL@@@1@@", ")WaitForExit() on closed Process instance", "979l9~9", "0N0c0p0", ":D:e:", "?Nullify@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEAAV12@XZ", "?set_Capacity@?$ArrayList@G@UnBCL@@UAEXH@Z", "??0StreamWriter@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@HHH@Z", "tnegative numchars to ASCIIEncoding::GetMaxByteCount", "?Nullify@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEAAV12@XZ", "6#626O6`6o6", "?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPAGPBGH@Z", "434R4s4", "3\"3)303\\3g3u3", "base\\ntsetup\\unbcl\\src\\datetime.cpp", "0 0.0", "TlP0X", "??0Process@UnBCL@@IAE@PAX0@Z", ":#;1;N;x;", "0$0q0~0", "?Concat@String@UnBCL@@SGPAV12@PBG@Z", "?WriteObject@SerializationStream@UnBCL@@IAEXPBUISerializable@2@@Z", "?AddRef@Object@UnBCL@@QAEXXZ", "~AVj ", "121C1Q1", "??0NotSupportedException@UnBCL@@QAE@PBVString@1@@Z", "?GetTemporaryFileName@File@UnBCL@@SGPAVString@2@PBV32@@Z", "??0?$Array@E@UnBCL@@QAE@ABV01@@Z", "??0ExternalException@UnBCL@@QAE@$$QAV01@@Z", "?Steal@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEPAVSerializationStream@2@XZ", "??0SecurityException@UnBCL@@QAE@XZ", "??4Int32Ops@UnBCL@@QAEAAU01@ABU01@@Z", "GetValue", "??_7TextWriter@UnBCL@@6BObject@1@@", "class UnBCL::XmlNode *__stdcall UnBCL::XmlNode::CreateXmlNode(struct IXMLDOMNode *)", "??4ConsoleLogHandler@UnBCL@@QAEAAV01@$$QAV01@@Z", "QSSSSSS", "?ReleaseBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z", "??0?$IEnumerable@G@UnBCL@@QAE@XZ", "::get_Item(int) const", "int __thiscall UnBCL::ArrayList >::BinarySearch(int,int,class UnBCL::SmartPtr,struct UnBCL::IComparer > *)", "??0CaseInsensitiveStringComparer@UnBCL@@QAE@$$QAV01@@Z", "4)5;5M5[5|5", "7;8M8_8m8", "void __thiscall UnBCL::ArrayList::CopyTo(class UnBCL::Array *,int) const", "class UnBCL::Version *__stdcall UnBCL::Try_Cast(struct UnBCL::ISerializable *)", ".?AVMultiSz@UnBCL@@", "??_DRegistryKey@UnBCL@@QAEXXZ", "?get_Item@XmlNodeList@XmlLite@UnBCL@@QAEPAVXmlNode@23@H@Z", ".?AV?$ArrayList@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@", "?ToString@Int32Ops@UnBCL@@SGPAVString@2@H@Z", "??0XmlAttributeCollection@XmlLite@UnBCL@@QAE@ABV012@@Z", "??1?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@UAE@XZ", "?StreamWrite@?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", "?get_P@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVSerializationId@2@XZ", "9,949<9D9L9\\9h9p9", "??0ThreadStateException@UnBCL@@QAE@PBG@Z", "<=::CopyTo(class UnBCL::Array *,int) const", "void __stdcall UnBCL::SerializationStream::RegisterType(const class UnBCL::String *,int,struct HINSTANCE__ *,struct UnBCL::IInstanceFactory *)", "?DeAssign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXXZ", "?get_Message@Exception@UnBCL@@UBEPBVString@2@XZ", "??4SbRegistrationList@UnBCL@@QAEAAV01@ABV01@@Z", "__thiscall UnBCL::Version::Version(int,int,int,class UnBCL::String *)", "?set_ParentNode@XmlNode@XmlLite@UnBCL@@IAEXPAV123@@Z", "??5SerializationStream@UnBCL@@QAEAAV01@AAPAUISerializable@1@@Z", "?RemoveTail@?$ArrayList@G@UnBCL@@UAEXXZ", ".0V0_0", "method called on closed RegistryKey", "?GetMaxByteCount@ASCIIEncoding@UnBCL@@UBEHH@Z", "?get_Length@?$Array@E@UnBCL@@UBEHXZ", "??_7?$Array@G@UnBCL@@6B?$IEnumerable@G@1@@", "?TICKS_PER_MS@DateTime@UnBCL@@1_JB", "8(959Q9s9", "??1XPathException@UnBCL@@UAE@XZ", "CloseHandle", "j\\Xf9D$", "??0XmlAttributeCollection@UnBCL@@QAE@ABV01@@Z", "void __stdcall UnBCL::File::Move(const class UnBCL::String *,const class UnBCL::String *)", ":#:>:P:_:p:", "<(::IndexOf(class UnBCL::StringPtr,int,int) const", "<.<@A>H>g>", "GetFileType", "??_7?$Array@H@UnBCL@@6B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "class UnBCL::XmlLite::XmlAttribute *__thiscall UnBCL::_::ArrayListEnumerator::get_Current(void) const", "class UnBCL::Array *__thiscall UnBCL::RegistryKey::GetBinaryValue(const class UnBCL::String *)", "??0InvalidCastException@UnBCL@@QAE@XZ", "?StreamWrite@?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", "SHELL32.dll", "?get_ParentNode@XmlNode@UnBCL@@QAEPAV12@XZ", "??0?$ICollection@H@UnBCL@@QAE@ABU01@@Z", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(short &)", "??_7XmlNamespaceManager@UnBCL@@6B@", "?Contains@?$Array@G@UnBCL@@UBEHG@Z", "v>Vj ", "141;1B1g1u1", "Microsoft Time-Stamp Service", "??0TextReader@UnBCL@@QAE@XZ", "3'353Y3", "?IsLetter@Char@UnBCL@@SGHG@Z", "?_CompareTo@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z", "?GetBaseException@Exception@UnBCL@@UBEPBV12@XZ", "?GetEnvironmentVars@Environment@UnBCL@@SGPAV?$Hashtable@PAVString@UnBCL@@PAV12@@2@XZ", "4)4\\4i4", "<.<=::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array *,int)", "?Remove@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHG@Z", "int __thiscall UnBCL::UnicodeEncoding::GetByteCount(const class UnBCL::String *,int,int) const", ".rsrc", ".?AVXmlDocument@XmlLite@UnBCL@@", "void __thiscall UnBCL::Array::RemoveAt(int)", "t!h@U", "_wtoi64", "0h0x0", "??0TimeSpan@UnBCL@@QAE@HHH@Z", "7W8}8", ")saw ref to unserialized object", "??0XmlNode@XmlLite@UnBCL@@QAE@W4XmlNodeType@2@PBG111@Z", "void __thiscall UnBCL::Array::Remove(unsigned char)", "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBEPAUIAtlStringMgr@1@@Z", "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEABQAVString@2@H@Z", "??0ArithmeticException@UnBCL@@QAE@PBVString@1@@Z", "?Add@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@0@Z", ".?AVTextWriter@UnBCL@@", "index out of range to StringBuilder#Chars[]", ">+>h>w>", "HeapSize", "?(?X?", "class UnBCL::String *__stdcall UnBCL::Path::GetFullPath(const class UnBCL::String *)", "??4SerializationException@UnBCL@@QAEAAV01@$$QAV01@@Z", "void __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "??4?$IEnumerable@G@UnBCL@@QAEAAU01@$$QAU01@@Z", "void __thiscall UnBCL::ArrayList::set_Item(int,int)", "null array to Hashtable#CopyTo", ".?AVDateTime@UnBCL@@", "?GetBuffer@?$Array@H@UnBCL@@UBEPBHH@Z", "5/5:5?5q5", "1#2s2", "t?Vj$", ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@", "??1SEHException@UnBCL@@UAE@XZ", "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABUtagVARIANT@@@Z", "class UnBCL::Process *__stdcall UnBCL::Process::Start(const class UnBCL::ProcessStartInfo *)", "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@", "invalid UNC path to Directory::CreateDirectory", "?ReAlloc@HeapMemoryManager@UnBCL@@UAEPAXPAXK@Z", "ROOT\\CIMV2", "??_7TimeSpan@UnBCL@@6B@", "?_Insert@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HV32@@Z", "??4?$IEnumerable@E@UnBCL@@QAEAAU01@$$QAU01@@Z", ".?AU?$ICollection@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@UnBCL@@", "TerminateProcess", "??1Mutex@UnBCL@@UAE@XZ", "9)9;9j9", "?IndexOf@?$ArrayList@G@UnBCL@@SGHPBV12@GHH@Z", " 0T0f0u0", "??0Win32Exception@UnBCL@@QAE@KPBVString@1@@Z", "2J2j2r2", "4-4?4N4", "_wcsicoll", "int __thiscall UnBCL::ArrayList::IndexOf(unsigned short,int,int) const", "unable to convert local to UTC filetime", "unable to delete subkey", ">*?>?K?c?t?", "??0?$ICollection@H@UnBCL@@QAE@XZ", "??4MutableString@UnBCL@@QAEAAV01@$$QAV01@@Z", "?DeAssign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXXZ", "_purecall", ";O;z;", "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@D@Z", "[j\\_f;", "WWWWQ", "252b2", "int __thiscall UnBCL::String::IndexOf(const unsigned short *,int) const", "?DeAssign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXXZ", "?Done@Environment@UnBCL@@SGJXZ", ".?AV?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@", "=&=E=c=u=", "unable to get String value on key", "??0?$Stack@PAVObject@UnBCL@@@UnBCL@@QAE@XZ", "void __stdcall UnBCL::ArrayList::Copy(const class UnBCL::ArrayList *,int,class UnBCL::ArrayList *,int,int)", "??0?$SerializableArrayBase@H@_@UnBCL@@QAE@ABV012@@Z", "??1InvalidOperationException@UnBCL@@UAE@XZ", "?get_Count@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ", ".?AVOverflowException@UnBCL@@", ";$::IndexOf(const class UnBCL::Array *,class UnBCL::Object *,int,int)", "?LastIndexOf@?$ArrayList@G@UnBCL@@UBEHGHH@Z", "const class UnBCL::StringPtr &__thiscall UnBCL::ArrayList::get_Item(int) const", ";3;O;", "NumberOfLogicalProcessors", "t!h@f", "===I=", ".?AV?$Array@G@UnBCL@@", "9 9$9(9,9094989<9@9D9H9L9P9d9h9l9p9", "?DeleteValue@RegistryKey@UnBCL@@QAEXPBVString@2@@Z", "606=6`6m6", "%i/%i/%i %02i:%02i:%02i", "?Delete@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHH@Z", "void __thiscall UnBCL::ArrayList::Resize(int,int)", ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@", "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@HH@Z", "?IsLetterOrDigit@Char@UnBCL@@SGHG@Z", "CreateSemaphoreExW", "?get_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UBEABQAVString@2@H@Z", "SizeofResource", ".?AV?$ArrayListEnumerator@H@_@UnBCL@@", "__thiscall UnBCL::StreamWriter::StreamWriter(const class UnBCL::String *,int,class UnBCL::Encoding *,int,int)", "?get_AutoDelete@?$Array@G@UnBCL@@UBEHXZ", ".PAVInvalidOperationException@UnBCL@@", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(int)", "_vscwprintf", ".didat$3", "3\"3C3\\3", ">F>{>", "0 0$0<0@0X0\\0t0x0|0", "int __thiscall UnBCL::SerializationStream::ReadObjectHeader(class UnBCL::Object *&)", "?Steal@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEPAVSerializationId@2@XZ", "??_7?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@6B@", "?get_FileName@ProcessStartInfo@UnBCL@@QBEPBVString@2@XZ", "r~akow", ".?AV?$ArrayList@PAVObject@UnBCL@@@UnBCL@@", "??0ExternalException@UnBCL@@QAE@XZ", "9'9`9r9", "666Y6", "Y::Remove(class UnBCL::String *)", "7*7L7_7", "0,00040L0\\0`0p0t0x0|0", ">#?r?", "??1InvalidCastException@UnBCL@@UAE@XZ", "?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHG@Z", "?m_OSVersion@Environment@UnBCL@@0PAVOperatingSystem@2@A", "?Add@?$ArrayList@G@UnBCL@@UAEHG@Z", "??0?$Array@E@UnBCL@@IAE@XZ", "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV?$CSimpleStringT@G$00@1@@Z", "t-hX+", "GetDepth", "void __thiscall UnBCL::ArrayList::Resize(int,int)", "?Fork@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z", "null buf to MemoryStream#Read", ".?AU?$IEnumerable@VStringPtr@UnBCL@@@UnBCL@@", "??0?$IList@G@UnBCL@@QAE@XZ", "int __thiscall UnBCL::_::ArrayListEnumerator::MoveNext(void)", "060E0", "?BinarySearch@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@PAU?$IComparer@PAVObject@UnBCL@@@2@@Z", "int __thiscall UnBCL::SerializationStream::WritePhantomObject(const class UnBCL::Object *)", "?ToString@String@UnBCL@@UBEPAV12@XZ", "?IsTrackingEnabled@HeapMemoryManager@UnBCL@@QAEHXZ", "6+6=6L6]6t6", "??4Allocator@UnBCL@@QAEAAV01@$$QAV01@@Z", "??_7Delegate@UnBCL@@6B@", "??4SEHException@UnBCL@@QAEAAV01@ABV01@@Z", "?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ", "?Clone@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ", "0#060N0U0\\0c0j0q0", "6)6C6u6", "3)3=3O3c3", "9E9P9^9l9", "??4?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAU01@$$QAU01@@Z", "??5SerializationStream@UnBCL@@QAEAAV01@AAV?$SmartPtr@UISerializable@UnBCL@@@1@@Z", "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@", ".?AU?$IList@H@UnBCL@@", "5?5r5", "5U5d5", "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@XZ", "%s: %s", "PQQVW", "null path to Path::WithLongPrefixUNC", ": :$:<:L:P:h:x:|:", "?SGetCharCount@ASCIIEncoding@UnBCL@@CGHPBV?$Array@E@2@HH@Z", ";-;5;:;N;^;i;", "?Seek@MemoryStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z", "?s_Registered@SerializationStream@UnBCL@@0PAV?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@A", "??0InvalidCastException@UnBCL@@QAE@$$QAV01@@Z", "?_TrimEnd@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z", "??_7ProcessStartInfo@UnBCL@@6B@", "??0Type@UnBCL@@QAE@ABV01@@Z", ".?AV?$SmartPtr@VString@UnBCL@@@UnBCL@@", "j Yf;", "??_7StreamWriter@UnBCL@@6BObject@1@@", "<\"<4::RemoveAt(int)", "?Save@XmlDocument@UnBCL@@QAEXPAVString@2@@Z", "< =Y=r=", "?RegisterVersion@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", ">$>D>L>T>`>", "?Concatenate@?$CSimpleStringT@G$0A@@ATL@@KAXAAV12@PBGH1H@Z", ".?AU?$ICollection@PAVString@UnBCL@@@UnBCL@@", "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@XZ", "?CharToOemA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXXZ", ":;;Z;h;", "> >(>0>8>D>L>d>l>", "?GetAllocLength@?$CSimpleStringT@G$0A@@ATL@@QBEHXZ", "9!989c9", "<3,int) const", "??5SerializationStream@UnBCL@@QAEAAV01@AAG@Z", "9?9j9", "??0DateTime@UnBCL@@QAE@ABV01@@Z", "??0?$ArrayList@G@UnBCL@@QAE@HH@Z", "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z", "?RemoveAt@?$Array@H@UnBCL@@UAEXH@Z", "?LookupNamespace@XmlNamespaceManager@UnBCL@@QAEPAVString@2@PAV32@@Z", "unable to launch process", "??1SyncObject@UnBCL@@UAE@XZ", "?AppendEscapedString@StringBuilder@UnBCL@@QAEPAV12@PBGW4EscapingRules@2@@Z", "??_7?$Array@E@UnBCL@@6B?$SerializableArrayBase@E@_@1@@", ".PAVXPathException@UnBCL@@", "??0SystemException@UnBCL@@QAE@PBVString@1@@Z", "unsigned short *__thiscall UnBCL::ArrayList::GetBuffer(int)", "wOVP9s", "??4?$IList@H@UnBCL@@QAEAAU01@ABU01@@Z", "void __stdcall UnBCL::ArrayList::Sort(class UnBCL::ArrayList *)", "??0Version@UnBCL@@QAE@HH@Z", "?Remove@?$Array@H@UnBCL@@UAEXH@Z", "count out of range in UnicodeEncoding::GetBytes", "1.2j2}2", "?get_Rank@?$Array@G@UnBCL@@UBEHXZ", "9j9|9", "void __thiscall UnBCL::XmlDocument::Save(class UnBCL::String *)", "1 1$1(1/1^1c1", "< =@=p=", "?set_LineNumber@XmlException@UnBCL@@MAEXH@Z", "3 3(383\\3d3l3t3|3", "?CompareTo@String@UnBCL@@UBEHPBVObject@2@@Z", "?ReAllocDbg@HeapMemoryManager@UnBCL@@UAEPAXPBDHPAXK@Z", "2/3A3c3", ":.;5;B;I;W;c;x;", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "??_8Process@UnBCL@@7BIDisposable@1@@", "5 5$5(5,5@5D5T5X5\\5t5", "negative codepage to Encoding constructor", "??4?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAEAAV01@ABV01@@Z", "?GetCharCount@ASCIIEncoding@UnBCL@@UBEHPBV?$Array@E@2@HH@Z", "?CopyTo@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEXPAV?$Array@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@H@Z", "?Dispose@FileStream@UnBCL@@UAEXXZ", "??_8StreamReader@UnBCL@@7B@", "??_8StreamReader@UnBCL@@7BTextReader@1@@", "CoUninitialize", "??_7?$Array@G@UnBCL@@6B?$ICollection@G@1@@", "base\\ntsetup\\unbcl\\src\\fileenum.cpp", "?get_Name@XmlNode@UnBCL@@QAEPAVString@2@XZ", ".?AV?$HTDictEnumBase@PAVString@UnBCL@@@_@UnBCL@@", "6O6+7c:", "?GetTempBuffer@SerializationStream@UnBCL@@QAEAAV?$ArrayList@E@2@H@Z", "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@PAVXmlNamespaceManager@2@@Z", "??0ThreadStateException@UnBCL@@QAE@$$QAV01@@Z", "?s_Registration@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "??1?$SmartPtr@VVersion@UnBCL@@@UnBCL@@UAE@XZ", "??4WaitHandle@UnBCL@@QAEAAV01@ABV01@@Z", "int __thiscall UnBCL::ArrayList::IndexOf(class UnBCL::Object *,int,int) const", ".?AV?$ValueCollection@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@_@UnBCL@@", "=\"=)=0=7=", "int __thiscall UnBCL::ArrayList::IndexOf(class UnBCL::String *,int,int) const", "??4?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAEAAV012@ABV012@@Z", "null keyname to RegistryKey#DeleteSubKey", "??4IndexOutOfRangeException@UnBCL@@QAEAAV01@$$QAV01@@Z", "3*3<3N3p3", "??4Delegate@UnBCL@@QAEAAV01@$$QAV01@@Z", ".tls$", "5,5:5t5", "7 7q7", "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6BISerializable@2@@", "?Equals@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z", "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "??4XmlDocument@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z", ".CRT$XLZ", "??_7?$Array@H@UnBCL@@6B?$IList@H@1@@", "?GetDirectoriesAndFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0W4EnumerationType@12@H@Z", "LoadResource", "?GetBytes@Encoding@UnBCL@@UBEPAV?$Array@E@2@PBVString@2@@Z", "?set_FileName@ProcessStartInfo@UnBCL@@QAEXPBVString@2@@Z", "?Attach@?$CSimpleStringT@G$0A@@ATL@@AAEXPAUCStringData@2@@Z", "Write() on read-only MemoryStream", "?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBGH@Z", ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@", ".?AV?$CSimpleStringT@G$0A@@ATL@@", "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "??7?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBE_NXZ", ".PAVObject@UnBCL@@", "4J4z4", "null path to Path::GetRootLength", "void __thiscall UnBCL::XmlLite::XmlDocument::LoadXml(class UnBCL::String *)", "XPath", ".?AV?$Array@E@UnBCL@@", "void __stdcall UnBCL::ArrayList::Sort(class UnBCL::ArrayList *)", "?GetStringValue@RegHandle@UnBCL@@QAEHPBGAAPAVString@2@@Z", "8)888S8e8t8", "?GetTempPathName@Directory@UnBCL@@SGPAVString@2@XZ", "null chars to ASCIIEncoding::GetString", "1 1-1s1", "\"%s\" %s", ";0;X;", "?set_UseShellExecute@ProcessStartInfo@UnBCL@@QAEXH@Z", "??0?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "5(585<5@5X5h5l5|5", "?get_CanWrite@MemoryStream@UnBCL@@UBEHXZ", "??_7?$ArrayList@G@UnBCL@@6BISerializable@1@@", "<\"<0::get_Item(int)", ".?AV?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@", "3#4<4c4", "2!232E2c2", "?Insert@?$Array@H@UnBCL@@UAEXHH@Z", "attempt to set negative FileStream position", ".?AU?$IEnumerator@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@UnBCL@@", ":^:t:", "= =,=L=X=|=", "??1BufferedStream@UnBCL@@UAE@XZ", "?ToUpper@String@UnBCL@@QBEPAV12@XZ", "1(161D1R1", "3 3034383<3P3`3d3|3", ".?AVDelegate@UnBCL@@", "?_Compare@String@UnBCL@@SGHV?$SmartPtr@VString@UnBCL@@@2@0H@Z", "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@G@Z", "8%9O9", ".?AV?$ArrayList@PAVString@UnBCL@@@UnBCL@@", ".?AV?$ArrayList@G@UnBCL@@", "??_8Thread@UnBCL@@7B@", "8h8z8", "6$666E6V6", ">8>\\>s>", ";H<[::Sort(class UnBCL::Array *)", "?GetByteCount@ASCIIEncoding@UnBCL@@UBEHPBVString@2@HH@Z", "??0?$IEnumerable@H@UnBCL@@QAE@XZ", "??1PathTooLongException@UnBCL@@UAE@XZ", "132P2j2r2w2", "<%::InitLarva(class UnBCL::ArrayList *)", "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6BObject@1@@", "?get_AutoDeleteKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ", "WaitForSingleObject failed in Thread::Join", "const class UnBCL::Exception *__thiscall UnBCL::Exception::GetBaseException(void) const", "?InnerList@?$Stack@H@UnBCL@@MBEABQAV?$ArrayList@H@2@XZ", "void __thiscall UnBCL::Array::Insert(int,class UnBCL::XmlLite::XmlNode *)", "4l5~5", "??1ThreadStateException@UnBCL@@UAE@XZ", "??0IInstanceFactory@UnBCL@@QAE@ABU01@@Z", "void __thiscall UnBCL::MemoryStream::set_Capacity(int)", "%s: %s failed", "??3Object@UnBCL@@SGXPAX@Z", "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXPBG@Z", "??_7?$SmartPtr@VVersion@UnBCL@@@UnBCL@@6B@", "??_7XmlAttribute@UnBCL@@6B@", "??_7MultiSz@UnBCL@@6BObject@1@@", ">,>0>@>D>T>X>h>l>", "??0Monitor@UnBCL@@AAE@XZ", "??_7TextReader@UnBCL@@6BObject@1@@", "void __thiscall UnBCL::Array::InitLarva(class UnBCL::ArrayList *)", "?Open@RegHandle@UnBCL@@QAEHPAUHKEY__@@PBGK@Z", ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@@UnBCL@@", "??_7SystemException@UnBCL@@6B@", "2<3h3", ".?AU?$IList@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@", "const class UnBCL::String *__stdcall UnBCL::String::Intern(const class UnBCL::String *)", "?get_Count@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ", "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@H@Z", ".?AV?$SmartPtr@V?$Array@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@", ">,?Y?^?", ": :0:4:8:L:P:T:l:p:t:|:", "null value to String#EndsWith", "??_D?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEXXZ", "??4?$IEnumerable@E@UnBCL@@QAEAAU01@ABU01@@Z", "?AddRange@?$ArrayList@G@UnBCL@@UAEXPBU?$ICollection@G@2@@Z", "?GetStackTrace@Exception@UnBCL@@QBEPAVString@2@XZ", "??1IPoolable@UnBCL@@UAE@XZ", "?set_Position@FileStream@UnBCL@@UAEX_J@Z", ":$:,:4:<:D:P:p:x:", "?GetString@Encoding@UnBCL@@UBEPAVString@2@PBV?$Array@E@2@@Z", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive(unsigned __int64 &)", "??_8BufferedStream@UnBCL@@7BIDisposable@1@@", "=O>b>z>", "??0AbandonedMutexException@UnBCL@@QAE@$$QAV01@@Z", "?Add@?$Array@G@UnBCL@@UAEHG@Z", "??1?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ", "EnterCriticalSection", ">M?_?q?", "??0StreamCounter@UnBCL@@QAE@XZ", "path too long on Win9x", "void __stdcall UnBCL::Array::Sort(class UnBCL::Array *)", "7\"7-7_7j7w7", "??0FileStream@UnBCL@@QAE@PAXW4FileAccess@1@@Z", "class UnBCL::XmlLite::XmlNode *__thiscall UnBCL::_::ArrayListEnumerator::get_Current(void) const", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@", "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6BObject@2@@", "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHI@Z", "919C9U9s9", "void __stdcall UnBCL::Path::CheckInvalidPathChars(const class UnBCL::String *)", "??0StringBuilder@UnBCL@@QAE@H@Z", "=?=l=", "??4?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "?GetDecoder@UnicodeEncoding@UnBCL@@UBEPAVDecoder@2@XZ", "??1?$IList@G@UnBCL@@UAE@XZ", "??C?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@1@XZ", ">'>6>S>q>", "404<4\\4h4", "?get_NumCPU@SystemInfo@UnBCL@@QBEKXZ", "YYf90u", "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ", "UnBCL::HeapMemoryManager::InternalValidatefailed", "?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@2@XZ", "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@", "::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,class UnBCL::String *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable *,class UnBCL::Array *,int)", "??0StreamWriter@UnBCL@@QAE@PBVString@1@HPAVEncoding@1@HH@Z", ".?AV?$SmartPtr@VObject@UnBCL@@@UnBCL@@", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "GetEnvironmentStringsW", "535O5x5", "051M1", "?get_AutoDelete@?$Array@H@UnBCL@@UBEHXZ", "?BlocksAllocated@Allocator@UnBCL@@SGII@Z", "??0Decoder@UnBCL@@QAE@ABV01@@Z", "?InitLarva@?$Array@PAVObject@UnBCL@@@UnBCL@@MAEXPAV?$ArrayList@PAVObject@UnBCL@@@2@@Z", "tstartIndex or count out of range to LastIndexOf()", "RtlGetVersion", "??_7Monitor@UnBCL@@6B@", "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7BISerializable@1@@", "0 121C1X1_1f1m1", "?Read@MemoryStream@UnBCL@@UAEHPAEHH@Z", "?GetBuffer@MemoryStream@UnBCL@@UAEPAV?$Array@E@2@XZ", "semaphore release failed", "null ascii to String::FromASCII", "?get_Context@SerializationStream@UnBCL@@QBEPAVObject@2@XZ", "?get_Length@String@UnBCL@@QBEHXZ", "vswprintf_s", "?get_IsEmpty@String@UnBCL@@QBEHXZ", "??_7DirectoryInfo@UnBCL@@6B@", "=S=p=w=", "??0NotSupportedException@UnBCL@@QAE@XZ", "LegalCopyright", "??0XmlAttribute@UnBCL@@QAE@PAUIXMLDOMNode@@@Z", "?AppendChar@?$CSimpleStringT@G$0A@@ATL@@QAEXG@Z", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "HeapCompact", "??0?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@XZ", "Y__^[", "??_D?$Array@E@UnBCL@@QAEXXZ", "?IndexOf@?$Array@H@UnBCL@@SGHPBV12@HHH@Z", "??0XmlAttribute@XmlLite@UnBCL@@QAE@PBG000@Z", "null value to StringBuilder#Append", "??C?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@1@XZ", "?Resize@?$ArrayList@G@UnBCL@@UAEXHH@Z", "towlower", "unable to SetSize on FileStream", "GetWindowsDirectoryW", "??1XmlAttribute@UnBCL@@UAE@XZ", "?get_Platform@OperatingSystem@UnBCL@@QBE?AW4PlatformID@2@XZ", "?0N0^0", "?0?c?", ";3;O;x;", "??_8SEHException@UnBCL@@7B@", "SetFileInformationByHandle", "8!8K8]8l8", "??0OutOfMemoryException@UnBCL@@QAE@XZ", "t,Vj$", "int &__thiscall UnBCL::Stack::Peek(void)", "|hK,_", "5L5^5m5", ".?AVIndexOutOfRangeException@UnBCL@@", "?set_ValidateOnParse@XmlDocument@UnBCL@@QAEXH@Z", "?EndsWith@String@UnBCL@@QBEHPBGH@Z", ".?AVCAtlException@ATL@@", "??0?$Array@H@UnBCL@@QAE@ABV01@@Z", "6#7t7", "int __stdcall UnBCL::ArrayList::BinarySearch(class UnBCL::ArrayList *,unsigned short,struct UnBCL::IComparer *)", "??_7?$Array@H@UnBCL@@6B01@@", ")null path or encoding to StreamWriter constructor", "??_7?$SerializableStackBase@H@_@UnBCL@@6B@", "5C5u5", "null stream to SerializationStream constructor", "??0SerializationId@UnBCL@@QAE@PAVString@1@H@Z", "2(373a3", "??_7?$SerializableStackBase@H@_@UnBCL@@6BISerializable@2@@", "?set_AutoDeleteKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXH@Z", "__thiscall UnBCL::FileStream::FileStream(const class UnBCL::String *,enum UnBCL::FileMode,enum UnBCL::FileAccess,enum UnBCL::FileShare,unsigned long)", "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "__thiscall UnBCL::Version::Version(int,int,int)", "?RegisterVersion@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", "source file to File::MoveEx not found", "??0ExternalException@UnBCL@@QAE@ABV01@@Z", "1$1`1}1", "=0=<=c=", "606T6", "??0ApplicationException@UnBCL@@QAE@PBG@Z", "RegOpenKeyExW", "Microsoft Corporation1)0'", "??_7MultiSz@UnBCL@@6B?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@1@@", "?Enter@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z", "arm64", "LoadLibraryExA", "<5=@=N=x=", "empty old string to String#Replace", "sort failed -- bad comparison routines?", "RegDeleteKeyExW", "> >/>Y>k>z>", "null srcpath or destpath to Directory::Move", "int __stdcall UnBCL::ArrayList::IndexOf(const class UnBCL::ArrayList *,class UnBCL::String *,int,int)", "??_8RegistryKey@UnBCL@@7B01@@", ".?AV?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "??B?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "GetCurrentThread", "??_7HeapMemoryManager@UnBCL@@6B@", ".data$brc", "4*4O4a4s4", "CoCreateInstance", "void __thiscall UnBCL::ArrayList::QuickSort(class UnBCL::ArrayList *,class UnBCL::ArrayList *,int,int)", "Microsoft Time-Stamp PCA 2010", "??0MemoryStream@UnBCL@@QAE@PAV?$Array@E@1@HH@Z", "?GetLoadedModuleDir@Directory@UnBCL@@SGPAVString@2@PBV32@@Z", ".?AV?$ArrayListEnumerator@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@_@UnBCL@@", "Legal_Policy_Statement", "?Clear@?$Array@H@UnBCL@@UAEXXZ", "__int64 __thiscall UnBCL::MemoryStream::get_Position(void) const", "class UnBCL::ArrayList *__stdcall UnBCL::Try_Cast*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)", "?_StartsWith@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z", "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBG@Z", "?GetDefault@Encoding@UnBCL@@SGPAV12@XZ", "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$IList@PAVString@UnBCL@@@1@@", ".?AV?$SmartPtr@V?$ArrayList@VStringPtr@UnBCL@@@UnBCL@@@UnBCL@@", "?Append@StringBuilder@UnBCL@@QAEPAV12@GH@Z", "??1?$IEnumerator@PAVString@UnBCL@@@UnBCL@@UAE@XZ", "?IndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z", "null value to String#LastIndexOf", "?get_Minutes@TimeSpan@UnBCL@@QBEHXZ", "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::SelectSingleNode(class UnBCL::String *)", "?Add@?$Array@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z", "3C3_3", "int __thiscall UnBCL::Hashtable::ContainsKey(class UnBCL::String *) const", "SetUnhandledExceptionFilter", "8$8(888H8L8d8h8l8p8t8x8", "??0AbandonedMutexException@UnBCL@@QAE@PBG@Z", "??0IInstanceFactory@UnBCL@@QAE@$$QAU01@@Z", "4(4,4<4@4P4T4X4\\4`4d4x4|4", "class UnBCL::RegistryKey *__thiscall UnBCL::RegistryKey::CreateSubKey(const class UnBCL::String *)", "??0ArgumentException@UnBCL@@QAE@XZ", "2@2d2", ".PAVException@UnBCL@@", "?set_AutoDelete@?$Array@E@UnBCL@@UAEXH@Z", "??0SerializationStream@UnBCL@@QAE@PAVStream@1@W4Mode@01@PAVObject@1@@Z", "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$SerializableArrayBase@PAVString@UnBCL@@@_@1@@", "?Reset@StringBuilder@UnBCL@@QAEXXZ", "7F8^8s8", "?set_Capacity@MemoryStream@UnBCL@@UAEXH@Z", "9$9,9094989<9L9T9p9", "GetComputerNameW", "??0?$IList@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "6$6+616;6J6R6^6c6i6x6", "??_8RegHandle@UnBCL@@7B@", "??0SerializationId@UnBCL@@QAE@ABV01@@Z", "?get_IsReadOnly@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ", "0C1d1k1r1y1", ".?AV?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@", "?$?,?8?X?`?l?t?", "?get_Keys@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$ICollection@PAVString@UnBCL@@@2@XZ", ".?AUILogHandler@@", "??0SecurityException@UnBCL@@QAE@PAVString@1@@Z", "?InvokeOOMHandler@Allocator@UnBCL@@SGXK@Z", "??4XmlNamespaceManager@UnBCL@@QAEAAV01@ABV01@@Z", "?GetInvalidPathChars@Path@UnBCL@@SGPBVString@2@XZ", "?Clone@String@UnBCL@@UBEPAVObject@2@XZ", "wcsrchr", "??1XmlException@UnBCL@@UAE@XZ", ".text", "!w(^_", "?set_Length@StringBuilder@UnBCL@@QAEXH@Z", "838R8", "4(5C5c5", "Caption", "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z", "null array argument to ArrayList#CopyTo", "UnBCL::RegHandle::GetStringInternal", "void __thiscall UnBCL::XmlSchemaSet::Add(class UnBCL::String *,class UnBCL::XmlDocument *)", "?DAYS_TO_1601@DateTime@UnBCL@@0HB", "3(3>3a3", "int *__thiscall UnBCL::ArrayList::GetBuffer(int)", "??_7XmlNode@UnBCL@@6B@", "404G4", "t!hP<", "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "10.0.19041.572", "=>U>t>", "class UnBCL::StringPtr &__thiscall UnBCL::ArrayList::get_Item(int)", "??0PathTooLongException@UnBCL@@QAE@PBG@Z", "HeapAlloc", "const class UnBCL::SmartPtr &__thiscall UnBCL::ArrayList >::get_Item(int) const", "?ToLower@Char@UnBCL@@SGGG@Z", "??_7?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@6B@", "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@XZ", "??_7UnicodeEncoding@UnBCL@@6BEncoding@1@@", "?GetObjectID@Object@UnBCL@@UBEIXZ", "=#=2=J=x=", "??0?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAE@XZ", "?GetEnumerator@?$Stack@H@UnBCL@@UBEPAU?$IEnumerator@H@2@XZ", ";u;", "t0j!Yf;", "??B?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ", "8'828@8", "void __thiscall UnBCL::XmlLite::XmlDocument::Load(class UnBCL::String *)", "?InsertAfter@XmlNode@UnBCL@@QAEPAV12@PAV12@0@Z", "1 1$1<1L1P1T1l1|1", "??4?$SerializableArrayBase@E@_@UnBCL@@QAEAAV012@ABV012@@Z", "?set_InnerText@XmlNode@UnBCL@@QAEXPAVString@2@@Z", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "??4?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", ".?AU?$IDictionary@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@", "QSVWh", "?Copy@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPBV12@HPAV12@HH@Z", "5<5A5V5o5", "WWWSWWWW", "??_7Thread@UnBCL@@6B@", "??0?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "??0?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z", "??4ArithmeticException@UnBCL@@QAEAAV01@ABV01@@Z", "?Clear@?$Stack@H@UnBCL@@UAEXXZ", "8@8p8", ".?AVApplicationException@UnBCL@@", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "<,::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable::RetrieveKey(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::Reset(void)", "??_7?$SerializableArrayBase@H@_@UnBCL@@6BObject@2@@", "SELECT * FROM Win32_bios", "??_8Mutex@UnBCL@@7B@", "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B01@@", ".PAVXmlException@UnBCL@@", "base\\ntsetup\\unbcl\\src\\thread.cpp", "??0exception@@QAE@ABV0@@Z", "RegCloseKey", "root of directory to create not found", "int __thiscall UnBCL::ASCIIEncoding::GetByteCount(const class UnBCL::String *,int,int) const", "?Reset@RegSubkeyEnumerator@UnBCL@@UAEXXZ", "??0AbandonedMutexException@UnBCL@@QAE@ABV01@@Z", "?GetBuffer@?$ArrayList@G@UnBCL@@UAEPAGH@Z", " Microsoft Operations Puerto Rico1&0$", "2(2H2P2X2`2l2", "?Assign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXPAV?$Array@E@2@@Z", "??_DFileSystemEnumerator@UnBCL@@QAEXXZ", "?s_OOMHandler@Allocator@UnBCL@@0PAUIOutOfMemoryHandler@@A", "?RegisterVersion@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", ".?AVSerializationStream@UnBCL@@", "?get_SubKeyCount@RegistryKey@UnBCL@@QBEHXZ", "??4NotSupportedException@UnBCL@@QAEAAV01@ABV01@@Z", "?ReadBytes@SerializationStream@UnBCL@@QAEXPAEH@Z", "GetModuleFileNameW", "< <6<\\ >::Insert(int,class UnBCL::SmartPtr)", "int __thiscall UnBCL::Process::WaitForExit(int)", "GetFileSize", "?get_IsLoading@SerializationStream@UnBCL@@QBEHXZ", "??0ThreadStateException@UnBCL@@QAE@PBVString@1@@Z", "void __thiscall UnBCL::ArrayList >::RemoveAt(int)", "7'787=7t7", "??_7?$Stack@H@UnBCL@@6B?$IEnumerable@H@1@@", "null envVarName to Environment::IsEnvironmentVarSetTrue", "?set_Schemas@XmlDocument@UnBCL@@QAEXPAVXmlSchemaSet@2@@Z", ":(:,:<:@:D:H:P:h:x:|:", "??_D?$Array@H@UnBCL@@QAEXXZ", "?GetEnumerator@?$Array@G@UnBCL@@UBEPAU?$IEnumerator@G@2@XZ", "3-3r3", ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@", ">H?Q?d?}?", ".?AU?$IEnumerator@PAVObject@UnBCL@@@UnBCL@@", "CoSetProxyBlanket", "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@XZ", ">X>|>", "?AddDictionary@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@AAEXPBU?$IDictionary@PAVString@UnBCL@@PAV12@@2@@Z", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "??0ASCIIEncoding@UnBCL@@QAE@$$QAV01@@Z", "?get_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z", "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@PAVStream@1@@Z", "void __stdcall UnBCL::Directory::Move(const class UnBCL::String *,const class UnBCL::String *)", "8+9=9O9~9", "insufficient space available in target array", ".?AVexception@@", "int __stdcall UnBCL::MP::OperatorCompare::Compare(int,int)", ".data", "XmlLite.dll", "?CanRegister@SerializationStream@UnBCL@@SGHXZ", "::BinarySearch(int,int,class UnBCL::String *,struct UnBCL::IComparer *)", "232Q2X2_2f2m2t2", ".?AV?$HTDictEnumBase@UUniqueObject@SerializationStream@UnBCL@@@_@UnBCL@@", "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", "??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "?ToString@MultiSz@UnBCL@@UBEPAVString@2@XZ", "?Interval@TimeSpan@UnBCL@@CG?AV12@NH@Z", "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B@", "?GetVersionId@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ", "root of destination path does not exist", "??_8OperatingSystem@UnBCL@@7BISerializable@1@@", "?LastIndexOf@?$Array@H@UnBCL@@SGHPBV12@HHH@Z", "__thiscall UnBCL::XmlDocument::XmlDocument(void)", "void __thiscall UnBCL::ArrayList::Insert(int,class UnBCL::Object *)", "8#8>8C8", "> >$>(>,>0>8>P>T>l>|>", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "unable to get file position", "overflow: unable to convert time to ticks", "??0?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@XZ", "??1MemoryStream@UnBCL@@UAE@XZ", "class UnBCL::String *__stdcall UnBCL::Path::GetShortName(const class UnBCL::String *)", "const unsigned short *__thiscall UnBCL::ArrayList::GetBuffer(int) const", "?Load@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z", "=3>a>", "(080_0f0", "??1?$IList@PAVObject@UnBCL@@@UnBCL@@UAE@XZ", "4#5<5c5", "?Delete@Directory@UnBCL@@SGXPBVString@2@H@Z", "?ToString@Type@UnBCL@@UBEPAVString@2@XZ", "GetCurrentProcessId", "??0?$IEnumerable@PBG@UnBCL@@QAE@XZ", ":#;l;~;", "30@0c0", "8<8`8", "?MakeUpper@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ", "??0ASCIIEncoding@UnBCL@@QAE@XZ", "int __thiscall UnBCL::_::HTEnumerator::TableKey,int,struct UnBCL::Hashtable::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,int,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "229879+4583610", "null chars to Encoding#GetBytes", "?Contains@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHQAVObject@2@@Z", ".idata$4", "GetModuleFileNameW failed", "?Add@XmlAttributeCollection@XmlLite@UnBCL@@IAEXPAVXmlAttribute@23@@Z", "<3<9<@<>O>^>", "??0Exception@UnBCL@@QAE@PBG@Z", "t,Vj ", "?Compare@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z", "RVVVV", "?ToString@Version@UnBCL@@UBEPAVString@2@XZ", "?Write@StreamWriter@UnBCL@@UAEXPBVString@2@HH@Z", ";c::Remove(class UnBCL::SerializationId *)", "Rich}", "??7?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBE_NXZ", ":';Q;", "??1?$SerializableStackBase@H@_@UnBCL@@UAE@XZ", "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B?$IList@PAVObject@UnBCL@@@1@@", "class UnBCL::String **__thiscall UnBCL::ArrayList::GetBuffer(int)", "??4?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z", "__thiscall UnBCL::ArrayList::ArrayList(const struct UnBCL::ICollection *)", "??0CaseInsensitiveStringComparer@UnBCL@@QAE@XZ", "?GetValue@?$Array@G@UnBCL@@UBEGH@Z", "?get_Rank@?$Array@H@UnBCL@@UBEHXZ", "_CxxThrowException", "?Copy@File@UnBCL@@SGPAVString@2@PBV32@0H@Z", "??1RegSubkeyEnumerator@UnBCL@@UAE@XZ", "??0XmlAttributeCollection@UnBCL@@IAE@XZ", "null buf to MemoryStream#Write", "??0Exception@UnBCL@@QAE@PBVString@1@PAV01@@Z", "2H2l2", "??0Type@UnBCL@@IAE@PAVString@1@@Z", "class UnBCL::SmartPtr __thiscall UnBCL::_::ArrayListEnumerator >::get_Current(void) const", "?Append@MutableString@UnBCL@@QAEXPBG@Z", "sFVj$", "7G7V7s7", "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXABV12@@Z", "Current retrieved on enumerator after last MoveNext()", "525W5o5", "S,_^[", "?RegisterVersion@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@MBEXH@Z", "?get_ObjectID@SerializationStream@UnBCL@@QBEPBVSerializationId@2@XZ", "??4?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", "?get_Ticks@DateTime@UnBCL@@QBE_JXZ", "??0?$SerializableArrayBase@G@_@UnBCL@@QAE@ABV012@@Z", "??0TextReader@UnBCL@@QAE@$$QAV01@@Z", "??0ArgumentNullException@UnBCL@@QAE@ABV01@@Z", "U0S0Q", "??0?$ArrayList@G@UnBCL@@AAE@ABV01@@Z", "?CompareTo@Version@UnBCL@@UBEHPBVObject@2@@Z", "??0StreamReader@UnBCL@@QAE@PBVString@1@PAVEncoding@1@@Z", "??_7Process@UnBCL@@6B@", "negative size to ArrayList#Resize()", "?Dump@HeapMemoryManager@UnBCL@@UAEIPAUILogHandler@@@Z", "9H:U:m:x:", ".PAVSystemException@UnBCL@@", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(long)", "7<7m7z7", "?InitTerm@Allocator@UnBCL@@SGXH@Z", "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$ArrayList@PAVString@UnBCL@@@1@@Z", ".?AU?$IEnumerator@PBG@UnBCL@@", "H0S0a0o0}0", "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@ABV01@@Z", "282R2h2", "?GetHashCode@String@UnBCL@@UBEHXZ", "?get_P@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVSerializationStream@2@XZ", "4D4d4", ":$;J;~;", "?Collate@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z", "?GetEnumerator@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@XZ", "353k3", "null path to Path::WithoutLongPrefix", "??_8Version@UnBCL@@7B?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "4#4H4U4k4z4", ".?AU?$ICollection@PAVSerializationId@UnBCL@@@UnBCL@@", "?CheckPathTooLong@Path@UnBCL@@KGXPBVString@2@@Z", "030L0W0", "??4Exception@UnBCL@@QAEAAV01@ABV01@@Z", "??0Stream@UnBCL@@QAE@ABV01@@Z", "<#=E=c=", "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@", "null anyOf to String#IndexOfAny", "?GetOccurenceCount@String@UnBCL@@QBEHG@Z", "2_3q3", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive(unsigned short)", ">$>,>4><>D>L>T>\\>d>p>", ".?AV?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@", "=?>S>e>s>", "5 545<5D5L5P5X5l5", "?DAYS_PER_400@DateTime@UnBCL@@0HB", "484G4g4", "9H9Z9i9", "?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGH@Z", "080`0", "??4?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z", "6+707Q7g7", "6,6<6@6D6H6P6h6x6|6", "PQQSVW", "??_7Stream@UnBCL@@6B01@@", "??0MutableString@UnBCL@@QAE@PBGHH@Z", ":#:1:?:", "??1?$ICollection@G@UnBCL@@UAE@XZ", "LeaveCriticalSection", ".?AV?$SmartPtr@U?$IEnumerator@PBG@UnBCL@@@UnBCL@@", "??4?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", "?_Trim@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ", "?OemToCharA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXXZ", "2=2O2a2", "?s_Registration@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "?get_NodeType@XmlNode@XmlLite@UnBCL@@QBE?AW4XmlNodeType@3@XZ", "item retrieval on empty stack", ".rdata$T$brc", "??4SyncObject@UnBCL@@QAEAAV01@ABV01@@Z", "??1XmlDocument@XmlLite@UnBCL@@UAE@XZ", "?IndexOfAny@String@UnBCL@@QBEHPBGHH@Z", "?set_AutoDelete@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXH@Z", ">N?y?", "void __thiscall UnBCL::Array::RemoveAt(int)", "??_7Version@UnBCL@@6BISerializable@1@@", "?ContainsKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z", "?GetBuffer@?$Array@E@UnBCL@@UBEPBEH@Z", "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@D@Z", "?get_ExceptionCode@SEHException@UnBCL@@QBEIXZ", ">,>0>4>8><>P>T>X>p>t>", "?Nullify@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEAAV12@XZ", "0C0\\0y0", "D$ f9", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "?Add@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEHPAVObject@2@@Z", "??4SystemException@UnBCL@@QAEAAV01@$$QAV01@@Z", "??_8MultiSz@UnBCL@@7B?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@1@@", "HeapDestroy", "?set_AutoDelete@?$Array@G@UnBCL@@UAEXH@Z", "0M1o1", "?Read@FileStream@UnBCL@@UAEHPAEHH@Z", "void __thiscall UnBCL::FileStream::Flush(void)", "4#4@4S4b4s4", ".?AVXmlNodeList@XmlLite@UnBCL@@", "??4?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z", ".?AV?$SmartPtr@VStream@UnBCL@@@UnBCL@@", "?GetCharCount@UnicodeEncoding@UnBCL@@UBEHPBV?$Array@E@2@HH@Z", "??4?$IEnumerable@PBG@UnBCL@@QAEAAU01@ABU01@@Z", "?CollateNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z", "??1ExternalException@UnBCL@@UAE@XZ", "?7?I?X?", "null startinfo to Process::Start", "?get_Item@XmlNodeList@UnBCL@@QAEPAVXmlNode@2@H@Z", "?get_TimeOfDay@DateTime@UnBCL@@QBE?AVTimeSpan@2@XZ", ".rdata$r$brc", "; ;Y;b;", "attempt to delete subkey of key opened read-only", "??0?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ", "??0TextWriter@UnBCL@@IAE@XZ", "7#8@8", "?GetNow@DateTime@UnBCL@@SG?AV12@H@Z", "FindNextFileNameW", "neutral", "unable to retrieve value count", "9#:-:::@:|:", "4-4?4H4S4", "unable to release mutex", "overflow: numchars too large in UnicodeEncoding::GetMaxByteCount", "??0IPoolable@UnBCL@@QAE@XZ", "?StreamRead@?$SerializableArrayBase@H@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", "??6SerializationStream@UnBCL@@QAEAAV01@V?$SmartPtr@UISerializable@UnBCL@@@1@@Z", "1#2B2f2", "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6BObject@2@@", "??BTimeSpan@UnBCL@@QBENXZ", "?IndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,class UnBCL::Object *,struct UnBCL::IComparer *)", "8\"8B8S8", "y?Vj$", "0$0T0", "?get_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ", "354G4U4", ".?AVRegistryKey@UnBCL@@", ".?AU?$IEnumerator@G@UnBCL@@", "?GetDirectories@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z", "=S=a=o=}=", "3=3n3", "result of TimeSpan subtraction too large", "?Nullify@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEAAV12@XZ", ".?AU?$IEnumerator@UUniqueObject@SerializationStream@UnBCL@@@UnBCL@@", "??0Exception@UnBCL@@QAE@PBVString@1@@Z", "_vsnprintf", "??4?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAV01@ABV01@@Z", "??_7Registry@UnBCL@@6B@", ";8::Insert(int,class UnBCL::StringPtr)", "int __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable::RetrieveValue(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::MoveNext(void)", ".?AU?$IEnumerator@VStringPtr@UnBCL@@@UnBCL@@", "4-4e4", "1=2O2^2{2", "?get_Attributes@XmlNode@UnBCL@@QAEPAVXmlAttributeCollection@2@XZ", "?RegisterVersion@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", "??1?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@UAE@XZ", "4,444<4H4h4p4x4", "void __thiscall UnBCL::FileStream::Write(const unsigned char *,int,int)", "OLE32.dll", "unsigned short &__thiscall UnBCL::ArrayList::get_Item(int)", ".?AV?$KeyCollection@UUniqueObject@SerializationStream@UnBCL@@H@_@UnBCL@@", ":3:g:", "707:7h7t7", "GetTempPathW requires length more than MAX_PATH.", "void __thiscall UnBCL::ArrayList >::CopyTo(class UnBCL::Array > *,int) const", "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B@", "?CopyTo@?$Array@G@UnBCL@@UBEXPAV12@H@Z", "3P3^3", "result of TimeSpan addition too large", "?RemoveAt@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z", "??1?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UAE@XZ", "1\"161s1", "545>5W5m5", "??0?$IEnumerable@PBG@UnBCL@@QAE@ABU01@@Z", "?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ", ".?AVConsoleLogHandler@UnBCL@@", "?get_Minor@Version@UnBCL@@QBEHXZ", "4)4?4b4t4", "?SetAt@?$CSimpleStringT@G$0A@@ATL@@QAEXHG@Z", "YiaKd", "0$0(0,00040H0L0\\0`0d0h0l0", "??_D?$Stack@PAVObject@UnBCL@@@UnBCL@@QAEXXZ", "??0XmlNode@XmlLite@UnBCL@@QAE@ABV012@@Z", "?IndexOf@?$Array@E@UnBCL@@UBEHE@Z", "?StreamWrite@?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z", "?get_CodePage@Encoding@UnBCL@@UBEHXZ", "3+4=4L4c4", "??_7?$Stack@H@UnBCL@@6BObject@1@@", "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@2@@", ".?AV?$HTEnumerator@UUniqueObject@SerializationStream@UnBCL@@HUTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@3@U123@UKeyTraits@53@$1?RetrieveKey@53@KG?AU123@PBV?$CAtlMap@UTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@", ")Microsoft Root Certificate Authority 20100", "??_7InvalidOperationException@UnBCL@@6B@", "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@H@Z", "::Remove(unsigned short)", "4+4:4S4", "??_8StreamReader@UnBCL@@7BIDisposable@1@@", "080s0", "??4ArgumentOutOfRangeException@UnBCL@@QAEAAV01@ABV01@@Z", "<^=q=", "7(747T7\\7h7", "OutputDebugStringA", "class UnBCL::String *__thiscall UnBCL::FileSystemEnumerator::get_Current(void) throw(...) const", "??0?$SerializableStackBase@H@_@UnBCL@@QAE@ABV012@@Z", "8)9K9m9", "?Replace@String@UnBCL@@QBEPAV12@PBG0W4StringCasing@12@@Z", "?RegisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z", "SetEnvironmentVariableW", "??_8FileStream@UnBCL@@7BStream@1@@", "?set_LinePosition@XmlException@UnBCL@@MAEXH@Z", ".?AV?$HTEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@PAV342@UKeyTraits@62@$1?RetrieveValue@62@KGPAV342@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@PAVTypeFactoryList@SerializationStream@3@UKeyTraits@23@V?$CElementTraits@PAVTypeFactoryList@SerializationStream@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@", ";8(unsigned long &)", "?set_Position@BufferedStream@UnBCL@@UAEX_J@Z", ":2:o:", "??6SerializationStream@UnBCL@@QAEAAV01@_K@Z", "Architecture", "class UnBCL::ArrayList *__thiscall UnBCL::String::Split(const unsigned short *,int) const", "?Read@StreamReader@UnBCL@@UAEHXZ", "?FixupName@RegistryKey@UnBCL@@AAEPAVString@2@ABV32@@Z", ".idata", "r(j\\[Ph", "??1?$IComparer@PAVString@UnBCL@@@UnBCL@@UAE@XZ", "GetFileAttributesW", "::get_Current(void) const", "4#5>5R5s5", ".didat$5", ":<:m:z:", "?get_Item@?$Array@E@UnBCL@@UBEABEH@Z", "??1?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UAE@XZ", "[0r0y0", "4$4,414E4S4[4`4t4", "686@6L6l6t6|6", "?get_Count@XmlAttributeCollection@XmlLite@UnBCL@@QBEHXZ", "?Reverse@?$ArrayList@G@UnBCL@@UAEXXZ", "ReadFile", "6-7X7", "??_7ArgumentNullException@UnBCL@@6B@", "t%Vj$", "1;2o2", ";1;c;r;", "??1?$ICollection@PAVString@UnBCL@@@UnBCL@@UAE@XZ", "??_D?$Array@PAVString@UnBCL@@@UnBCL@@QAEXXZ", "?Concat@String@UnBCL@@SAPAV12@HZZ", "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXABV12@@Z", "?SetSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAGPAPAG@Z", "??4?$SerializableArrayBase@H@_@UnBCL@@QAEAAV012@ABV012@@Z", "242;2B2h2w2", "=*>I>[>m>{>", "6+6:6[6t6", "??0MultiSz@UnBCL@@QAE@PBEIPAK@Z", "??1?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ", "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ", "??0Thread@UnBCL@@AAE@PAX@Z", "class UnBCL::XmlLite::XmlAttribute **__thiscall UnBCL::ArrayList::GetBuffer(int)", "??0MemoryStream@UnBCL@@QAE@XZ", "class UnBCL::DictionaryEntry __thiscall UnBCL::_::HTEnumerator::TableKey,class UnBCL::DictionaryEntry,struct UnBCL::Hashtable::KeyTraits,&protected: static class UnBCL::DictionaryEntry __stdcall UnBCL::Hashtable::RetrieveEntry(class ATL::CAtlMap::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable::KeyTraits,class ATL::CElementTraits > const *,struct __POSITION * const &)>::get_Current(void) const", "?SetValue@?$Array@G@UnBCL@@UAEXGH@Z", "??4?$IList@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z", "?0?d?", "??7?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBE_NXZ", "?Add@TimeSpan@UnBCL@@QBE?AV12@ABV12@@Z", "333K3v3", "<(::GetBuffer(int) const", "??0Registry@UnBCL@@QAE@ABV01@@Z", ">2?@?N?\\?j?x?", "?GetTypeName@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ", "?GetTypeName@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UBEPBVString@2@XZ", "?ReferenceEquals@Object@UnBCL@@SGHPBV12@0@Z", "8,8S8o8", "?RegisterVersion@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z", "?get_P@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ", "?TimeToTicks@DateTime@UnBCL@@AAE_JHHH@Z", "606B6M6[6s6", "?#?@?^?j?{?", "6J7\\7", "int __stdcall UnBCL::Array::BinarySearch(const class UnBCL::Array *,int,struct UnBCL::IComparer *)", "??0Decoder@UnBCL@@QAE@XZ", "?GetStringValue@RegistryKey@UnBCL@@QAEPAVString@2@PBV32@H@Z", "int __stdcall UnBCL::ArrayList::BinarySearch(class UnBCL::ArrayList *,class UnBCL::String *,struct UnBCL::IComparer *)", "??1?$Array@E@UnBCL@@UAE@XZ", "class UnBCL::XmlAttribute *__thiscall UnBCL::XmlAttributeCollection::get_Item(class UnBCL::String *)", "Invalid offset to MemoryStream#SetLength", "??0ApplicationException@UnBCL@@QAE@XZ", "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@", "??0StringPtr@UnBCL@@QAE@PBG@Z", "?MakeTrim@MutableString@UnBCL@@QAEXPBG@Z", "8;8_8", "??0UnicodeEncoding@UnBCL@@QAE@$$QAV01@@Z", "??4IInstanceFactory@UnBCL@@QAEAAU01@$$QAU01@@Z", ".PAVIndexOutOfRangeException@UnBCL@@", "1S2p2", "(object of class=\"%s\" at {%x})", "?ValueEquals@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@0@Z", "< <(<,<0<4<<::BinarySearch(class UnBCL::ArrayList *,unsigned char,struct UnBCL::IComparer *)", "?GetHashCode@Version@UnBCL@@UBEHXZ", "?get_IsReadOnly@?$Array@E@UnBCL@@UBEHXZ", "??0StringBuilder@UnBCL@@QAE@ABV01@@Z", "?IndexOf@?$Array@H@UnBCL@@UBEHH@Z", "<0", "?get_IsReadOnly@?$ArrayList@G@UnBCL@@UBEHXZ", "null str to String::Intern", "?Copy@?$ArrayList@G@UnBCL@@SGXPBV12@PAV12@H@Z", "?FILETIME_OFFSET@DateTime@UnBCL@@0_JB", "3P3s3", "??0?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAE@XZ", "?IsShortCompliant@Path@UnBCL@@SGHPBVString@2@H@Z", "GetCurrentProcess", "u\"Vj 9r", "?Clear@?$Array@E@UnBCL@@UAEXXZ", ">0>D>V>x>", "??0SystemException@UnBCL@@QAE@PBGPAVException@1@@Z", ";*;C;g;u;", ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@", ".?AU?$IEnumerator@E@UnBCL@@", ";.;c;", "??_7Mutex@UnBCL@@6BIDisposable@1@@", "Microsoft Windows0", "??0XmlDocument@UnBCL@@QAE@PAUIXMLDOMDocument3@@@Z", "1 1$1(1,1@1D1T1X1p1", "unable to query value", "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,const class UnBCL::Array *)", "7#7i7", "FindFirstFileNameW", ": :$:8:<:@:D:X:h:l:p:", " Operating System", "??1?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MAE@XZ", "S _^[", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "~>Vj ", "GetPrefix", "??0ConsoleLogHandler@UnBCL@@QAE@$$QAV01@@Z", "9!9/9=9", "class UnBCL::String *__thiscall UnBCL::RegistryKey::GetStringValue(const class UnBCL::String *,int)", "?s_Registration@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A", "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@E@Z", "?StreamRead@?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z", "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@PAVDecoder@1@@Z", "z.9Wv", "2$2,242<2D2P2p2|2", "void __thiscall UnBCL::BufferedStream::Flush(void)", "R$VWS", "5G5j5", "??_7InvalidCastException@UnBCL@@6B@", "?get_Day@DateTime@UnBCL@@QBEHXZ", "6.7[7", "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z", "8C9c9", "?GetBuffer@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPBQAVString@2@H@Z", "??4?$IEnumerator@PBG@UnBCL@@QAEAAU01@ABU01@@Z", ";A$uS9w", "??1CaseInsensitiveStringComparer@UnBCL@@UAE@XZ", "??4Decoder@UnBCL@@QAEAAV01@ABV01@@Z", "??0InvalidOperationException@UnBCL@@QAE@XZ", "??4TextWriter@UnBCL@@QAEAAV01@$$QAV01@@Z", "6$64686H6L6\\6`6d6h6l6p6t6", "?LastIndexOf@String@UnBCL@@QBEHPBGHH@Z", "?_IndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z", "??0String@UnBCL@@QAE@PBV01@@Z", "304B4Q4j4", "??0XmlAttribute@UnBCL@@QAE@ABV01@@Z", ".PAVWin32Exception@UnBCL@@", "?get_IsFixedSize@?$Array@G@UnBCL@@UBEHXZ", "031s1", "5S6w6", "?#?-?{?", "?AddStackTrace@Exception@UnBCL@@QAEXPBD@Z", "0,000H0X0\\0`0x0", "?Concat@String@UnBCL@@SGPAV12@PBG000@Z", "?get_IsReadOnly@?$Array@G@UnBCL@@UBEHXZ", "??0IndexOutOfRangeException@UnBCL@@QAE@XZ", "?Assign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXPAV?$Array@PAVString@UnBCL@@@2@@Z", "base\\ntsetup\\unbcl\\src\\directory.cpp", "??_7FormatException@UnBCL@@6B@", "?GetBaseKey@RegistryKey@UnBCL@@KGPAV12@PAUHKEY__@@@Z", "?GetManager@?$CSimpleStringT@G$0A@@ATL@@QBEPAUIAtlStringMgr@2@XZ", "??4?$IList@H@UnBCL@@QAEAAU01@$$QAU01@@Z", "?Clear@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXXZ", "??4?$SerializableArrayBase@G@_@UnBCL@@QAEAAV012@ABV012@@Z", "?GetValue@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVString@2@H@Z", "?get_IsVM@SystemInfo@UnBCL@@QBEHXZ", "::Add(class UnBCL::Object *)", "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@H@Z", "?CopyTo@?$ArrayList@G@UnBCL@@UBEXPAV?$Array@G@2@H@Z", "=;>L>^>s>", "?Subtract@TimeSpan@UnBCL@@QBE?AV12@ABV12@@Z", "?ToString@MultiSz@UnBCL@@QBEPAVString@2@G@Z", "??_7?$Array@E@UnBCL@@6B?$IEnumerable@E@1@@", "??_7MemoryStream@UnBCL@@6BIDisposable@1@@", "545d5", "GetTickCount", "??0?$Array@PAVObject@UnBCL@@@UnBCL@@IAE@XZ", "0L0c0r0", "?Insert@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z", ">/>R>d>v>", "unable to get binary value on key", "??_7SEHException@UnBCL@@6B@", "attempt to delete nonexistent subkey", "??0?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@ABU01@@Z", "??0XmlDocument@XmlLite@UnBCL@@QAE@XZ", "C(^[]", "LocalFree", "< <.<", "__thiscall UnBCL::DateTime::DateTime(int,int,int,int,int,int,int)", "??_7XmlDocument@XmlLite@UnBCL@@6B@", "??0OutOfMemoryException@UnBCL@@QAE@PAVString@1@@Z", "void __thiscall UnBCL::ArrayList::CopyTo(class UnBCL::Array *,int) const", "5$505P5\\5|5", "3<4{4", "sAWj ", "?Assign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXABV12@@Z", "<@=K=Y=g=u=", "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@", "?_IndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z", "374D4c4", "?FromASCII@String@UnBCL@@SGPAV12@PBD@Z", "Read() on closed MemoryStream", "CreateStreamOnHGlobal", "?GetValueNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ", "??7?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBE_NXZ", "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<__int64>(__int64 &)", "??_8?$Array@E@UnBCL@@7B?$IList@E@1@@", "void __thiscall UnBCL::ArrayList::Resize(int,int)", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "?get_P@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@2@XZ", "??_8?$Array@G@UnBCL@@7B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@", "=!=C=d=", "94:F:", "??_D?$Stack@H@UnBCL@@QAEXXZ", "??_7SecurityException@UnBCL@@6B@", "6-6;6I6", "?Clone@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ", ")value", "y>Sj ", "?MAX_TICKS@DateTime@UnBCL@@0_JB", "%Microsoft Windows Production PCA 20110", "1&1K1p1", "?SetValue@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@H@Z", "8#8K8]8l8", "3$3D3P3p3x3", "?CompareTo@String@UnBCL@@QBEHPBGH@Z", "int __thiscall UnBCL::String::_EndsWith(class UnBCL::SmartPtr) const", "??_7Win32Exception@UnBCL@@6B@", "?Insert@?$Array@E@UnBCL@@UAEXHE@Z", "__thiscall UnBCL::XmlSchemaSet::XmlSchemaSet(void)", "3C3w3", "HeapValidate", "?Add@?$Array@E@UnBCL@@UAEHE@Z", "j Xf;", "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@1@@", "set_Capacity on closed MemoryStream", ".?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@", "void __thiscall UnBCL::MemoryStream::LengthAtLeast(int)", "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@@", "1/2T2i2{2", "int __thiscall UnBCL::ArrayList::BinarySearch(int,int,class UnBCL::XmlLite::XmlNode *,struct UnBCL::IComparer *)", "int __stdcall UnBCL::Array::BinarySearch(const class UnBCL::Array *,unsigned char,struct UnBCL::IComparer *)", "?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z", "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7BISerializable@1@@", "?Start@Process@UnBCL@@SGPAV12@PBVProcessStartInfo@2@@Z", "?Move@Directory@UnBCL@@SGXPBVString@2@0@Z", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", ": :=:[:{:", "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@E@Z", "=3>h>z>", "??0XmlException@UnBCL@@QAE@PAVString@1@PAVException@1@HHJ@Z", ".?AV?$Array@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@", "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@00@Z", ";$::Insert(int,class UnBCL::String *)", "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@XZ", "CreateThread", "hMYZV" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "7db85e25c08e701dbc4d1a01c7611c89cfb08622415ab3e3b339dc217aa864c1", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/7db85e25c08e701dbc4d1a01c7611c89cfb08622415ab3e3b339dc217aa864c1", "guest_paths": [ "overlay" ], "size": 8512, "crc32": "0D71448B", "md5": "dd6af0ed9f9ed2d99cfd1a941ed5b569", "sha1": "5d3b2e55b35ba7d51b7570e95bad7f6085b42978", "sha256": "7db85e25c08e701dbc4d1a01c7611c89cfb08622415ab3e3b339dc217aa864c1", "sha512": "d5a045f9837ca8473ff23475da82ac41b649d01d31f24c067bff974b619cd708a2a85d16a540143c0d98d75188b41243f4160db44786cfc2eea94d7498376b52", "rh_hash": null, "ssdeep": "96:/MDXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGueDXT7l+RBDqhBYDfrU:HF2q8hDBQABJgBcr+YVqnajKsk9G8", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T166023BD28E6C5847DEE27C4053A8F957BE3E53CB2850855605AAF9E81C833C6EF0866D", "sha3_384": "d7a342efa643e57adcc18779290813072928ef536010a247f62884b84bcc18219fdbf12ecbc611dbebfd641fe182c0b3", "data": null } ], "extracted_files_time": 0.0005373429994506296, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "products.xml" ], "path": "/opt/CAPEv2/storage/analyses/3/files/76fcc8eeacb7da966441a7e0ac8b79cc095f13682abb92ee5a614c52f72ce54c", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\products.xml" ], "size": 2794793, "crc32": "6444C97C", "md5": "f9c1df5c8718468b892af250f6d7b78e", "sha1": "040da263bc223436f929dbc1f2ab88198e299610", "sha256": "76fcc8eeacb7da966441a7e0ac8b79cc095f13682abb92ee5a614c52f72ce54c", "sha512": "edeb708e50f815ef022bd9275255dd3644b07597e9a90736364fbb7206b77ba44953d61735def7e2653a12442fd623baff0630793b507eccf4508e772ba02a39", "rh_hash": null, "ssdeep": "6144:iqm6xDGaol3wdAZNRlKUp9Lq0T/vjXrOo/TpuIexzfDS8/jRCMRNoUosgFTkYKl1:dzfDS8/jRCMRNxyrcL/cGPjOAEg", "type": "Unicode text, UTF-8 text, with CRLF line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T104D5DFB5E4D5B20970335493BCA0A727FC19900B4918E8EDB9CD262F1FF36A931A35B5", "sha3_384": "de20707c25dc9483d4de2977b76e79ffc2719123825581346d88788cbc853bc7ddc93a2123f12cb2dfe2cdfb1b223e9d", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\n \n \n \n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd\n zh-cn\n Chinese (Simplified, China)\n CoreCountrySpecific\n x64\n 3945834799\n 8b49a8943cb3260ce9a8dadcd729f0ac98018245\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/6048ac73-c010-4eaf-ac07-a8672588662e/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd\n \n %ARCH_64%\n %BASE_CHINA%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x86FRE_zh-cn.esd\n zh-cn\n Chinese (Simplified, China)\n CoreCountrySpecific\n x86\n 2884140025\n fbd0b7322af31de59db60b437150080c81451a76\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/927ea937-74a7-4f37-aeaf-14a7cf98acc5/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x86FRE_zh-cn.esd\n \n %ARCH_32%\n %BASE_CHINA%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n Professional\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n ProfessionalN\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n ProfessionalEducation\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n ProfessionalEducationN\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n ProfessionalWorkstation\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n ProfessionalWorkstationN\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n Core\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n \n %ARCH_64%\n %CLIENT%\n False\n \n \n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\n ko-kr\n Korean (Korea)\n CoreN\n x64\n 3955051946\n a39fb6ff19f14ed12f0a274adb4982c7374981ab\n http://dl.delivery.mp.microsoft.com/filestreamingservice/fil ", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "DiagTrack.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/b55d66f2943f1c63ea9b39dae88aa2a4f91775cefffefd263bd302866a7bd91c", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" ], "size": 922976, "crc32": "D4B75FAE", "md5": "6c3f6a6bc5ede978e9dfe1acce386339", "sha1": "3b7b51d762c593e92123f9365a896ed64ee26a7a", "sha256": "b55d66f2943f1c63ea9b39dae88aa2a4f91775cefffefd263bd302866a7bd91c", "sha512": "3f87064354a0f55f36aa272c5918d208b8a77fffb7965e9b50727c06fd8d8db5e6695636a7db37926fe444c91e4a4a7dc892ef5ef57676ba9515216d5e5f94ff", "rh_hash": null, "ssdeep": "12288:Er+9jUr2TTWLQRPwMRlf+8Kh+fx6gmkwJKdMrtUIHkaMNUEP3g5Qy1Jxb3ArS:A+9jUr2TTr5LlfcwwggUhnNzg5Rbwr", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1EB155C32ABEC8176FAFB16B4362D622550BDF8701F2088CB6250479E6970BD1AF34757", "sha3_384": "0fb890b408147aec6a2b35e417bd4006147ec1241b420c8fffb92e00ed817208d33bd42a85df58d8e6d8671e533a6132", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x000ac5d0", "ep_bytes": "8bff558bec837d0c017505e86b060000", "peid_signatures": null, "reported_checksum": "0x000ebf44", "actual_checksum": "0x000ebf44", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "diagtrack.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x100cd418", "name": "rand_s" }, { "address": "0x100cd41c", "name": "vswprintf_s" }, { "address": "0x100cd420", "name": "_snprintf" }, { "address": "0x100cd424", "name": "_finite" }, { "address": "0x100cd428", "name": "_vscwprintf" }, { "address": "0x100cd42c", "name": "realloc" }, { "address": "0x100cd430", "name": "wcsnlen" }, { "address": "0x100cd434", "name": "wcsncmp" }, { "address": "0x100cd438", "name": "towlower" }, { "address": "0x100cd43c", "name": "strnlen" }, { "address": "0x100cd440", "name": "srand" }, { "address": "0x100cd444", "name": "sprintf_s" }, { "address": "0x100cd448", "name": "wcsstr" }, { "address": "0x100cd44c", "name": "_wtoi" }, { "address": "0x100cd450", "name": "_wcstoi64" }, { "address": "0x100cd454", "name": "_wcsnicmp" }, { "address": "0x100cd458", "name": "memcpy_s" }, { "address": "0x100cd45c", "name": "_wcstoui64" }, { "address": "0x100cd460", "name": "_wtof" }, { "address": "0x100cd464", "name": "towupper" }, { "address": "0x100cd468", "name": "swprintf_s" }, { "address": "0x100cd46c", "name": "_snwscanf_s" }, { "address": "0x100cd470", "name": "_ftol2" }, { "address": "0x100cd474", "name": "memcmp" }, { "address": "0x100cd478", "name": "_except_handler4_common" }, { "address": "0x100cd47c", "name": "_wcsdup" }, { "address": "0x100cd480", "name": "_onexit" }, { "address": "0x100cd484", "name": "__dllonexit" }, { "address": "0x100cd488", "name": "_unlock" }, { "address": "0x100cd48c", "name": "_lock" }, { "address": "0x100cd490", "name": "?terminate@@YAXXZ" }, { "address": "0x100cd494", "name": "_initterm" }, { "address": "0x100cd498", "name": "_amsg_exit" }, { "address": "0x100cd49c", "name": "_XcptFilter" }, { "address": "0x100cd4a0", "name": "_callnewh" }, { "address": "0x100cd4a4", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0x100cd4a8", "name": "??1exception@@UAE@XZ" }, { "address": "0x100cd4ac", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0x100cd4b0", "name": "??0exception@@QAE@ABQBDH@Z" }, { "address": "0x100cd4b4", "name": "??0exception@@QAE@ABQBD@Z" }, { "address": "0x100cd4b8", "name": "??0exception@@QAE@XZ" }, { "address": "0x100cd4bc", "name": "memcpy" }, { "address": "0x100cd4c0", "name": "__CxxFrameHandler3" }, { "address": "0x100cd4c4", "name": "_CxxThrowException" }, { "address": "0x100cd4c8", "name": "_stricmp" }, { "address": "0x100cd4cc", "name": "_wcsicmp" }, { "address": "0x100cd4d0", "name": "_vsnwprintf" }, { "address": "0x100cd4d4", "name": "malloc" }, { "address": "0x100cd4d8", "name": "_purecall" }, { "address": "0x100cd4dc", "name": "??_V@YAXPAX@Z" }, { "address": "0x100cd4e0", "name": "free" }, { "address": "0x100cd4e4", "name": "memmove" }, { "address": "0x100cd4e8", "name": "wcschr" }, { "address": "0x100cd4ec", "name": "??8type_info@@QBEHABV0@@Z" }, { "address": "0x100cd4f0", "name": "wcscpy_s" }, { "address": "0x100cd4f4", "name": "swscanf_s" }, { "address": "0x100cd4f8", "name": "??1type_info@@UAE@XZ" }, { "address": "0x100cd4fc", "name": "rand" }, { "address": "0x100cd500", "name": "time" }, { "address": "0x100cd504", "name": "??3@YAXPAX@Z" }, { "address": "0x100cd508", "name": "memset" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x100cd118", "name": "GetCurrentProcess" }, { "address": "0x100cd11c", "name": "SetUnhandledExceptionFilter" }, { "address": "0x100cd120", "name": "UnhandledExceptionFilter" }, { "address": "0x100cd124", "name": "GetTickCount64" }, { "address": "0x100cd128", "name": "WakeConditionVariable" }, { "address": "0x100cd12c", "name": "AcquireSRWLockExclusive" }, { "address": "0x100cd130", "name": "SleepConditionVariableSRW" }, { "address": "0x100cd134", "name": "ReleaseSRWLockExclusive" }, { "address": "0x100cd138", "name": "MoveFileExW" }, { "address": "0x100cd13c", "name": "RaiseFailFastException" }, { "address": "0x100cd140", "name": "UnregisterWaitEx" }, { "address": "0x100cd144", "name": "DisableThreadLibraryCalls" }, { "address": "0x100cd148", "name": "Sleep" }, { "address": "0x100cd14c", "name": "CreateEventW" }, { "address": "0x100cd150", "name": "InitializeConditionVariable" }, { "address": "0x100cd154", "name": "CloseThreadpool" }, { "address": "0x100cd158", "name": "LoadResource" }, { "address": "0x100cd15c", "name": "FindResourceExW" }, { "address": "0x100cd160", "name": "FreeResource" }, { "address": "0x100cd164", "name": "EncodePointer" }, { "address": "0x100cd168", "name": "LocalAlloc" }, { "address": "0x100cd16c", "name": "TerminateProcess" }, { "address": "0x100cd170", "name": "GetVersionExW" }, { "address": "0x100cd174", "name": "WaitForMultipleObjectsEx" }, { "address": "0x100cd178", "name": "WaitForThreadpoolWorkCallbacks" }, { "address": "0x100cd17c", "name": "GetSystemDirectoryW" }, { "address": "0x100cd180", "name": "InitializeCriticalSectionAndSpinCount" }, { "address": "0x100cd184", "name": "GetUserGeoID" }, { "address": "0x100cd188", "name": "GetSystemDefaultLCID" }, { "address": "0x100cd18c", "name": "GetNativeSystemInfo" }, { "address": "0x100cd190", "name": "GetThreadPriority" }, { "address": "0x100cd194", "name": "GlobalFree" }, { "address": "0x100cd198", "name": "GetProcessHeap" }, { "address": "0x100cd19c", "name": "HeapFree" }, { "address": "0x100cd1a0", "name": "HeapAlloc" }, { "address": "0x100cd1a4", "name": "QueryPerformanceCounter" }, { "address": "0x100cd1a8", "name": "GetCurrentProcessId" }, { "address": "0x100cd1ac", "name": "GetSystemTimeAsFileTime" }, { "address": "0x100cd1b0", "name": "GetTickCount" }, { "address": "0x100cd1b4", "name": "CloseThreadpoolWork" }, { "address": "0x100cd1b8", "name": "WerRegisterMemoryBlock" }, { "address": "0x100cd1bc", "name": "WriteFile" }, { "address": "0x100cd1c0", "name": "CreateFileW" }, { "address": "0x100cd1c4", "name": "WideCharToMultiByte" }, { "address": "0x100cd1c8", "name": "InitializeCriticalSectionEx" }, { "address": "0x100cd1cc", "name": "CreateThreadpoolTimer" }, { "address": "0x100cd1d0", "name": "EnterCriticalSection" }, { "address": "0x100cd1d4", "name": "LeaveCriticalSection" }, { "address": "0x100cd1d8", "name": "SetThreadpoolTimer" }, { "address": "0x100cd1dc", "name": "CloseThreadpoolTimer" }, { "address": "0x100cd1e0", "name": "WaitForThreadpoolTimerCallbacks" }, { "address": "0x100cd1e4", "name": "SetThreadPriority" }, { "address": "0x100cd1e8", "name": "WaitForMultipleObjects" }, { "address": "0x100cd1ec", "name": "FindNextChangeNotification" }, { "address": "0x100cd1f0", "name": "FindFirstChangeNotificationW" }, { "address": "0x100cd1f4", "name": "WTSGetActiveConsoleSessionId" }, { "address": "0x100cd1f8", "name": "AcquireSRWLockShared" }, { "address": "0x100cd1fc", "name": "ReleaseSRWLockShared" }, { "address": "0x100cd200", "name": "LocalFree" }, { "address": "0x100cd204", "name": "ReadFile" }, { "address": "0x100cd208", "name": "GetFileSize" }, { "address": "0x100cd20c", "name": "FindCloseChangeNotification" }, { "address": "0x100cd210", "name": "CreateThreadpool" }, { "address": "0x100cd214", "name": "SetThreadpoolThreadMaximum" }, { "address": "0x100cd218", "name": "CreateThreadpoolWork" }, { "address": "0x100cd21c", "name": "SubmitThreadpoolWork" }, { "address": "0x100cd220", "name": "FileTimeToSystemTime" }, { "address": "0x100cd224", "name": "MultiByteToWideChar" }, { "address": "0x100cd228", "name": "SetFilePointerEx" }, { "address": "0x100cd22c", "name": "GetSystemPreferredUILanguages" }, { "address": "0x100cd230", "name": "GetProductInfo" }, { "address": "0x100cd234", "name": "SetEndOfFile" }, { "address": "0x100cd238", "name": "UnmapViewOfFile" }, { "address": "0x100cd23c", "name": "MapViewOfFile" }, { "address": "0x100cd240", "name": "CreateFileMappingW" }, { "address": "0x100cd244", "name": "GetFileSizeEx" }, { "address": "0x100cd248", "name": "ResetEvent" }, { "address": "0x100cd24c", "name": "GetTempPathW" }, { "address": "0x100cd250", "name": "MoveFileW" }, { "address": "0x100cd254", "name": "VirtualAlloc" }, { "address": "0x100cd258", "name": "VirtualFree" }, { "address": "0x100cd25c", "name": "QueryPerformanceFrequency" }, { "address": "0x100cd260", "name": "GetSystemInfo" }, { "address": "0x100cd264", "name": "SetThreadPriorityBoost" }, { "address": "0x100cd268", "name": "FlushViewOfFile" }, { "address": "0x100cd26c", "name": "GlobalMemoryStatusEx" }, { "address": "0x100cd270", "name": "OpenProcess" }, { "address": "0x100cd274", "name": "QueryUnbiasedInterruptTime" }, { "address": "0x100cd278", "name": "GetTempFileNameW" }, { "address": "0x100cd27c", "name": "GetSystemPowerStatus" }, { "address": "0x100cd280", "name": "K32GetPerformanceInfo" }, { "address": "0x100cd284", "name": "IsWow64Process" }, { "address": "0x100cd288", "name": "CreateProcessW" }, { "address": "0x100cd28c", "name": "GetExitCodeProcess" }, { "address": "0x100cd290", "name": "CreateToolhelp32Snapshot" }, { "address": "0x100cd294", "name": "Process32FirstW" }, { "address": "0x100cd298", "name": "Process32NextW" }, { "address": "0x100cd29c", "name": "DeleteCriticalSection" }, { "address": "0x100cd2a0", "name": "UpdateProcThreadAttribute" }, { "address": "0x100cd2a4", "name": "DeleteProcThreadAttributeList" }, { "address": "0x100cd2a8", "name": "CreateWaitableTimerExW" }, { "address": "0x100cd2ac", "name": "SetWaitableTimerEx" }, { "address": "0x100cd2b0", "name": "SetFilePointer" }, { "address": "0x100cd2b4", "name": "GetStdHandle" }, { "address": "0x100cd2b8", "name": "CreateJobObjectW" }, { "address": "0x100cd2bc", "name": "SetInformationJobObject" }, { "address": "0x100cd2c0", "name": "AssignProcessToJobObject" }, { "address": "0x100cd2c4", "name": "SetWaitableTimer" }, { "address": "0x100cd2c8", "name": "ResumeThread" }, { "address": "0x100cd2cc", "name": "TerminateJobObject" }, { "address": "0x100cd2d0", "name": "SystemTimeToFileTime" }, { "address": "0x100cd2d4", "name": "WaitForSingleObject" }, { "address": "0x100cd2d8", "name": "SetEvent" }, { "address": "0x100cd2dc", "name": "CreateThread" }, { "address": "0x100cd2e0", "name": "FindFirstFileExW" }, { "address": "0x100cd2e4", "name": "CopyFileW" }, { "address": "0x100cd2e8", "name": "FindFirstFileW" }, { "address": "0x100cd2ec", "name": "FindClose" }, { "address": "0x100cd2f0", "name": "DeleteFileW" }, { "address": "0x100cd2f4", "name": "SetFileAttributesW" }, { "address": "0x100cd2f8", "name": "RemoveDirectoryW" }, { "address": "0x100cd2fc", "name": "FindNextFileW" }, { "address": "0x100cd300", "name": "CreateDirectoryW" }, { "address": "0x100cd304", "name": "GetFileAttributesW" }, { "address": "0x100cd308", "name": "SetLastError" }, { "address": "0x100cd30c", "name": "GetCurrentThread" }, { "address": "0x100cd310", "name": "ExpandEnvironmentStringsW" }, { "address": "0x100cd314", "name": "SetEnvironmentVariableW" }, { "address": "0x100cd318", "name": "FormatMessageW" }, { "address": "0x100cd31c", "name": "OutputDebugStringW" }, { "address": "0x100cd320", "name": "GetCurrentThreadId" }, { "address": "0x100cd324", "name": "CloseHandle" }, { "address": "0x100cd328", "name": "GetModuleFileNameA" }, { "address": "0x100cd32c", "name": "GetProcAddress" }, { "address": "0x100cd330", "name": "GetLastError" }, { "address": "0x100cd334", "name": "RaiseException" }, { "address": "0x100cd338", "name": "GetModuleHandleW" }, { "address": "0x100cd33c", "name": "GetModuleHandleExW" }, { "address": "0x100cd340", "name": "LoadLibraryExW" }, { "address": "0x100cd344", "name": "FreeLibrary" }, { "address": "0x100cd348", "name": "SizeofResource" }, { "address": "0x100cd34c", "name": "LockResource" }, { "address": "0x100cd350", "name": "InitializeCriticalSection" }, { "address": "0x100cd354", "name": "LoadLibraryExA" }, { "address": "0x100cd358", "name": "DelayLoadFailureHook" }, { "address": "0x100cd35c", "name": "InitializeProcThreadAttributeList" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x100cd000", "name": "QueryTraceW" }, { "address": "0x100cd004", "name": "AdjustTokenPrivileges" }, { "address": "0x100cd008", "name": "ImpersonateSelf" }, { "address": "0x100cd00c", "name": "CryptGenRandom" }, { "address": "0x100cd010", "name": "ImpersonateLoggedOnUser" }, { "address": "0x100cd014", "name": "RegQueryValueExW" }, { "address": "0x100cd018", "name": "GetTokenInformation" }, { "address": "0x100cd01c", "name": "ConvertSidToStringSidW" }, { "address": "0x100cd020", "name": "CloseTrace" }, { "address": "0x100cd024", "name": "TraceSetInformation" }, { "address": "0x100cd028", "name": "EnableTraceEx2" }, { "address": "0x100cd02c", "name": "ProcessTrace" }, { "address": "0x100cd030", "name": "OpenTraceW" }, { "address": "0x100cd034", "name": "StartTraceW" }, { "address": "0x100cd038", "name": "CryptDestroyHash" }, { "address": "0x100cd03c", "name": "CryptReleaseContext" }, { "address": "0x100cd040", "name": "CryptGetHashParam" }, { "address": "0x100cd044", "name": "CryptHashData" }, { "address": "0x100cd048", "name": "CryptCreateHash" }, { "address": "0x100cd04c", "name": "CryptAcquireContextW" }, { "address": "0x100cd050", "name": "LookupAccountSidW" }, { "address": "0x100cd054", "name": "ConvertStringSidToSidW" }, { "address": "0x100cd058", "name": "AllocateLocallyUniqueId" }, { "address": "0x100cd05c", "name": "GetSecurityDescriptorControl" }, { "address": "0x100cd060", "name": "GetSecurityDescriptorLength" }, { "address": "0x100cd064", "name": "MakeSelfRelativeSD" }, { "address": "0x100cd068", "name": "GetSecurityDescriptorSacl" }, { "address": "0x100cd06c", "name": "GetSecurityDescriptorDacl" }, { "address": "0x100cd070", "name": "GetSecurityDescriptorGroup" }, { "address": "0x100cd074", "name": "GetSecurityDescriptorOwner" }, { "address": "0x100cd078", "name": "RegEnumKeyExW" }, { "address": "0x100cd07c", "name": "RegEnumValueW" }, { "address": "0x100cd080", "name": "RegQueryInfoKeyW" }, { "address": "0x100cd084", "name": "ControlTraceW" }, { "address": "0x100cd088", "name": "RevertToSelf" }, { "address": "0x100cd08c", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x100cd090", "name": "RegDeleteKeyExW" }, { "address": "0x100cd094", "name": "RegNotifyChangeKeyValue" }, { "address": "0x100cd098", "name": "EventWrite" }, { "address": "0x100cd09c", "name": "DuplicateTokenEx" }, { "address": "0x100cd0a0", "name": "CreateProcessAsUserW" }, { "address": "0x100cd0a4", "name": "EnumServicesStatusExW" }, { "address": "0x100cd0a8", "name": "RegDeleteValueW" }, { "address": "0x100cd0ac", "name": "StopTraceW" }, { "address": "0x100cd0b0", "name": "OpenSCManagerW" }, { "address": "0x100cd0b4", "name": "OpenServiceW" }, { "address": "0x100cd0b8", "name": "CloseServiceHandle" }, { "address": "0x100cd0bc", "name": "ControlService" }, { "address": "0x100cd0c0", "name": "QueryServiceStatus" }, { "address": "0x100cd0c4", "name": "RegisterServiceCtrlHandlerExW" }, { "address": "0x100cd0c8", "name": "SetServiceStatus" }, { "address": "0x100cd0cc", "name": "EventUnregister" }, { "address": "0x100cd0d0", "name": "EventRegister" }, { "address": "0x100cd0d4", "name": "RegSetValueExW" }, { "address": "0x100cd0d8", "name": "RegCopyTreeW" }, { "address": "0x100cd0dc", "name": "RegCreateKeyExW" }, { "address": "0x100cd0e0", "name": "RegOpenKeyExW" }, { "address": "0x100cd0e4", "name": "RegDeleteTreeW" }, { "address": "0x100cd0e8", "name": "RegDeleteKeyW" }, { "address": "0x100cd0ec", "name": "RegCloseKey" }, { "address": "0x100cd0f0", "name": "RegGetValueW" }, { "address": "0x100cd0f4", "name": "OpenThreadToken" }, { "address": "0x100cd0f8", "name": "EventWriteTransfer" } ] }, "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x100cd538", "name": "CoTaskMemFree" }, { "address": "0x100cd53c", "name": "CreateStreamOnHGlobal" }, { "address": "0x100cd540", "name": "CoCreateGuid" }, { "address": "0x100cd544", "name": "StringFromGUID2" }, { "address": "0x100cd548", "name": "CLSIDFromString" }, { "address": "0x100cd54c", "name": "CoUninitialize" }, { "address": "0x100cd550", "name": "CoInitializeEx" }, { "address": "0x100cd554", "name": "CoCreateInstance" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x100cd394", "name": "LoadStringW" } ] }, "USERENV": { "dll": "USERENV.dll", "imports": [ { "address": "0x100cd39c", "name": "DestroyEnvironmentBlock" }, { "address": "0x100cd3a0", "name": "CreateEnvironmentBlock" }, { "address": "0x100cd3a4", "name": "ExpandEnvironmentStringsForUserW" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x100cd374", "name": "UuidFromStringW" }, { "address": "0x100cd378", "name": "RpcStringFreeW" }, { "address": "0x100cd37c", "name": "UuidToStringW" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x100cd364", "name": "SysFreeString" }, { "address": "0x100cd368", "name": "SysStringLen" }, { "address": "0x100cd36c", "name": "SysAllocString" } ] }, "bcrypt": { "dll": "bcrypt.dll", "imports": [ { "address": "0x100cd410", "name": "BCryptGenRandom" } ] }, "SHLWAPI": { "dll": "SHLWAPI.dll", "imports": [ { "address": "0x100cd384", "name": "SHCreateStreamOnFileW" }, { "address": "0x100cd388", "name": "PathFileExistsW" }, { "address": "0x100cd38c", "name": "UrlEscapeW" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x100cd510", "name": "EtwTraceMessage" }, { "address": "0x100cd514", "name": "WinSqmIsOptedInEx" }, { "address": "0x100cd518", "name": "NtSetInformationThread" }, { "address": "0x100cd51c", "name": "NtQueryInformationThread" }, { "address": "0x100cd520", "name": "NtQuerySystemInformation" }, { "address": "0x100cd524", "name": "RtlNtStatusToDosError" }, { "address": "0x100cd528", "name": "NtQueryInformationProcess" }, { "address": "0x100cd52c", "name": "NtSetInformationFile" }, { "address": "0x100cd530", "name": "RtlGetVersion" } ] }, "XmlLite": { "dll": "XmlLite.dll", "imports": [ { "address": "0x100cd404", "name": "CreateXmlWriter" }, { "address": "0x100cd408", "name": "CreateXmlReader" } ] }, "WINHTTP": { "dll": "WINHTTP.dll", "imports": [ { "address": "0x100cd3ac", "name": "WinHttpWriteData" }, { "address": "0x100cd3b0", "name": "WinHttpQueryHeaders" }, { "address": "0x100cd3b4", "name": "WinHttpReceiveResponse" }, { "address": "0x100cd3b8", "name": "WinHttpSetTimeouts" }, { "address": "0x100cd3bc", "name": "WinHttpConnect" }, { "address": "0x100cd3c0", "name": "WinHttpCrackUrl" }, { "address": "0x100cd3c4", "name": "WinHttpCloseHandle" }, { "address": "0x100cd3c8", "name": "WinHttpOpenRequest" }, { "address": "0x100cd3cc", "name": "WinHttpAddRequestHeaders" }, { "address": "0x100cd3d0", "name": "WinHttpSetStatusCallback" }, { "address": "0x100cd3d4", "name": "WinHttpReadData" }, { "address": "0x100cd3d8", "name": "WinHttpSetCredentials" }, { "address": "0x100cd3dc", "name": "WinHttpSetOption" }, { "address": "0x100cd3e0", "name": "WinHttpGetProxyForUrl" }, { "address": "0x100cd3e4", "name": "WinHttpSendRequest" }, { "address": "0x100cd3e8", "name": "WinHttpQueryOption" }, { "address": "0x100cd3ec", "name": "WinHttpOpen" }, { "address": "0x100cd3f0", "name": "WinHttpGetIEProxyConfigForCurrentUser" }, { "address": "0x100cd3f4", "name": "WinHttpGetDefaultProxyConfiguration" } ] }, "CRYPT32": { "dll": "CRYPT32.dll", "imports": [ { "address": "0x100cd100", "name": "CertFreeCertificateContext" }, { "address": "0x100cd104", "name": "CertVerifyCertificateChainPolicy" }, { "address": "0x100cd108", "name": "CertGetCertificateChain" }, { "address": "0x100cd10c", "name": "CryptStringToBinaryA" }, { "address": "0x100cd110", "name": "CertFreeCertificateChain" } ] }, "WTSAPI32": { "dll": "WTSAPI32.dll", "imports": [ { "address": "0x100cd3fc", "name": "WTSQueryUserToken" } ] } }, "exported_dll_name": "diagtrack.dll", "exports": [ { "address": "0x100243a0", "name": "?_LoadSharedStringResource@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@K@Z", "ordinal": 3 }, { "address": "0x100cc090", "name": "?gs_lifetimeManager@@3VCLifetimeManager@Diagnostics@Microsoft@@A", "ordinal": 4 }, { "address": "0x10022c30", "name": "RunDll32Main", "ordinal": 5 }, { "address": "0x10022800", "name": "ServiceMain", "ordinal": 1 }, { "address": "0x10022230", "name": "SvchostPushServiceGlobals", "ordinal": 2 }, { "address": "0x10022d50", "name": "UtcSysprepGeneralize", "ordinal": 6 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000ca120", "size": "0x0000015d" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000cd560", "size": "0x00000140" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x000d1000", "size": "0x00009070" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x000df400", "size": "0x00002160" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x000db000", "size": "0x000092e8" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00014ef0", "size": "0x00000038" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00014f48", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x000cd000", "size": "0x0000055c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x000ca008", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x000c927d", "size_of_data": "0x000c9400", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.41" }, { "name": ".data", "raw_address": "0x000c9800", "virtual_address": "0x000cb000", "virtual_size": "0x0000131c", "size_of_data": "0x00000c00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "3.82" }, { "name": ".idata", "raw_address": "0x000ca400", "virtual_address": "0x000cd000", "virtual_size": "0x0000260a", "size_of_data": "0x00002800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.58" }, { "name": ".didat", "raw_address": "0x000ccc00", "virtual_address": "0x000d0000", "virtual_size": "0x00000020", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.45" }, { "name": ".rsrc", "raw_address": "0x000cce00", "virtual_address": "0x000d1000", "virtual_size": "0x00009070", "size_of_data": "0x00009200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.80" }, { "name": ".reloc", "raw_address": "0x000d6000", "virtual_address": "0x000db000", "virtual_size": "0x000092e8", "size_of_data": "0x00009400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.73" } ], "overlay": { "offset": "0x000df400", "size": "0x00002160" }, "resources": [ { "name": "MUI", "offset": "0x000d9f80", "size": "0x000000f0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.82" }, { "name": "WEVT_TEMPLATE", "offset": "0x000d17d8", "size": "0x000087a2", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.76" }, { "name": "RT_VERSION", "offset": "0x000d1408", "size": "0x000003cc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.44" }, { "name": "RT_MANIFEST", "offset": "0x000d1160", "size": "0x000002a1", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.03" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Microsoft Windows Diagnostics Tracking" }, { "name": "FileVersion", "value": "10.0.10586.0 (th2_release.151029-1700)" }, { "name": "InternalName", "value": "diagtrack.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "diagtrack.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.10586.0" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "10f41e56254fb4a6c54b71ca3e6dee8e", "timestamp": "2015-10-30 02:10:19", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 15 }, "data": null, "strings": [ ";{`u#", "6SPQVj", "9wht<", "j=^f90t", "2C4B5r5", ":$:,:4:<:D:L:T:\\:d:l:x:", "4$444@4`4h4t4", "keyword", "GetTokenInformation", "AppInteractivity", "001a1", "base\\diagnosis\\diagtrack\\engine\\throttlemonitor.cpp", "?%?[?", "Unable to open manifest file: %s.", ">-?\\?", "tH9=P", "?'?L?n?", "4N5c5v5", "AsimovUploader_NormalUploadSucceeded", "ActualSequenceNumber", "InfoString", ".?AV@@", "OpenServiceW", "8&9P9v9", "RingBuffer_TooFullToCommitPreCompressBuffer", "WerReportSetParameter", "6@6P6k6", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getregkeyaction.cpp", "<$<@SSj", "GetMemoryInfoAction", ";sltV", "NtQueryInformationProcess", "NormalDbLatency", "8,8?8S8j8", "121V1~1", "0h1w1", "overBatteryThresholdMs", "=<=I=~=", "RegCreateKeyExW", "Trigger_MSACouldntPopulateWithEventSID_UnableToRetrieveMSA", "<.<8<", "UnmapViewOfFile", "dataitem", "0I0{0", "5>6m6", "VortexHttpAttempts", "5$5,545<5D5L5T5`5", "ActionType", "0%0O0e0", "filtername", "HKEY_PERFORMANCE_TEXT", "wnfStateName=", "C`;CXv@", "4$4H4T4x4", "MetadataEngine_InitializeMetadata", "LookupAccountSidW", "Utils_SetRegistryKey", "running", "%d.%d.%s.%s.%s", "1!252", "PID: ", "WriteOperationCount", "AlwaysUpload", "AuthorizationInfo_RuntimeTransition", "AuthorizationInfo_PopulateFromOs", "CriticalSettingsDownload", "HexInt64Field", "base\\diagnosis\\diagtrack\\engine\\action.cpp", "233S3c3", "VWj{X", ":+:R:p:", "ServiceMain_HandleStopEvent", "GetStdHandle", "SOFTWARE\\Microsoft\\SQMClient", "maximumDurationSec=", "0.070S0b0p0", "Metadata_LastLogonTime", "wcsstr", "VVWPVV", "3$444@4H4|4", "f9Y6r)", "TransitionFromEverythingOff", "DiagTrack did not shutdown correctly", "FailingFunction", "8K u3", "ProviderCount", "notexists", "network reset", "0$040@0H0|0", "timed out", " ", "SettingsManager", "datamodel", "seqNum", "TraceBufferBudgetMaxMB", "OpenProcess", "=S=Z=", "1*2h2", "data error", "SessionId", "<\"", "D$8SVW", ";4;l;", "no_protocol_option", "ProcessStartKey", "4'4F4", "alpha.telemetry.microsoft.com", "Setting not recognized", "9L9l9", "ExpandEnvironmentStringsW", "PPShp", "ndualtriggerpropertyfilter", ";5;Y;j;o;", "12730", "DiagTrackPerf", "150818171528Z", "WERLoggerFactory_CreateWERLogger", "AllowAllTelClientSyntheticEvents", "NtQueryWnfStateData", "GQSSh", "SSSVR", "7;7t$", "_purecall", "captureStateProvider=", "<$=.=B=L=`=j=~=", "5$5,545<5D5L5T5\\5d5l5t5|5", "PartA_Tags", "<;:A;l;", "9*:J:u:", "8CHAN", "D$ SVW", "5J5p5", "proccnt", "Win32kTraceLogging", "traceProfileScenarioId=", "4V5v5g6", "-----------------------------------------------", "Escalation for scenario couldn't run because the AoT was not running. AoT is currently owned by: %s", "MaxEscalations", "Redmond1", "1,181@1t1", ";(;0;<;\\;d;l;t;", ";Z@@", ": :5:A:M:Y:e:q:}:", "base\\diagnosis\\diagtrack\\engine\\systemstatemanager.cpp", "5'5?5D5J5^5c5o5~5", "041B1S1]1", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "9,:2:A:R:a:", ";J:J:V:j:", "FLPQQ", "OverrideCopyOutputDirectory", "_vscwprintf", ".didat$3", "wnfstructure", "IdentityType", "Utils_FailedToWriteFile", ">i>y>", "Microsoft Corporation1", "MaxInitialRandomDelayMs", "CanAddMsaToMsTelemetry", "181k1", "BlackBoxTriggerEventsCapacity", ">%>*>0>6><>B>H>N>T>Z>`>f>l>r>x>~>", "<&=-=4=;=B=l=", "invalid argument", "Unsupported consumer TriggerDataType = %d", ";+w#", "ComponentManifestVersion", "7X7j7", ".json", "ManifestRefreshIntervalMilliseconds", "wlan show wlanreport", "notlike", "101e1j1", "initial", "989D9L9", "12678", "6N6\\6u6", "SetWaitableTimer", "9@9p9", "StringFileInfo", "greaterthan", "ConsumerFactory_CreateConsumer", "263d3m3", "3>3^3~3", "N0L0J", "deployment", "r~akow", "<%=W=", "646D6P6p6|6", "doesn't exist", "*4I4f4", "If-None-Match: ", "D$0Phd", "KernelPaged", "uint8", "0-03090~0", "1'1n1", "DelayAction: ", "CcDataPages", "6!6'626?6[6f6s6", "InfoStream_UnableToExpandIdentityString_0", "BackoffMultFactor", "not connected", "L$$9s", "2#2'2+2/2", "triggers", "rAsimov.HashCycleMinutes", "p -p ", "%windir%\\system32\\ipconfig.exe", "sdksz", "Utils_EscalationReasonETWTrigger", "7.797J7u7", "AsimovUploader", "wnfmessagesize", ">=>t>", "pFailed to start ETW Consumer thread", "iostream stream error", "proclsp", ":';I;q;", "TdhFacade_ProviderStats_1", "777]7z7", "7$7K7|7", "TriggerFactory_CreateTrigger", "1.0,0", "portos", "001=1", "%u.%u.%u.%u", "9$90989l9|9", "AllocateLocallyUniqueId", "Trigger_MSACouldntPopulateWithResolvedSid_UnableToRetrieveMSA", "6'6Y6", "TimeStamp", "edition", "WinHttpQueryOption", "\"Metadata_LastPowerSourceChangeTime", "UInt32Field", " 000<0D0x0", "1+1R1", " name=\"Microsoft.Windows.base.diagtrack\"", "TDH_INT16", "WinHttpReadData", "8%9w9", "ClientId.UniqueProcess", "UTC storage creation failed.", "8M8b8", "8D8]8", "Software\\Policies\\Microsoft\\Windows\\DataCollection", "Warning: Imposed structure is larger than WNF buffer. Including hex string representation.", "[ERROR:InType=%u]", "uT9GXuO!E", "Windows", "Extension module signature mismatch. ", "2A2z2", "", "InfoStream_AlternativeTracePreempted_0", "sysmfg", "5B6V6", "6R7v7", "j.XVf", ";R<|<", "CoreTelOptedOutMs", "LdrFastFailInLoaderCallout", "S>", "EventDroppedDb", "WPR_initiated_DiagTrack*.etl*", "ETWConsumer_EtlProcessingThreadProcNoSettingsAvailable", "no message", "PartA", "0L0\\0h0p0", "setting %s has invalid value: %s.", "??8type_info@@QBEHABV0@@Z", "ETWConsumer_EnableProvider", "Trigger_MSAPopulateWithResolvedSID", "InfoStream_UpdateTrace_0", "network_down", "wrong_protocol_type", "J ;H w", "L$0Sj", "4/5r5h6u6", "SoftMaxLoadedScenarios", "DiagTrack_*", "vector too long", "", "base\\diagnosis\\diagtrack\\include\\CoInitializeWrapper.h", "W ^[|", "%Microsoft Windows Production PCA 2011", "https://settings-win.data.microsoft.com/settings/v2.0/", "TransitionCount", "SettingsExpirationMinutes", "bad_address", "EscalationEngine_ExecuteDenied", "REG_NONE", " 0q0|0", "040X0", "0,1<1H1P1p1x1", "040D0T0_0h0s0", "0/1S1X1h1", "7>7w7", "4.5D5K5D7g7", "; ;(;0;8;D;d;l;x;", "D$@SVW", ".text$x", "5(5M5W5r5", "PSWh$i", "j\\^QQ", "?5?k?", ":N:v:", "TelemetryServiceDisabled", "LastQueryResult", "EventId", ":?:t:", "application/json", "L$L_^[3", "HeartBeatIntervalMS", "need dictionary", "\\Device\\Mup\\", "Alternative trace could not be preempted", "SSSSPV", "424w4", "6&7;7@7", "WERLogger_IsConsentLevelEverything", ": ;1;I;h;", "> >,>L>T>`>", "12729", "SystemStateManager_TimerWake", "J$;H$w", "DiskCounters.BytesRead", "CompletionReportCount", "151007181737Z", "V-VW&6)%", "MappedWriteIoCount", "081v1", "SkipTelemetryServiceRules", "5.6<6f6", "TDH_COUNTEDSTRING", "Tracer_UpdateTraceState", ";FLu(", "303\\3", "1f;2u", "wn>Jj", "WTMDisplaySession", "6]6f6{6", "1$242@2H2|2", "platid", "%DiagtrackRegistryRoot%\\SettingsRequests", "systemperformanceinfo", "3'4|4.5d5~5", "7&838U8", "=E=o=", "QWSj?h", "WWWWWWP", "?F?L?Q?", "6$606T6\\6d6l6t6|6", "%hs(%d)\\%hs!%p: ", "3\"3<3P3X3p3", "VarFileInfo", ">J?`?u?", "base\\diagnosis\\diagtrack\\engine\\pdcnetworkactivity.cpp", "Delay (ms): ", "\"Metadata_LastSuccessfulRefreshTime", "8*;J;", "626m6", "3=3]3", "Metadata_LastDeviceArrivalTime", "ProcessInfo", "WaitForThreadpoolTimerCallbacks", "CTracer::SaveTraceToFile() failed", "QPtMh(e", "DeleteCriticalSection", "+?9?B?a?q?", "SPSh?", "6x7<8p8", "20151030033523.477Z0", "savetolocalstore", "IsACOnMetadata_Query", "%windir%\\SysWow64\\dtdump.exe", "_lastpowersourcechangetime", "Couldn't expand identity string. State model does not have transition with name: %s", "Metadata_LastResumeFromHibernateTime", "1\"2=2x2", "<)=;=L=", "1=1Q1", "localId", "PageReadIoCount", "buildflightid", "wsdsksc", "GetProcessDump successful", "%I64x", "7'8F8Y8y8", "^.*exec.*$", "WerpSetIntegratorReportId", "getmemoryinfoaction", "8(8H8r8", "delayMillis=", "SettingsHttpAttempts", "NextWriteSequenceCounter", "<0<@+>L>[>j>", "base\\diagnosis\\diagtrack\\engine\\heartbeat.cpp", "4H5R5`5e5", "CcMapDataNoWaitMiss", "NormalSettingsandManifestDueTime", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\buildstringmetadata.cpp", "0=0X0^0", "InvalidHttpCodeCount", "NonPagedPoolFrees", "*.etl", "DiskCounters.ReadOperationCount", "=j>w>", "1*1O1t1", "9Q:n:", "REG_QWORD", "ComputerHardwareId", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "3 3@3L3T3", "FilterType", "<7=H=Z=", "2#2p2", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\singlepropertyfilter.cpp", "050H0f0", "IsContinuumSessionActiveMetadata_Query", "6$6,646<6L6d6p6", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\iskerneldebuggerpresentmetadata.cpp", ":9;L;d;w;", "TimestampOutputDirectory", "CcMapDataWait", "traceProfileHash=", "393X3}3", "tVSSj", ">U?Z?r?", "8(848T8\\8h8", "9,:::b:h:~:", "7<7C7]7b7x7", "MatchEngine_ManifestUpdateMaintainScenarioList", "alternativeTraceProfileHash", "ScenarioManagerFactory_CreateScenarioManager", "PagedPoolLookasideHits", "aotProfileHash", "L$ 9\\$4s", "msvcrt.dll", "deleteonget", "8{tHQ", "=$=4=<=D=L=T=\\=d=l=", "\\Windows.Uif.static", "TriggerCount", ">$>D>L>T>`>", "tWindows.Server", "9N:`:", "GetCurrentThreadId", "TargetAppId", "MoveFileExW", "G,;0r", "<='>4>L>W>d>", "<2=D=S=", "MatchEngine_CompletedManifestUpdate", "InFlightScenario_ExpandPropertyIdentifier", "5)606", "FreeLibrary", "`.data", "2H3X3f3", "InfoStream_NotImplemented_0", "copyoutputdirectory", "&deviceId=", "iostream", "WerReportAddFile", "^9t$Ps", "L$ _^", "ReturnHr", "ScenarioPath", "CommitTotal", "<\"===Z=5>B>d>", "7=8L8Z8", "pFailed to query Msa. Type: %d, SID: %s", "CreateThreadpoolWork", "SecondTry", "2B3s3", "bldchk", "aotTracePath", "8;8|8", "Escalation for scenario failed.", "_D_^[", "UseDeviceIdBasedSampling", "file exists", "SYSTEM\\CurrentControlSet\\Control\\SystemInformation", "9$9,949<9D9\\9h9", " AND ", "D$HSVW", "PVVj6", "StartTraceAction: ", "GetProcessDump failed to create output file", "0(0D0T0`0", ".header", "CcPinReadWaitMiss", "Flight settings broker failed to get ring name", ";1C?p?v?", "LineNumber", "?,?c?", "4 545T5Z5n5", ":?:_:", "lessthan", "3F3K3\\3", "9/9E9\\9i9", "7*7V7", "0'0a0", "0;s`u", "606@6L6l6t6", "destination address required", "toggletracewithcustomfilteraction", "ProcessTrace", "70I0u0", "Metadata_LastResumeFromStandbyTime", "base\\diagnosis\\diagtrack\\common\\dynamicconfig.cpp", "too many links", "UuidFromStringW", "9{lu&", "InstanceStartTime", "12737", "PPWhp ", "%windir%\\system32\\dxdiag.exe", ".CRT$XCA", "=*=O=T=", "0,0<0H0h0t0", "D$$PSj", "EscalationEngine_Execute", "AsimovUploader_TelClientSyntheticSampledOut", "D$8SV", "GetFileSizeEx", "is a directory", "GetSystemDefaultLCID", "4/5:5S5", "1(1Y1v1", "NormalSettingsDownload", "2?3$4U4{4", "D$LVPh0", "IoWriteTransferCount", "wimbt", "0;0u]", "4D5S5n5}5", "324i4", "070[0", "Qkkbal", "f9y6r", "SetFilePointer", ":8:H:T:\\:|:", "4(5A596", "686C6e6", "0$0@0P0\\0d0", "network unreachable", "CacheIoCount", "?A?}?", "maxfailureescalations", "Trigger_XToken_ProviderReturnedEmpty", "userId", "ComplexData", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers", "3?3c3w3", "ResidentSystemCodePage", "no message available", "5+6S6", "3$303P3`3h3", "SVWjP", "0@0b0r0", "939C9n9t9", "ResolveDelayLoadsFromDll", "2V2]2", "0<1q1", "__DEPRECATED_InfoStream_ScenarioReported_0", "TP_SERVER_BASE_NAME", "??0exception@@QAE@ABQBDH@Z", ">S>}>", "SWh", "Expected ", ".?AV@@", "SSPh0U", "0*0P0", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\radaraction.cpp", "4!5E5h5", "InfoStream_CannotParseValueFromString_0", "%windir%\\system32\\bcdedit.exe", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "RegQueryInfoKeyW", "AppId", "j_ZQf", "scenarios", "CriticalEventDroppedDb", "5'6X6t6", "Duration", "u/8C5t*", "1!1C1", "4F4i4", "9f:|:", "101_1", "C(;C(uE", "@@", "CcLazyWritePages", "CoUninitialize", "ScenarioManager_SkipLoadingScenarios_NotAuthorized", "RegDeleteKeyW", "4-4=4M4[4j4z4", "1h2z2", "Failed to load manifest: %s.", " Metadata_IsKernelDebuggerPresent", "InternalName", ";P;t;", "162T2", "ReleaseSRWLockShared", "Microsoft Corporation1.0,", "DiagTrackAuthorization", ".didat$4", "0!0,0Y0s0H1]1", "5]6o6", "7K7~7", "equal", "UploadEnabled", ": :<:R:X:_:h:", "Accepting scenario.", "%windir%\\system32\\netsh.exe", "8f99t", "6U6^6d6q6~6", ":1:=:R:f:{:", "250701214655Z0|1", "6#6,6C6\\6v6", "KeyName", ".CRT$XCC", "RandomizedBackoffPercentage", "aotScenarioId", "Kernel dump saved (fake)", "7S7n7|7", ":-:6:E:N:]:f:", "7e8t8~8", "050_0", ":1:C:U:g:|:", "=J=T=b=g=}=", "base\\diagnosis\\diagtrack\\main\\serviceglobal.cpp", "=;=j=", "PSSSSSS", "G@#w,", ">V>f>", ";#;1;=;R;};", "RaiseFailFastException", "ConsumerDroppedCount", "D$ )Gh", "PathFileExistsW", "4/595", "1#1*191M1R1j1", "607K7", "base\\diagnosis\\diagtrack\\tracing\\tracemanager.cpp", "L$ WP", "3?3g3", "<(=G=", "595Y5", "=N=_=", "0:0`0|0", "BuildFlightId", ">+?m?", "333T3g3t3", "3$3,343<3D3L3T3\\3h3p3", "8 8N9", "3,4^4", " -pid ", "7B7m7", "EscalationWorkItem_ExecutedAction", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\appidmetadata.cpp", "Translation", "6>6Y6", "ReadOperationCount", "CTracer::Initialize() failed", "3E3Y3", "ValueName", "0(00080@0H0P0\\0|0", "MatchAnyKeyword", "D$ PS", "base\\diagnosis\\diagtrack\\engine\\scenariodef.cpp", "576Y6", "6,686X6`6h6p6|6", "7;7X7x7", "NumberOfThreadsHighWatermark", ":3;g;", "JsonBuilder - too much data", "ServiceMain_RunDll32Main", "EncodePointer", "HKEY_USERS", "^update .* -fd -ets$", "svcVersion", "MatchEngine_ScenarioAgeOut", "FormatMessageW", "tCj:[f;", "ReturnCode", "CanPerformTraceEscalations", "XMLParser_SessionEnd", "memcpy", "Throttled noisiest producer at Trigger Buffer. %s, TLG Name: %s, Hit: %llu, Th: %llu, Bff Size: %u", "CcCopyReadNoWait", "GetModuleHandleW", "ScenarioCancelled_0", "9I9P9g9n9", ")Cl_^[", "1(282D2L2", "1?1g1", "QSVWj![j", "GetSystemInfo", "LoadResource", "u1SVW", "pxmlns", "-flush", "1(181\\1d1l1t1|1", "ignoreFailure=", "TelClientSynthetic", "", "LoadSettingsFromFile", "Metadata_IsContinuumSessionActive", "1+1D1U1", "4%4+424A4H4X4j4w4", "6$6O6", ":K;R;", "LastNormalDownloadAttempt", "deflate", "aThe system does not support NtQueryWnfStateData.", "3C3c3", "REG_DWORD_BIG_ENDIAN", "%windir%\\system32\\powercfg.exe", "InfoStream_ExtensionSignatureMismatch_0", "skipProcessEnumeration=", " http://www.microsoft.com/windows0", "Gdf+G\\fH", "?$?0?P?\\?|?", "TDH_SID", "WinHttpCloseHandle", "https://v10.vortex-win.data.microsoft.com/collect/v1", "nrunexewithargsaction", "&0J0O0e0", "AppStateChange", "%DiagtrackRegistryRoot%\\AsimovUploader", ">,>4>P>`>l>", "z(PhX", "swprintf_s", "TraceExpirationTimer", "version", "FindFirstFileExW", "5&6^6", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getfileaction.cpp", ">%>1>A>S>j>I?U?g?s?", "RealtimeUploadCount", "IsAotExpired", "filename", "161k1w1", "D$ QP", "ToggleTraceWithCustomFilterAction_FailedToCreateFilter", "2L2v2", "FirstLevelTbFills", "9~dt\"", "SystemCache", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\delayaction.cpp", "161Y1s1", "j{Yf9", "pSetRegKeyAction: ", "7.:Q:", "MicrosoftWlanTelemetry", "Washington1", ":?:m:", "7)848A8U8[8f8s8", "EventStoreSizeMb", "TimeToAlternativeExpirationSec", ";';4;O;", "4+525?5", "3$454G4T4^4n4{4", "CacheTransitionCount", "EscalationWorkItem_EscalationCompleted", "base\\diagnosis\\diagtrack\\matchengine\\asimoveventbuffer.cpp", "t$LPh", "DisableProviderGroups", "9-9B9Q9V9h9z9", "=.=F=^=v=", "HKEY_PERFORMANCE_DATA", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\runexewithargsaction.cpp", "SOFTWARE\\Microsoft\\Reliability Analysis\\RAC", "IoOtherTransferCount", "Cd;C\\rJw", "th_9~", "capturestate", ": ;X;", "1\"282[2h2", "MetadataEngine_StartEventThread", ":::m:", "9=9]9", "InfoStream_ExceededMaxSetupDurationMsOnLastAction_0", "_lastresumefromstandbytime", "(type: ", "deque too long", "4#4K4X4|4", "Reserved3", "4Q5a5t5@6P6_6", "D$7G7[7y7~7", "2", ">&?T?f?", ":-;7;t;", "0F0k0", "0d:l:t:|:", "8TASK", ":!;S;", "tickets", "exeName=", "resource unavailable try again", "8,9d9", ":-:7:C:g:u:", "999a9", "L$\\_^[3", ".?AV@@", "ThrottledDroppedCount", ";$;,;4;<;D;L;T;\\;d;l;t;|;", "[ERROR:ConsumePayload(%u)]", "Metadata_LastApplicationInstallTime", ":(:0:<:\\:d:p:", "E PhP", ":_;u;", ";$0G0d0}0", ">+?}?", "010W0q0", "UploadEtlSucceeded", "SnapAlwaysOnTraceAction", "8LEVL", "1(222m2", "metadata", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "=V>^>", "1G1Q1", "3+3A3S3q3", "RecoveredEntries", "9qhu%", "GlobalFree", ":F;p;", "5#616O6]6l6", "=2=R=r=", "s29>w.+>S", "5?5M5R5~5", "api-ms-win-eventing-provider-l1-1-0", ".idata$6", "TEMP@", "8\"9)9", "WaitResult", "\"[ERROR:EventHeader.Flags=%x]", "base\\diagnosis\\diagtrack\\include\\WithFileIoPriority.h", "InitializeProcThreadAttributeList", "BuildLabEx", "12738", "wcschr", " ", "=G=}=", "2,3Y3d3", "ReadOffset", "G ^_]", "address not available", "1(1D1T1`1", "", "D$0PS", "8K8R8n8s8", "j{[f9", "4+4\\4", "CreateWaitableTimerExW", "<(B?|?", "InfoStream_UnactionableScenario_0", "MetadataEngine_RegistryThreadWaitFailed", "505@5w5", "ProviderID", "__DEPRECATED_InfoStream_ScenarioCompleted_0", "PageFaultCount", "6#6<6J6}6", "D$D@P", ";0uA9E", "JsonBuilder - cbValue too large", "W>", "TDH_BINARY", "MaxCancelReports", "4(404P4l4|4", "BufferSize", "111W1q1", "base\\diagnosis\\diagtrack\\matchengine\\transition.cpp", "minute", "%windir%\\system32\\RdrLeakDiag.exe", "3W3d3", "ScenarioDef_ParsingScenario", ".rdata$zETW0", "NumEvents", "<27", "GroupId", "DTSQMLogger_UploadScenario", "<)<><", "base\\diagnosis\\diagtrack\\engine\\triggerlistener.cpp", "DbDroppedCount", "EventDroppedUploader", "RingBufferLatency", "3!3%3)3-3135393=3A3E3I3M3Q3U3Y3]3a3e3i3m3q3u3y3}3", "DiagTrackScenario", "GlobalMemoryStatusEx", ".didat$6", "?_LoadSharedStringResource@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@K@Z", "RegQueryValueExW", ":%;/;", "RestrictedNetworkTime", ":*;h;", "mintimebetweenfailureescalationsms", "[ERROR:MB2WC=%u]", "999f9", "97u-W3", "FindCloseChangeNotification", "t$HPQ", "191M1e1", "ntoggletraceaction", "CcPinReadWait", "^wfp show state -$", "EventData", "DisableCabUpload", "changestamp", "MatchAllKeyword", "aepic.dll", "041r2", "WEVT|", "242G2", "959k9", "WinHttpCrackUrl", "4 404<4\\4d4p4x4", ";m;{;", "1$1<1H1h1t1", "w\\_9~", "=B>q>z>", "=->Y>f>", "AOT started successfully", "AOT in registry started successfully", "GetProcessHeap", "processname", "3@4T4", "WerReportCloseHandle", "%d.%d.%[^.].%[^.].%s", "sample", "uKPPV", ".?AV@@", "nsnaptraceaction", "ServiceMain_StandaloneShutdown", "1C1Q1m1", "SystemProductName", "mathoperation", "_ftol2", "LoadLibraryExW", "memoryinfo.xml", "1@1r1", "WTSAPI32.dll", "LaunchCount", "Utils_ExpandAndCreateDirectory_SkippingDiskRootPath", "9+949K9n9", "9!:J:", "ProcessorNameString", "base\\diagnosis\\diagtrack\\tracing\\tracer.cpp", "Failed to parse scenario.", "5c6s6", "@f94C", "bldtm", "VortexUrl", "1I1P1c1o1v1|1", "SetEndOfFile", "RtlConvertDeviceFamilyInfoToString", "?2?x?", "2>2Q2e2r2", "NumBytes", ":\";L;v;", "GetSecurityDescriptorControl", "DefaultProviderGroupDefinition", "uint16", "diagtrack.dll", "D$$<)", "DiagTrackAotLogger", "7 8F8", "9!9^9u9", "SystemSKU", "4M5m5", "Win32StartAddress", "2!212S2", ":4:@:`:l:t:", "Failed to set ETW session disallow list", ">A?{?", "282d2", "1=1U1t1", "AppIdMetadata_HasAccountPrefix_LsaUnknownType", "4.4p4", "242]2s2", ">G?a?n?", "D$(SVW", "exists", "RegSetValueExW", "|$x9y", "InfoStream_InvalidScenarioXML_0", "2\"2N2u2", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\setregkeyaction.cpp", "t9h0!", "multiply", "L$<^3", "BlackBoxErrorEventsCapacity", "?$?K?Z?", "PointerField", "?@?P?\\?d?", ".?AV@@", "GetSecurityDescriptorSacl", "9U:f:/;R;`;n;", "Metadata_LastAbnormalShutdownTime", "1$1D1L1T1\\1x1", "9)949A9U9[9f9s9", ";F tW", "CreateThreadpool", "6Y7_7s7", "??1exception@@UAE@XZ", ">T?q?w?", ":@;L;", "8EVNT", "2$2@2P2\\2d2", "R!s4Z", "?!?,?1?L?h?", "ClientId.UniqueThread", "Escalation engine Execute() for scenario failed.", "4D4R4|4", "FXPhx", ":H;X;q;", "0%0=0", "base\\diagnosis\\diagtrack\\matchengine\\inflightscenario.cpp", "2'2-2G2M2j2p2", ":T:\\:", "tempDirectory=", "415a5", "EventPayload", ">)>P>", "CcFastMdlReadNotPossible", "UploadEtlFilesOnly", "<@?J?U?a?l?v?", "nstarttraceaction", "operation_would_block", "GetTempPathW", "1.1W1s1", "SharedCommittedPages", "809S9p9}9", "5S5]5u5", "6'6B6O6", "processNameSubstring=", "WideCharToMultiByte", "\"Microsoft Window", "s-9C\\w(+C\\j0^", "^wfp show filters -$", "606<6D6x6", "HeartBeatInterval", "RedirectedStorageRoot", "RegEnumKeyExW", "GetProcessDump: CreateToolhelp32Snapshot failed", "8;9[9", "OtherTransferCount", "D$hSVW", "3$343<3D3L3T3\\3d3l3t3|3", "GetSecurityDescriptorLength", "8_^[]", "PicFreeFileInfo", "; Wait Time (min): ", "SystemCalls", "2)222k2", "WaitForMultipleObjectsEx", "t#9>t", ";&<3~>", "win:Informational", " -dumptype ", "WinSqmIsOptedInEx", ":B;R;", "not a stream", "SettingsHttpFailures", "NextReadSequenceCounter", "%.17g", "ToggleTraceWithCustomFilterAction_FailedToGetTraceHandle", "9CHr4", "QQVWQ", "pGlobal\\UTCRingBuffer_events", "LoggerName", "argument out of domain", "8OPCO", "7B7Z7}7", "6*6N6j6", "718>8Y8", "INVALID_HIVE_NAME", "TracePriority", "737[7p7", "D$ PQ", "IoWriteOperationCount", "MOPR1'0%", "Reserved4", "939:9E9J9Z9", "verbld", "ADVAPI32.dll", "f9F.u", "AppType", "scenarioId=", "bad file descriptor", "SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\", "%hs!%p: ", "8 8D8L8T8\\8d8l8t8|8", "EnterCriticalSection", "%windir%\\system32\\disksnapshot.exe", "WorkingSetSize", "not enough memory", "3/3C3", "8$8D8L8T8p8x8", ">4>D>P>p>x>", "settings", "drivers\\*.mrk", "CLSIDFromString", ":P:`:l:t:", "TestEvent_RADARAction", "0*080l0", "5b5u5", "CloseServiceHandle", "nCipher DSE ESN:148C-C4B9-20661%0#", "EventUnregister", "3-3R3", "Failed to stop ETW trace", "Microsoft.Windows.DiagTrack.XML", "base\\diagnosis\\diagtrack\\matchengine\\asimovhttpclient.cpp", "2@3o3", "2/3u3", "verqfe", ">?>z>", "QSSj SSSPS", "HttpRequestCount", ";$;+;B;H;N;T;Z;`;g;n;u;|;", "1 101@1P1`1p1", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\toggletraceaction.cpp", "osVer", "7*797G7", "> >+>L>m>|>", "3%313I3U3`3u3", "5,585@5`5h5p5", "0K0x0", "directory not empty", ";@;x;", "G<#WL", "O:BAD:(A;OICI;GA;;;BA)(A;OICI;GA;;;S-1-15-2-4100369157-1034187050-1364371154-1714612948-1847883727-388702109-1961059416)(A;OICI;GA;;;S-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795)(A;OICI;GA;;;S-1-15-2-3926089429-3779096810-139998268-2665160821-3597776985-345016210-467500384)(A;OICI;GR;;;WD)", "2/3E3x3", "Filter_FilterEvaluated", "CHttpRequest Waiting for WinHttp to complete", "CcCopyReadWaitMiss", ";CltS", "7L7m7z7", "ReturnHr[PreRelease]", "OnCostedNetworkMs", "8\"8u8", "instanceId", "relatedActivity", "CcMdlReadWaitMiss", ".?AV@@", "Throttled noisiest producer at Event Store. %s, TLG Name: %s, Hit count in WL: %llu, Th: %f%, Persistence: %d", "1&1G1h1", "FiletimeField", ";>;y;", "Int16Field", "SequenceNumber", "212W2n2", "prodsuite", "<@<>D>L>T>p>", "9(:`:", "source", "wscpusc", "performanceinfo", "ToggleTraceWithCustomFilterAction_CreatedFilter", "stoptraceaction", "operation_in_progress", "ResourceFileName", "RingBuffer_CopiedHeaderAndFlushedToDisk", ";\"<@6???", "FailureReportCount", "%windir%\\system32\\whoami.exe", "7-8Q8[8", "2.3I3~3", "AsimovUploader_AddEvent", "9':4:N:\\:", "RtlGetVersion", "D$ 4?", "value", "%DiagtrackRegistryRoot%\\TriggerListener", "DoubleField", "CcDirtyPageThreshold", "6.6?6v6", "_lastresumefromhibernatetime", "CryptHashData", "FileSize", "/0U0b0n0", "=!>0>@>R>", ".?AV@@", "notequal", "XMLParser_DebuggingInfo", "ETWConsumer_ModernAppProviderLoaded", "vLhHT", "2M3_3", ".didat$7", ";(;4;<;\\;d;l;", "PeakVirtualSize", "< =@=U=i=", "NormalSettingsTimer", ">=>a>", "D$TPh0", ";$;D;`;p;|;", "pservicename", "202l2", "8$8,888X8`8l8t8", "~H+~@", "0!1Y1", "Failed to stop ETW tracing session (before starting a fresh session)", "InitializeCriticalSectionAndSpinCount", "vswprintf_s", "787@7H7P7X7t7", "TEMP,", "3P3`3l3t3", "8.8z8", "<4<<E>U>m>", "maxfailurereports", "616=6_6v6", "lessthanequal", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "Y__^[", "8$8+8", "MSAUserIdentityProvider_ExpiredCacheHit", ".idata$3", "939E9e9", "??_V@YAXPAX@Z", "_timesinceosinstall", "towlower", "ProviderPath", ";>t+S", "uRj;S", "=7=D=c=", "internal\\Base\\inc\\DeviceTicket.hpp", ":0:L:\\:h:", "5-6:6J6", ":%:u:", "ForcePickAOT", "t.;:u", "%DiagtrackStorageRoot%\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", "%DiagtrackStorageRoot%\\DownloadedScenarios", "8U9b9", "<<", "??1type_info@@UAE@XZ", "ETagQueryParameters", "UnicodeStringArrayCountField", "0$090L0W0g0", "|hK,_", "D$@SP", "D$DQP", "buffer error", "HKEY_LOCAL_MACHINE", "t9hX ", ".?AVCAtlException@ATL@@", "+0S0z0", "4TP(3", "EventRegister", ";W&>>>Y>s>", "ServiceStatusFilter", ";0;R;;=[=l=}=", "8 808@8H8l8|8", "?gs_lifetimeManager@@3VCLifetimeManager@Diagnostics@Microsoft@@A", "9.:E:X:", "signature", "5#515>5N5", "BasePriority", "9w(t#", "=2=l=", "dbghelp.dll", "3-4N4W4c4", "wpbuildmaj", "base\\diagnosis\\diagtrack\\engine\\filelinetracker.cpp", "base\\diagnosis\\diagtrack\\engine\\metadataengine.cpp", "RingBuffer_ReadFailedDueToInvalidSequenceNumber", "RegOpenKeyExW", "filePath=", "UserSid", "L$89\\$Ls", "processdump_", "s>9>w:+>", "LoadLibraryExA", "969G9e9u9", "InnerText: ", "9(909d9l9t9|9", "alternativeTraceStartTime", "1!21262", "", "??0exception@@QAE@ABQBD@Z", "Gf9z$u[", ".00cfg", "RegDeleteKeyExW", "=#=`=v=", "%windir%\\SysWow64\\RdrLeakDiag.exe", "", "0*171W1h1", "? ?(?*>K>g>", "no such file or directory", "", "", "9:9D9q9", "NetworkState", "D$dVPh(", "<89?H?V?", "7(787D7L7", ">$?4?|?", "UtcSysprepGeneralize", "2\\2o2", ">$>,>4><>D>L>T>\\>d>l>t>|>", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\etwforwarder.cpp", "<&<7%>K>V>s>", "wer.dll", ";e<|<", "ActualChecksum", "file error", "5 5d5x5", "OnBattery", "D$0SVW", "070?0[0", "3c4q4", "L$T_^[3", "UTC_ForceEscalationUpload", "5!6N6", "20151029165758Z", "6!778%9S:", ":4:<:D:L:T:\\:d:l:t:|:", "internal\\sdk\\inc\\wil\\Result.h", "f98u+", "10p0w1", "0(181T1X1d1", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection", "ignorefailure", "?S?t?", "MSAUserIdentityProvider_SuccessfulCacheHitWithErrorRequery", "7X7e7", ": :T:d:p:x:", "AutoLogger-Diagtrack-Listener", "12677", "#Metadata_LastApplicationInstallTime", "=(=E=Z=y=", "GetDeviceUniqueID", "message_size", "already connected", "ConvertStringSidToSidW", "connection_refused", "0Q0y0", "3#3N3W3m3", ">/?J?Z?g?", ":(:-:=:e:", "*.json", "SetThreadPriorityBoost", "TraceSetInformation", "TotalSystemCodePages", "connection aborted", "3\"3Q3F4^4i4", "CriticalSettingsDueTime", "0&0W0]0z0", "RunDll32Main", "LastCriticalDownloadAttempt", "alwaysontrace", "Failed to open ETW trace while processing etl file.", "2$2}2", "1<1D1L1X1x1", ".CRT$XIZ", "CoCreateGuid", "0'1Y1", "=$=<=H=P=p=x=", "8#9C9", ">+?M?c?o?|?", "PreviousHeartBeatTime", "?B?`?{?", "LatencyDataLastUploadTime", "CompanyName", "PageReadCount", "ScenarioManager_SkipRestartingSavedTraces_UploadEtlFilesOnly", "&osVer=", "retwtrigger", "Phone", "9D:K:", "091S1x1", "6&7j7", ";Aw", "NewState", "5W5h5~5", "181Q1^1", "7%8e8", "WinHttpSendRequest", "InputKeyName", "Y9WLw", "=.>5>m>q>u>y>}>", "network down", "<:<^<", "base\\diagnosis\\diagtrack\\main\\servicemain.cpp", "tQvQk", "DiagtrackStorageRoot", "\\AsimovEvent_", "CreateFileW", "L$@WS", "DiagTrack_", "CcFastReadNoWait", "SetFilePointerEx", "KernelNonpaged", "000I0W0d0", "D$ 9\\$4s", ">%>0>U>", "D$ 0)", "windowsperformancerecordercontrol.dll", "1J1P1\\1a1n1", "OnBatterySaverMs", "384x4", "isautologger", "Message", "00a0l0x0", "8EVTF", "Failed to start ETW tracing session", ".text", ":/;B;", "InfoStream_QueryMsaDeviceTicketFailed_0", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\starttraceaction.cpp", "PayloadBytes", "CreateProcessW", "too many symbolic link levels", ";.;C;c;o;", "__DEPRECATED_InfoStream_UploadedEventRejectedByBackend_0", "2!2=2V2", "HttpRequestLatency", "CTracer::UpdateTrace() failed", "CcFastReadWait", "CcDataFlushes", "RRRPh@:", "8#8n8", "=-=<=o=", "LastFreeNetworkLossTime", "connection_aborted", "G?", "wpcoreutil.dll", "0l1~1Q4g4", "SetRegKeyAction", "CConditionalTimer_GetTimeToWakeup_Timeout", "MaxBuffers", "3.3W3n3", "CanCollectOsTelemetry", "ProviderId", "4+4Q4{4", "4*4>4U4g4~4", "0(1>1]1s1", "bssku", "<2<>`>}>", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "%ProgramData%\\Microsoft\\Diagnosis\\DownloadedSettings", "NonPagedPoolPages", "vermin", "CreateXmlReader", "8#;(;", "win:Verbose", "base\\diagnosis\\diagtrack\\factories\\consumerfactory.cpp", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "0L0v0", "7/7P7q7", ".?AVlength_error@std@@", ":C;m;", "5$5,5`5p5|5", "9$9,949<9D9\\9h9p9", "$Metadata_LastResumeFromHibernateTime", "UIntArrayCountField", "MinBuffers", "maxdurationms", "ScenarioStateModel_SkipAnachronisticTrigger", "2T3n3", "USERENV.dll", "IsWow64Process", "< =@=n=", "ETWConsumer_OpenOfflineETLFilesTrace", "1)2s2", "2\"2)2i2", "L$$_^[3", "7 7N7b7", "dword", "toleranceMillis=", "<@4?q?", "WaitForThreadpoolWorkCallbacks", "Warning: Additional data available in WNF buffer. Including hex string representation.", "TDH_HEXINT32", "S-1-12-1-", "JsonVector - exceeded maximum capacity", "2 2Q2V2", "9L$pr/", "pThrottle buffer recover at Trigger Buffer. Index: %hu, Th: %llu, Count: %Iu", "waitTimeMin = ", "797g7", "base\\diagnosis\\diagtrack\\main\\lifetimemanager.cpp", "DiagTrackReleaseType", "PartB_", "SetFileAttributesW", "ResolveDelayLoadedAPI", "_vsnwprintf", "EnteringCriticalOverflowDroppedCounter", "propertykey", "Completion", "PeakCommitment", "base\\diagnosis\\diagtrack\\include\\LifetimeManager.h", "f0(1c1", "3L3j3", "334`4", "InfoStream_AOTStopped_0", "valuetype", "utc.app.json", ">h?u?y?}?", ":$:,:`:p:|:", "DestroyEnvironmentBlock", "=3=[=k=", "PhysicalTotal", "GetVersionExW", "OnAcTimeoutMs", "newest", "9=:u:", "5d5s5", "ControlService", "RingBuffer_ExitingCriticalOverflowMode", "FuzzWindowMs", "<3<`<", "CurrentFailureEscalations", "uR9GXuM3", "Microsoft Corporation1200", "TDH_UINT32", "MicrosoftTelemetry", "ProviderStats", "747o7", "3)3W3a3w3", "WinHttpAddRequestHeaders", " type=\"win32\"/>", "0!0Q0m0", "uXSSW", "<$=5=S=", "374K4", "DisableMatchEngine", "RealtimeDbLatency", ";A;E;I;M;Q;U;Y;];a;e;w;K?", "Q2X2|2", "575]5j5", "HeapAlloc", "LogFileMode", "WinHttpGetDefaultProxyConfiguration", "919L9i9p9~9", "WinHttpReceiveResponse", "8B8l8", "t$0WV", ">9?s?", "3 303@3P3`3p3", "FailureEscalationCount", "AppSessionGuid", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "\\AsimovBuffer_", "QueryPerformanceCounter", "%DiagtrackRegistryRoot%\\Scenarios", "(caller: %p) ", "SleepConditionVariableSRW", "BuildString", "8$8f8", "Y9WLr", ">$???y?", "?6?D?h?", "InFlightScenario_TransitionTaken", "8&848P8U8a8f8v8", "/collect", "2$242D2L2T2\\2x2", "WWWPh", "=$=,=<=D=L=T=\\=t=", "ContainsEscalationSection", "ETWConsumer_SkippingRealtimeSession_UploadEtlFilesOnly", "TransitionName", "2/292Z2o2", "ExitCode", "KEYW8", ".CRT$XCZ", "__TlgCV__", "9pTs=", "9O0u*", ";Uw +>", ":7:O:`:", "3 363e3", "protocol not supported", "InfoStream_QueryMsaUserTicketFailed_0", "8{tVV", "GetSecurityDescriptorOwner", ">$>,>4>P>`>l>", "NormalTimer", "_snwscanf_s", "UnicodeStringArrayField", "WinHttpWriteData", "6<6k6", "9k:|:", "5$5,545<5H5h5p5x5", ".text$yd", "tLj\\Xj", ";s`t+", "0N0s0", "8$8,848<8D8T8l8t8", "VirtualSize", "rsingletriggerpropertyfilter", "9 9@9H9P9\\9|9", "", "HasStrongId", ".CRT$XIAA", ">+?K?k?", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\lastpowersourcechangetimemetadata.cpp", "ProviderDefinition", "not_a_socket", "787O7", "9wDsC", "414G4L4j4s4", ";&;S;", "EventDroppedThrottled", ".?AVlogic_error@std@@", ";k >$>(>,>0>4>8><>P>T>X>\\>`>d>", "2$2<2H2P2p2x2", "3(303t3", "CertVerifyCertificateChainPolicy", "8<8L8X8x8", "TriggerLatency", "12675", "UpdateProcThreadAttribute", "TestEvent_TestEvent", "s(9>w$+>", "393q3~3", "8D9Q9", "8C9~9", "system", ":=:L:", "DeleteFileW", "RecoveredBytes", "WinHttpGetIEProxyConfigForCurrentUser", "5/6s6", "SessionCreateTime", " ", "UniqueProcessId", "^9t$8s", "j\\Zf9TA", "8+8V8^8", "000=0V0}0", "7O8l8v8", "7 7T7f7v7", "0)1L1l1", "2\"2?2\\2y2", "A\\;A`u", "<9=?=K=e=t=", "PageSize", "2>2o2", "8(828;8", "9/9D9Y9m9", " -wait ", " -dumpfile ", "diagtracktempdir", "wnfExplicitScopeType=", "tracepriority", "PQj;Z", "y!WhH", "QueryServiceStatus", "domain", "PPh (", ".?AV@@", "<(=k=", "?terminate@@YAXXZ", ";h;u;", "fileName", "??0exception@@QAE@ABV0@@Z", "RegCloseKey", "9m9v9|9", ">8>T>d>p>x>", "__DEPRECATED_InfoStream_FailedToDeleteEscalationDirectory_0", ">'?r?", "LastDownloadTime", "BufferSizeKb", "FilterLength", "AsimovUploader_RealtimeUploadSucceeded", "QueryNumber", "Watchlist size too large. Size: %d, Persistence: %d", "typeid", "213[3b3o3", "30383D3d3l3x3", ";P(u6;p,u1", "IoOtherOperationCount", "0;w$u", "QPtJh(e", "LsaLookupUserAccountType", "FreeSystemPtes", "CurrentFailureReports", "LastQueryFiletime", "hive=", "142;2W2^2", "GetThreadPriority", ">e?z?", "PrivatePageCount", ": :\\:c:z:", "IsEscalationInProgress", "PSQVWj\\h", "3.4=4K4d4", "UTCRBES3", "0Z0x0", "function not supported", "20151030165758Z0v0<", "SettingsPendingExpirationMinutes", "level", ";8r%3", "?:?^?f?", "8&8G8e8u8", "GetProcAddress", "DiagTrackTestEvent", "<\"0>8>T>d>p>", "> ?a?", "E(SV3", "7%9e9", "Microsoft Corporation1&0$", "TicketExpiryTime", "FindNextChangeNotification", "Wv#Vh", "WWPh0U", ".?AV@@", "captureStateLogger=", "7c7m7", "wpbuildmin", "nCipher NTS ESN:4DE9-0C5E-3E091+0)", "JsonBuilder - destination must be an array or object", "ResetEvent", "SkipDeploymentFilters", "TEMP8", "5!535E5W5i5~5", "<+<[9>I>/?G?", ">%>L>]>", "ReleaseSRWLockExclusive", "HKEY_CURRENT_CONFIG", "2 2f2", "<7s>~>", "CoTaskMemFree", "?5?w?", "838H8]8r8", ".data", "Content-Encoding", "XmlLite.dll", ":E:~:", "ETWConsumer_EtlProcessingThreadProc_NotAuthorizedToProcessShutdownLoggerETL", "6B7f7", "?D?{?", "LatencyData_0", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\tdhfacade.cpp", "StringFromGUID2", "CommitPeak", "7(7S7X7h7", "/enum all", "686E6U6g6p6", "0O0}0", "t$$WW", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", ">&?k?w?", "wpvermin", "sQSVj", "CreateThreadpoolTimer", " Windows", ">&?|?", "D$TSV", "8-898R8]8v8~8", ">\">;>A>", "?.?N?n?", "5#5,5", "?]?i?", "DemandZeroCount", "VortexFailuresTimeout", "GUIDField", ">*>J>s>", "0.0F0X0]0", "GetKernelDumpAction: ", "001t1", "IsSatisfied", "wnfExplicitScopeString=", "T$,SP", "RingBuffer_EventAddedSuccessfully", "8^pthh2U", "StopTraceAction", "GetProcessDumpAction: ", "WorkingSetPrivateSize", "RunExeWithArgsAction: ", "TDH_ANSISTRING", "Metadata_IsAcOn", "CcTotalDirtyPages", "_isacon", "RegDeleteValueW", "1!2I2j2s2", "trigger", "", "=H>h>", "MinimumRefreshIntervalMinutes", "base\\diagnosis\\diagtrack\\include\\Utils.h", "valueType=", "windowRangeMillis=", "PartAExt_", "=]>m>{>", "*31612+85cef474-af76-4076-90ff-a35e1e23d7de0", "wcsncmp", "ClockType", "Scenario has an invalid filter.", "wsdgsc", "<,<:<]w?+>", "3q4!5", "HeartBeat_5", "D$$QP", "4 4(444T4`4h4", "?S>h>", "t3h\\Q", "DiskCounters.FlushOperationCount", "alternativeTraceStopTime", "L$ h0C", "SKUInfo", "< <0Diagnostics Tracking Service", "596M6", "ETWConsumer_ProcessTrace", ">4>:>L>", ";$A>j>w>", "3r4y4", "4 4(4H4P4l4|4", "%temp%", "DiagTrack Extension DLL: ", ":-:A:", ";\";2;G;", "ETWConsumer_SkippingShutdownLogger_UploadEtlFilesOnly", "6\"6'6?6D6Z6", "F0f0k0{0", "L$ 9^", "filename_too_long", "TargetAppVer", "BatteryThresholdExceeded", "TerminateJobObject", "9=9y9", "MaxFailureEscalations", "Rich&", "7T7a7z7", "7/8O8T8", "base\\diagnosis\\diagtrack\\include\\RegistryBasedMetadata.h", "_lastsuccessfulrefreshtime", "InheritedFromUniqueProcessId", "address_in_use", "RegisterServiceCtrlHandlerExW", "ConfigurationClient.dll", ";,;8;X;d;", "file too large", "<0<;<", ".idata$4", "=3>v>", "http://www.w3.org/2005/07/scxml", ":C:P:^:c:", "5'565H5W5f5u5", "wlan show I", ";9;a;", "353U3u3", " rtSV", ">,>8>D>P>\\>r>~>", "EventSubStoreReset", "AOT snapped successfully", "D$|Pj@Z", "scenarioid", ":$ETLUNIQUECVDATA", "BackoffIndex", "w ><>D>L>X>`>", "Complete", "RunExeWithArgsAction was cancelled and the exe was terminated. The service is shutting down.", "@.didat", "Fhj0SP", ".CRT$XIA", "D$ Ph", "D$$PVQ", "0K1l1", "F$9F s+", "TriggerInfo", "MSAUserIdentityProvider_SuccessfulCacheHitWithErrorNoRequery_ActionRequiredFreeNetworkUnavailable", "<9t&S", "83999J9i9z9", "CategoryDefinition", "s69>w2+>S", "category", "6)6\\6i6", "Error", "MetadataEngineBufferSize", "ResumeThread", "111019184142Z", "base\\diagnosis\\diagtrack\\engine\\database.cpp", "EventDroppedEtw", "<'=Q=`=p=", "?what@exception@@UBEPBDXZ", "already_connected", "VirtualFree", "=N=p=", "property", "GetProcessDumpAction: Dumping 32-bit procees failed", "KernelProcess", "divide", "CurrentCompletionReports", "FindFirstFileW", "TdhFacade_EventSourceProviderLoadedError", "1/1=1Q1n1", ":D:T:`:h:", "=)=7=U=|=", "LastInvalidHttpCode", "LifetimeManager_EscalationsDisabled", ".rdata", "7<7D7L7X7x7", "D$pSVW", "CcCopyReadWait", "Int8Field", "5-5i5", "=9>L>X>m>", "OEMOptionalInfoId", "1 1,141h1x1", ";QN>", "D$XSVW", "incompatible version", "telemetry.ASM-WindowsDefault.json", "PercentageOfAlwaysOnTraceRunning", "regKeyValue=", "Disabled", "MSAUserIdentityProvider_SuccessfulCacheHitNoApiPresent", "MSAUserIdentityProvider_SystemSID", "<4=H=", "ContextSwitches", "TdhLoadManifest", ":/;c;p;", "686@6H6X6`6", "0[1{1", "DiagTrackTrace", "SOFTWARE\\Microsoft\\Internet Explorer", "4/595o5", "=&>X>", "OriginalFilename", "6G6m6", "_iskerneldebuggerpresent", "InfoStream_DatabaseFailed_0", "=E>W>", "TicketTarget", "_CxxThrowException", "=6>C>", "7'828", "5C6t6", "2H3p3", ">Z?n?", "%windir%\\system32\\msinfo32.exe", "SetThreadPriority", "WasPreempted", "greaterthanequal", "7\"777L7a7v7", "?3?Z?{?", "OnBatteryMs", "GetUserGeoID", "Live kernel dumps are not currently available. This is a placeholder. Enjoy...", ":@;~;", "WinHttpSetOption", ">-?9?", "SystemDefault", "read only file system", "@.reloc", "WTSQueryUserToken", "LastBootTime", ";7ui3", "9W9u9", "CHttpRequest async operation", "Keyword", "0base\\diagnosis\\diagtrack\\include\\Transition.h", "EnableProperty", "LogHr", "2Q3x3", "545D5c5p5", "G0;0r", "8L9e9v9", "ScenarioManager_AcceptScenario", ".?AV@@", "HKEY_CLASSES_ROOT", "*.rbs", "3/4A4", "RingBuffer_WroteOverflowData", "thread", "RacSampleNumber", "U0S0Q", "L$HSj", "=6>n>", "escapedString", ">#>2>", "y}Ph`", ">\">'>5>", "<+<<Q>a>h>", "", "CcFastMdlReadResourceMiss", "getkerneldumpaction", "Checked", "%windir%\\system32\\dispdiag.exe", ";/6", "PagedPoolFrees", "Process32NextW", "444\\4}4", "MatchEngineBufferSize", "545<5D5P5p5x5", "DiagTrackAlternativeLogger", "3&4C4", "HKEY_PERFORMANCE_NLSTEXT", "GetRegKeyAction: ", "4!5<5A5h5m5~5", "LastEventSizeOffender", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\toggletracewithcustomfilteraction.cpp", "PrefilterThreshold", "`021j1", "PRAID", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "9F:}=", "%04d-%02d-%02dT%02d:%02d:%02d.%07dZ", "0a1u1", "CreateXmlWriter", "848E8R8", "ReleaseType", "Failed to process ETW trace", "InitializeConditionVariable", "InfoStream_InitializeTracer_0", "SiteCode", "operation", "COUNT(", "InfoStream_ProcessCreationFailed_0", ";(<:^>y>", "MultiByteToWideChar", "1,1q1w1", "616A6X6e6}6", "FlushViewOfFile", "RevertToSelf", "1)1C1X1", "5 5(505<5\\5d5l5t5", "; ;(;4;T;`;", "Alternative trace started successfully", "2$2,242<2D2L2T2`2", "memcmp", "BIOSVersion", "AuthorizationInfo_Startup", "triggercriterion", "ImageTimeDateStamp", "4\"404m4w4", "Microsoft Time-Stamp PCA 20100", "IsContinuumActive", "pSnapAlwaysOnTraceAction: ", "base\\diagnosis\\diagtrack\\engine\\triggerbuffer.cpp", "> >*>E>O>m>", "diagtrack_win.dll", "TDH_UINT64", "1$1,141<1H1h1p1x1", "base\\diagnosis\\diagtrack\\include\\MemoryMappedStream.h", "CreateJobObjectW", "Query values failed: 0x", "traceProfile=", "CcLazyWriteIos", "CloseThreadpool", ">(?,?0?4?8?I>S>g>q>", "2)252Q2t2", "ScenarioName", ".idata$2", "8(8D8T8`8", "processId = ", ";$;4;@;`;l;", "message size", "3=3W3^3u3", "base\\diagnosis\\diagtrack\\matchengine\\scenariostatemodel.cpp", "3,4o4", "TebBase", "9D$4w", "SVWj2^", "D$89\\$Ls", "X-AuthXToken", "REG_EXPAND_SZ", "8U9e9", "REG_MULTI_SZ", "FlushTimer", "=W>a>", "1B1i1", "465p5}5", "EditionID", "2 2T2d2p2", "UseMsFlushTimer", "FXSPh", "api-ms-win-eventing-tdh-l1-1-0.dll", "alternativeTracePath", "747D7P7X7x7", ">8>H>P>t>", "argument list too long", "ErrorValue", "^[\"]?%temp%[\"]?\\\\.+[.]cab[\"]?$", "WPRCDisableBuiltinProfiles", "3_3f3", "0F0y0", "LeaveCriticalSection", "ServiceMain_Disabled", "TDH_FLOAT", "D$0QP", "4C5e5q5", "identifyingInfo", "rand_s", "5(5D5T5`5", "TimeStampInterval", "5+5J5i5", "ImageName", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\werloggerphone.cpp", "D$TVPh", "Validator Error: Unable to load error string to decode error.", "PagefileUsage", "month", "D$xSVWj", "Alternative trace snapped successfully", "161R1i1|1", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getprocessdumpaction.cpp", "SequenceNumberEligibleToBeErased", "222S2", "Attribute: ", "\"Microsoft Time Source Master Clock0", "ProductVersion", "~(_^]", "ScenarioManager_InvalidScenario", "", "8W8`8", "ScenarioManager_LoadingScenarioFileStart", "WinHttpConnect", "SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows", "JsonBuilder - cchName too large", "%s-%s", "t$dWW", "VWj0P", "wcsnlen", "9;9l9", "PeakWorkingSetSize", "Gp;GxsL", "1U2{2", "1?1R1i1}1", ">7>n>", "traceprofile", "PWWWj", "VirtualAlloc", "4 4.4@4W4", "WinHttpSetCredentials", "8#898_8", "InfoStream_DownloadOneSettingsNamespace_0", "systemonly", "PagedPoolAllocs", ":D:U:d:y:", "9 :;:", "", "alternativeTraceIsAutoLogger", "FDPhT", "5U5Z5", "base\\diagnosis\\diagtrack\\include\\SettingsDownloader.h", "Process32FirstW", "1$1D1", "mintimebetweencompletionescalationsms", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "WSSPS", "D$\\SPj", "6\"6C6T6}6", "t.;9u", "0+0T0Y0k0", "Result", "5N6a6", "_wtof", "ConnectivityRestrictedNetworkTime", "CcMdlReadNoWait", "UnregisterWaitEx", "list too long", "4M4{4", "MSAUserIdentityProvider_NoCacheHitAfterPopulate", "6q7v7", "categoryid", "SnapTraceAction", "=%=6=\\=g=", "NtStatus", "base\\diagnosis\\diagtrack\\matchengine\\asimovsyntheticevent.cpp", "CcPinMappedDataCount", "?4?@?V?p?", "?RRSPQWR", "D$tVPhD", "CloseThreadpoolTimer", ">U>_>", "VS_VERSION_INFO", "7+8u8", "too many files open", "TDH_INT32", "RealtimeEventUploadTimer", "TDH_COUNTEDANSISTRING", "7(747<7p7", "LocalAlloc", "9(909P9X9t9", "9,:<:H:P:p:", "OutputDebugStringW", "nradaraction", "ScenarioId", "activity", "6$6,686X6d6", "OLEAUT32.dll", "provider", "ImageChecksum", "interrupted", "REG_DWORD", "bad address", "0;{`u", "O0M0K", "&ms=1", "realloc", "HardFaultCount", "0O1T1f1", "7:8h8", "HKEY_CURRENT_USER", "FreeResource", "_isescalationinprogress", "copycab", "SystemStateManager_ServiceControlTimeChange", "?4?@?`?l?", "twSSh", "Failed to update settings", "application/x-json-stream; charset=utf-8", "NonPagedPoolLookasideHits", "C(j0j", "KernelTime", "6(6H6P6X6`6l6", "InfoStream_WatchListExceededWarningSize_0", ";=;B;H;a;g;", "MatchEngine_ScenarioCompleted", "L$89^", "%DiagtrackRegistryRoot%\\TraceManager", "identifier removed", "%DiagtrackStorageRoot%\\ETLLogs\\AutoLogger", "Default", "s0*1:1", "s#9>w", "PVj@hD;", "6!7'767k7w7", "ScenarioDef_FailedToCreateTrigger", "6+6?6c6", "FixedUIntArrayField", "5-5T5", "5(505d5t5", "InfoStream_ExeTerminated_0", "base\\diagnosis\\diagtrack\\engine\\setupworkitem.cpp", "8>8_8", "K>b>", ":I;l;", "2(202@2\\2l2x2", "3!3{3", "C(j0VP", "nsetregkeyaction", "1B1r1", "~Tu2A", "Cache-Control", "AsimovUploader_PersistEvent", ":#:8:_:", "XML written to file: ", "9,9W9\\9t9", "5V5}5", "ptscenarioname", "MetadataEngine_EventThreadWaitFailed", "9CHrC", "F$+F ", "GetModuleFileNameA", "PackageFullName", "SHLWAPI.dll", ";$;,;4;<;D;\\;h;", "ResetEventStore", "%windir%\\system32\\wscollect.exe", "TDH_INT8", "D2|f#", "GetWNFStateAction", "TotalSize", "bad_file_descriptor", "protocol error", "state", "dLastHeartBeatTime", "matchbehavior", "CommitLimit", "base\\diagnosis\\diagtrack\\engine\\scenariocachelru.cpp", "0,0B0", "REG_LINK", "GetSystemDirectoryW", "99:L:", "8-8N8", ".rsrc$01", "5L5\\5h5", "1$1,141<1D1L1T1\\1d1l1t1|1", "3(30383D3L3d3t3|3", "Start", "Length", "Metadata_LastSuccessfulRefreshTime", "?(?:?L?i?", "StopTraceAction: ", "5\"5w5", "5*5W5{5", "kernel_dump.dmp", "Reserved2", "_unlock", "6 6(6\\6l6x6", ":3:L:e:{:", "C`+C\\j0", ";=<]<", "; Tolerance (ms): ", "MaxCompletionReports", ":';4;I;", ";base\\diagnosis\\diagtrack\\engine\\escalationengine.cpp", ".?AVout_of_range@std@@", "3U3i3}3", "4<4H4P4", "DecodingDroppedCount", "0;w`u", "RefreshInterval", "=&=6=G=U=g=", "6&6;6P6e6x6", "2 202@2P2`2p2", "EscalationWorkItem_CopyOutputDirectoryPath", "FXPh ", "!0A0v0", "RedirectedRegistryRoot", "UTCReplace_", ".rsrc$02", "D$ 9^", "D$PQP", "595S5x5", "SOFTWARE\\Microsoft\\SQMClient\\Windows", "&sku=", "GetLastError", "memcpy_s", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\telemetryprotocolfilter.cpp", "4.4B4I4N4`4", "RealTimeTimerSnapMillis", "%I64u", "SOFTWARE\\Microsoft\\TelemetryClient", "OpenSCManagerW", "GetTempFileNameW", "PPPQV", "6>8S8", "Escalation Type: ", "commandLine=", ":+:V:w:", "wrong protocol type", "Unable to open manifest string: %s.", "pointer", "ServiceMain_DllMain_Unregister", "MetaDataTypeName", "CommandLineHash", "InFlightScenario_AddMatchedTrigger", "2>2h2q2", "SvchostPushServiceGlobals", "ServiceMain_ServiceMain", "282Z2j2", "324o4", "2*202I2S2(3F3", "/srumutil", "maxcompletionescalations", "3G3S3b3}3", "9CPr,h", "4\\4e4", "2[2i2", " processorArchitecture=\"x86\"", "7*7M7\\7j7", ">+?U?d?t?", "2!3z3", "ConsumerDroppedProviderCounts_0", "=)>>>", "8H$tj", ";#;D;", "ETWConsumer_StopTrace", "6!7/7S7|7", "4$4,444<4D4L4T4\\4d4l4t4|4", "CriticalOverflowEntersCounter", "SOFTWARE\\Microsoft\\SQMClient\\Windows\\CommonDatapoints", "invalid vector subscript", "_fail", "5 5$5(5,5 6$6@6`6", "ntdll.dll", "Setup for scenario timed out during final action. Current runtime: %d ms. Maximum allowed runtime: %d ms.", "97:}:", "__DEPRECATED_InfoStream_ToggleTraceStarted_0", "flags", "GetNativeSystemInfo", "0+1:1H1k1u1", "connection reset", "CryptDestroyHash", "8K9m9|9", "UTC_Storage_Error.err", ":K;_;v;", ";c;3<", "-report", "FilterFactory_CreateFilter", "SubmitThreadpoolWork", "1^1g1z1", "8+8v8", "4-4e4", "_amsg_exit", "879]9", "__DEPRECATED_InfoStream_DownloadedTelemetryManifest_0", "TickCountSinceLastWakeup", "969c9", "7'7H7W7e7", "snapalwaysontraceaction", "7)7m7%8K8h8", "numeric", ">Y>s>z>", ">\"?P?p?", "%hs(%d) tid(%x) %08X %ws", "9/9?9S9s9", "TDH_UINT8", "6X8j8", "alternativeTracePriority", "telemetryprotocolfilter", "9@9P9\\9d9", "osver", "ScenarioInstanceId", "B ;B$w", "3/3F3S3k3", "_wf9~", "RegNotifyChangeKeyValue", "stream end", ">->8>Q>`>w>", "4*5U5}5", "676O6`6}6", "producerMap", "RingPersistence", "6L6}6", "CanCollectHeartbeats", "G@9w@r", "Microsoft", "D$$9t$8s", "D$4VPh", "0V1r1", ";7uT3", "FailFast", "G,+G(", "8-9_9", "__DEPRECATED_InfoStream_NewVersionOldTimestamp_0", "alwaysontrace.etl", "<4=_=h=", "ProducerThrottleTimer", "MaxCompletionEscalations", "^[\"]?%temp%[\"]?\\\\.*[..|\\\\].*[.]cab[\"]?$", "6S6l6", "ThreadCount", "9 9$9(9,90949", "UnhandledExceptionFilter", "0@0J0h0", "2+2F2", "__dllonexit", "L$ Qj", "Metadata_IsEscalationInProgress", "$!|$$", "9O9h9", "10433", "4&4@4", "7M8z8", "isSetupAction=", "SetupCount", "TdhGetEventInformation", "aotIsAutoLogger", "SequenceNumberToErase", "4$5C5Y5", "Partner: '%s', Feature: '%s', Parameters: '%s', ClientETag: '%s', ServerETag: '%s', Changed: '%d'", "\\scenario_data.xml", "NtQuerySystemInformation", "LastConnectivityHeartBeatTime", "8<8L8f8", "536u6", "=$=4=@=`=h=x=", "7,737>7W7^7i7", "Failed to open process: access denied", "Internal", "InstanceId", "advapi32", "889i9", "9U9}9", "IdentityString", "SetRegKeyAction: module not supported", "CompletedTime", "2@3O3U3^3t3", "7F8_8p8", "tracePriority=", "CRYPT32.dll", "{11D8A17B-F2D8-4733-B41B-6F4959ACD701}", "6!7_7", "Flight settings broker returned an empty ring name", "invalid string position", "[ERROR:BadSidLength=%u]", ":$:E:R:", "Metadata_LastUnlockTime", "; <.<4<=f>", "W9F(u.PPVh $", "InfoStream_VortexErrorResponse_0", "$040@0H0", "%DiagtrackStorageRoot%\\Sideload", "X-Shed-Non-Critical", "expression", "SetupWorkItem_ExecutedAction", "s\\;s`tG", "VVPh0U", "DisableThreadLibraryCalls", "4<4c4", "ImpersonateSelf", "InfoStream_StartTracing_0", "< <@5?:\\:", "5@5P5\\5d5", "DestinationPath", "6,7\\7", ")Microsoft Root Certificate Authority 20100", "ScenarioManager_InvalidScenarioFileName", "RunExeWithArgsAction", "gTreatDeviceAsXbox", "Microsoft.Windows.Mobile.Shell.Chrome", "8&9u9", "7W7z7", "TraceManager_SnappingTrace", "deviceClass", "AcquireSRWLockExclusive", "100701213655Z", "LastBootTimeMetadata_Update", "F,+F(", "PowerMonitor.BatteryConsumptionThreshold", "WaitForSingleObject", "4&4G4Y4", "cross device link", "7,757W7t7", "_t#f;U", "EventDroppedConsumer", "keyname", "base\\diagnosis\\diagtrack\\matchengine\\asimovuploader.cpp", "WERLogger_AddFileToCAB", "pidExpansionString=", "4%5M5m5", "Gd+Gh=", "RingBuffer_RecoveredDataFromDirtyShutdown", "?U?p?", "PdcNetworkActivation_Deactivate", "servicestatusfilter", "bad function call", ">0?o?", "FindNextFileW", ":&;,;1;\\;b;g;", "8$8,888X8`8h8t8", "appId", "#0-0:0G0", "hexint64", "3j=hl", "UpdateID", "5,6>6L6", "\\$4htl", "WerReportCreate", "LastPowerSourceChangeTimeMetadata_Update", "generic", "PdcNetworkActivation_2", "Failed to stop AutoLogger ETW tracing session (before starting a fresh session)", "7\"7t7", "alternativeTraceScenarioId", "ServiceMain_FinishedInitialize", "7$70787\\7d7l7t7|7", "ThreadId", "RaiseException", "=o={=", "<,6", ":8:_:l:", "NoNetworkTime", "DirtyPagesWriteCount", "TDH_POINTER", ";4;D;P;X;", "IsContinuumSessionActive", "DeleteProcThreadAttributeList", "8:9|9", "8:8J8O8U8Z8q8}8", "242R2a2o2", "8_8l8", ":&;4;Z;", ":$:D:L:T:`:", "base\\diagnosis\\diagtrack\\engine\\escalationworkitem.cpp", ".temp", ":::s:", "InputPath", "C\\;C`t", "ImageFileName", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getmemoryinfoaction.cpp", "2!2N2h2$3", "EscalationsDisabled", "SinkStateOrdinal", "MaxBackoffAttempts", "InfoStream_SetupFailed_0", "D$8>@>L>T>t>", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "D$ Pj", "_wcsicmp", "3,4q4", "HRESULT", "ControlTraceW", "=$=C=z=", "8<8I8", "QQSV3", "9(9c9", "5,585@5t5", "", "MatchEngine_ManifestUpdatePruneScenarioList", "0?0E1", "<6@@", "no space on device", "[%hs(%hs)]", "4@4{4", "Unactionable scenario (no reports or escalations remain).", "2U3b3", "=7=F=T=", "RingBufferPersistence", "?\"?(?9?J?X?f?v?", "LastConnectivityLossTime", "network_reset", "map/set too long", "1$1:1J1f1", "Global\\UTCUploaderStatsSharedMemory", "ScenarioManager_ExpireTraces", "MaxFailureReports", "= =@=H=P=\\=|=", "t$HQP", "address in use", "505:5Q5", "E(SVW", "LastPersistedEventTimeOrFirstBoot", ">8>V>", "2?3R3a3", "Scenario has an invalid filter. Filter is: %s.", "0123456789ABCDEF", "OpenTraceW", "6*7D7M7", "Alternative trace was not present in manifest and was stopped successfully", "Spare", "PartA_iKey", ".didat$5", "9!9j9", "4*444D4[4h4}4", "SkipScenarioExpiration", "\">A>P>k>q>", "Failed to open ETW trace", ":/:@:Q:b:u:", "|$TVPQ", "4+4D4[4", "uploadcab", "ExitCurrentElement: ", "506x6", "inappropriate io control operation", "SetWaitableTimerEx", "invalid seek", ">$>@>P>\\>d>", "EscalationWorkItem_CopyOutputDirectoryAlreadyExists", "2!3^3", "D$lPh0", "Failed to enable ETW provider: %s", " ver=", "broken pipe", "4&5o5", "saveToLocalStore=", "baseType", "Failed device ticket query.", "; <0<<@@", ".?AV@@", "6e7t7", "<'<>4L4", "DiagTrackSpew", "1%1A1J1b1f1u1", "Query value failed: 0x", "CreateToolhelp32Snapshot", "i*j@P", "ThreadState", "ras diagnostics set rastracing * enabled", "KERNEL32.dll", "Severity", "0 000@0P0`0p0", "TelemetrySampleNumber", ";\";:;H;", "__DEPRECATED_InfoStream_SideloadedManifestEnumerationFailed_0", "error", "LastPowerSourceChangeTime", "GetBuildSignature", "Signature", "MSFTInternal", "CcMdlReadNoWaitMiss", ">-?7?D?W?f?", "4$525?5[5g5~5", "10.0.10586.0", "1c1w1", "; ;,;4;h;x;", "WINHTTP.dll", "CopyFileW", "8'9_9", "no buffer space", "G(9G$u", "UInt8Field", "SetEvent", "3B3p3", ":%;/;>;D;U;", "WatchlistThrottleThreshold", "CreateEnvironmentBlock", "IsACOn", "base\\diagnosis\\diagtrack\\common\\xmlfacade.cpp", "9(9^9", "UInt64Field", "uISSj", "ResidentPagedPoolPage", ")Fh)^l_^[", "CurrentCompletionEscalations", "D$PSVW", "2&2A2a2", ">;>\\>e>z>", "D$hQP", ";0;=;q;", "invalid map key", ".rdata$zETW2", "Y9~\\t", "9^ltG", "858`8", "svolsz", "131]2", "QQSVW", "ScenarioManager_InitialTraceSetup", "1&242I2~2", "SettingsBaseUrl", "Trigger_MSACouldntPopulate_NoSID", "no_buffer_space", "ptraceprofilescenarioid", "TdhFacade_EventSourceProviderLoaded", "containsTolerance=", "8*:-;6;b;", "1#1(1@1E1a1f1", "osinsty", "VSj?Z", ";R;_;", "9<9L9X9`9", "ScenarioManager_LoadingScenarioFileStop", "device", "MaxInUseScenarios", "4/5\\5", "ConnectivityNoNetworkTime", "AvailablePages", "TEMP4", "9<9L9X9`9x9", "IsAlternativeExpired", "Failed to open process", "172O2o2", "RPCRT4.dll", "srand", "?$?0?8?l?|?", "custom", "GetWNFStateAction_FailedToQueryWNF", "Provider", "Hardware\\Description\\System\\CentralProcessor\\0", "Y9SLrJw", "Created directory: ", "0,0Y0", "operation not supported", "s\\;s`t_", "_buildstring", "Enabled", "PreviousTriggerTime", "", "network_unreachable", "464;4L4q4}4", "AsimovEventDumpDirectory", "GetCurrentProcess", "?0?L?\\?h?p?", "ETWConsumer_EndExistingTrace", "?8?H?T?\\?", "=:=E=n=", "not supported", "CommitMB", "_^[Y]", "WerReportAddDump", "1(1;1", "Content-Type", "en-US", "baseData", "Accept", "__BUILDDATE__", "SkipDownloadedSettings", "TDH_UNICODESTRING", "DiagTrackWP", "EventName", "WinHttpSetStatusCallback", "Microsoft Windows0", "Unknown", "\\events", "ScenarioManager_UpdateNormalSettingsTimer", "3$3,343<3L3X3`3", "9>9W9c9|9", "CertFreeCertificateChain", "StartedNewAoT", "0,080X0`0l0t0", "1@1P1\\1|1", "InfoStream_StopTracing_0", "G<)_h)_d)_T", "ScenarioDuration", "4)4=4Z4g4", "base\\diagnosis\\diagtrack\\main\\extensionmanager.cpp", ">!>&>0>A>F>P>a>q>", "><>^>p>", "InfoStream_AcceptingScenario_0", "Couldn't expand identity string. State model does not have matching trigger.", "CcReadAheadIos", "Microsoft.Windows.DiagTrack", "1(1@1R1r1", "CryptAcquireContextW", "partner", "6-7O7", "strict", "?$?>?K?e?", "ConnectivityHeartBeatInterval", "TotalSystemDriverPages", "4.4W4n4", "REG_BINARY", " Operating System", "1X1i1", "Query key failed: 0x", "base\\diagnosis\\diagtrack\\matchengine\\asimovsharedpartastate.cpp", "no protocol option", ";-;3;@;V;", ";<=d=", "maxinflightinstances", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "262<2I2z2", "FixedUnicodeStringArrayField", "LastPowerSourceChanceTimeMetadata_Query", "3(3P3^3z3", "SVWj@", "base\\diagnosis\\diagtrack\\include\\samplingnumber.hpp", "8(8S8X8h8", "not_connected", "RingBuffer_EnteringCriticalOverflowMode", ".?AVbad_function_call@std@@", "base\\diagnosis\\diagtrack\\engine\\connectivityheartbeat.cpp", ";$;,;4;<;D;P;p;|;", "SystemManufacturer", "X[_^]", ":';A;g;", "t$0QP", "3K5p5", ":D:Z:", "expectedtoexist", ";L;V;", " -handle ", "RunExeWithArgsAction_ProcessExitCode", "too_many_files_open", "0%080L0", "849{9", "s7+1W", "SetLastError", "strnlen", "<]f>", "8::E:", "<,<<i>", "768@8[8", "string", "1+2F2Y2`2i2", "9):V:", "677f7", "%DiagtrackStorageRoot%\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", "ProcessStarted", "Accept-Encoding", "Trace profile needs more memory than the total system budget", "r2f;E", ".?AV@@", "1Q1p1", "8G$t^", "9 9@9L9T9t9|9", "1$1q1", "wnfinfo.xml", "%windir%\\system32\\logman.exe", "PQRj+", "8#8:8", "ScenarioMetadata", "notregex", "vector too long", ".?AVResultException@wil@@", "ScenarioManager_RejectScenario", "UploadWindowMillis", "feature", "3$3W3]3n3", "sourceString", "InFlightScenario_InSinkState", "psavedtrace_", "Escalation for scenario succeeded. Escalation type: %s", "timed_out", "t+;~(t", "3*30363G3L3Q3Z3t3", ";K;Z;h;", "GetProcessDumpAction: CreateProcess failed", "4,4L4u4", "Vj@^Vj", "8+838", "RingBuffer_TriedToEraseAnIncorrectSequenceNumber", "u$WSQ", "tdh.dll", "171l1", "InfoStream_AoTNotRunning_0", "ImpersonateLoggedOnUser", "VortexHttpFailures4xx", "L$(GW", "1<1f1", "InfoStream_ProducerThrottled_0", "UUUUV", "address family not supported", "TimerName", "><>H>P>", "yL_^]", "4!565E5X5", "InvalidHttpCodes", "GroupDefinition.", "0%0@0", "onfailure", ":d;~;", "f92tZ", "8?8l8", "C,+C(", "TDH_INT64", "\\Windows.Uif.xml", "FilterData", "SkipSoftLandingRuleSignatureValidation", "GetProcessName successful", "0M1a1", ".rdata$zETW9", "809|9", "<, iterator", "Authorization: MsaToken ", "3'3-3B3", "?0?8?@?H?T?t?|?", "state not recoverable", ">&?R?\\?r?", ":\";a;", "TdhFacade_ProviderUnloaded", "j.Xf9", " ", "PicRetrieveFileInfo", "Alternative trace exceeded duration and was stopped successfully", "NtSetInformationFile", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\fileinfofilter.cpp", "2/2J2Y2", "Zf;OT", "FeatureSetType", "2E3b3", "TraceManager_SkipConfiguringExpirationTimer", "5]6v6", "TlP0X", "LastTelSettingsRingId", "%windir%\\system32\\settingsynchost.exe", "connection_already_in_progress", "FilterRepresentation", "StartTraceW", "AppIdMetadata_HasAccountPrefix_PrefixUnknownType", "8?8i8", "GetWNFStateAction_NotEnoughTypes", "3 3,343h3x3", "Priority", "no child process", "MSAUserIdentityProvider_SkippingCacheDueToTestHook", "Utils_UrlEscapeStringFailed", "InfoStream_Dumping32bitProcessFailed_0", "index", "7(7p7", "9>9b9", "2#232S2k2", "747l7", "io error", "7;8A8m8", "CreateTime", "exename", "CanCollectCoreTelemetry", "3$343@3H3|3", "607@7L7T7t7", "AlwaysOnTraceRefreshDurationSec", "!Metadata_IsContinuumSessionActive", ":WWWj", "base\\diagnosis\\diagtrack\\matchengine\\state.cpp", ")sh){l", "WEVT_TEMPLATE", "EventWrite", "4)464h4", ">A?N?", "fileinfofilter", "base\\diagnosis\\diagtrack\\matchengine\\ringbuffer.cpp", "PhaseShiftTimer", "8 8(8H8P8l8|8", "7'727?7S7Y7d7q7", "ToggleTraceAction: ", "Gdf+Gh", "RunExeWithArgsAction was cancelled and the exe was terminated. The executable took too long.", ".rdata$sxdata", "RADARAction", "899d9i9", ";;;W;k;", "PWSjH", "2 2.2=2^2n2v2~2", "CurrentType", "t$0PQ", ".?AU?$default_delete@VCScenarioStateModel@Diagnostics@Microsoft@@@std@@", "4:5]5", "wcscpy_s", "=*>W>", "DiagTrack Release Type: ", "LockResource", "484Z4j4", "flightid", "stream error", "TimeToAotExpirationSec", "RemoveDirectoryW", "5/6;6", "272E2f2", "3 3(30383D3L3d3l3t3", "GetSystemTimeAsFileTime", "memset", "RingBufferEventStore_FlushingPreCompressBuffers", ">P>`>l>", "RegistryKeyFilter", "Failed to copy file due to sharing violation: ", "PhysicalAvailable", "BinaryField", "protocol_not_supported", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\servicestatusfilter.cpp", "base\\diagnosis\\diagtrack\\common\\threadprivilegemanager.cpp", "GetTickCount", "<#===Z=", ":C:{:", "LastBootTimeMetadata_Query", "CoInitializeEx", "ras diagnostics set rastracing * disabled", "wpvermaj", "operation canceled", "?/?M?a?g?", "DTSQMLogger_SQMSingleInfoStreamRow", "_lastunlocktime", "=&>S>", "444D4P4t4|4", "<$<,<4<<3>O>", "Global\\DiagTrackActiveEvent", "LocalFree", "permission_denied", "ResidentSystemCachePage", ">C>N>", "1!1>1M1Z1", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "40474e4", "StackLimit", "GetKernelDump action executed but not implemented.", "TDH_GUID", "8 8@8L8l8t8", "<0<8b>", "8U9p9", "?;?K?f?|?", "4$4D4L4T4`4", "969a9j9", "SOFTWARE\\Policies\\Microsoft\\SQMClient", "9O:t:", "878W8w8", "PowerSetting", "Utils_CreateRegistryKeyFailed", "_wtoi", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "3\"3R3_3", "2L2\\2h2p2", "6 6@6H6T6t6|6", "uVSSh", "operation would block", "setup", "QuotaPeakNonPagedPoolUsage", "IsContinuumSessionActiveMetadata_Update", "9&969=9", "ResidentSystemDriverPage", "wnfhex", "base\\diagnosis\\diagtrack\\engine\\trigger.cpp", ";7u0S", "2-2<2b2p2", "808L8\\8h8p8", "GetSecurityDescriptorGroup", "3 3@3H3d3t3", "8<8H8h8p8x8", "5-5M5R5", ";,<<w)+>", "GetFileAction succeeded", "Metadata_LastBootTime", "Fbase\\diagnosis\\diagtrack\\include\\FileWrapStream.h", "device or resource busy", " Microsoft Corporation. All rights reserved.", ">5>S>`>", "base\\diagnosis\\diagtrack\\matchengine\\asimovconstanteventbuffer.cpp", "t7h0U", "9sPr>h", "SHCreateStreamOnFileW", "4D4U4", "p_pid", ">(>/>4>?>Q>Y>d>|>", "UnicodeStringField", "AnsiStringField", "EventSubStoreResetCounter", "deviceid", "process", "pdiagtrack_action_output", "IsTest", "7 7D7L7T7\\7d7l7t7|7", "!This program cannot be run in DOS mode.", "< <@<`<", "3*3n3y3", "0.0g0", "diagscenario", "RegDeleteTreeW", "delayaction", "%04d/%02d/%02d:%02d:%02d:%02d", "PWWWWWWW", "X-UploadTime", "GetExitCodeProcess", "D$4SP", "FindFirstChangeNotificationW", "=(=I=X=t=", "7i8s8", "9L9U9e9}9", "7!7_7j7", "=4=V=l=", "presult", "0 0@0L0l0t0", ">/?K?", "=,=B=", "Identifier", "CcPinReadNoWait", "5\"6v6", "5<6u6", "SSSVh", "=2=B=i=", "dword64", "L$tCS", "epoch", "ReadTransferCount", "9T:4;v;", "host_unreachable", "m_eventNameWithoutProvider.c_str()", "111L1R1k1p1v1", "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\stoptraceaction.cpp", "TelClientSynthetic.__model", "registryfilter", "9K0t@9K8t;9K)?[?", "CloseHandle", "Setup for scenario failed.", "D$xQP", "7$7;8y8", "=1>U>[>h>~>", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\DiagTrack", "9$9,9`9p9|9", "=Q>V>", "465k5", "0$0)0", "5u6|6", "011;1R1a1", "ScenarioDef_FailedToCreateSetupAction", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", "&sampleId=", "SkipSoftLandingScenarios", "8MAPS", "ScenarioFailed_0", "ServiceMain_FinishedStopCallback", "4!474I4[4k4", "CEIPEnable", "WriteFile", "ProcessId", "90:j:", "print", "SourcePath", "_start", "> >(>0>8>@>L>l>t>", "FailingCode", "7t8 9v9):", ":#:1:6:_:i:w:|:", ", but 'ignorefailure' was specified. Continuing.", "AsimovUploader_UploadEventBuffer", "w<+>S", "filter", "6-6_6", ".?AV@@", "DelayLoadFailureHook", "2?2N2", ".data$r", "WaitForMultipleObjects", "4>4W4", "FileVersion", "NoForceCopyOutputDirAcl", "https://vortex-win.data.microsoft.com", "session", ";,;4;<;L;T;\\;d;l;t;|;", "HexInt32Field", "expectedtoberunning", ".rdata$zzzdbg", "QueryTraceW", "telemetry", "csdbld", ";F;d;", "ExpandEnvironmentStringsForUserW", "appliesto", "WaitReason", "2n2w2", "StopTraceW", "3(3L3T3\\3d3l3t3|3", "3$3^3", "3 404i4", "5+6:6H6", "_appid", "SVWj(", "2-2>2", "", "QueryToken", "3h3v3", "5E5L5n5u5", "Modern", "1$1D1L1h1x1", "UploaderDroppedCount", "CreateThread", "[MicrosoftTelemetry]" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "84360b9e3abc337e64acc72daa81a4a889726556ec7527ca3ef2274d41aefa7d", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/84360b9e3abc337e64acc72daa81a4a889726556ec7527ca3ef2274d41aefa7d", "guest_paths": [ "overlay" ], "size": 8544, "crc32": "E6719742", "md5": "d202461bf04e6f793d342431eab27acf", "sha1": "b8269f22b25ab270e0f8386ee691311852154375", "sha256": "84360b9e3abc337e64acc72daa81a4a889726556ec7527ca3ef2274d41aefa7d", "sha512": "b0a4d07fbd40f6cea3e30742536c51ef028f879e71c250c4642f2b3c530fd8275f791cbe3cc34130d82602cf49de594e13ec3de5933f13877191798bcc97519a", "rh_hash": null, "ssdeep": "192:ulWt8RDBQABJBP/Vqnaj2Zl7R9ZUFh2m:ulRDBRJBHVlSRzKh2m", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T19E023CD29B789483DE46BC505398EA873C3D53C35C2091A609FEFAD51CD73C6AB08A6D", "sha3_384": "d254ad6bf1176428d590341ccc911a21f8d84e13bb7d1825c31f323ec40079394aa0ef45c7abbfab9e1f2d2955d7441a", "data": null } ], "extracted_files_time": 0.000859298997966107, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "wdscore.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/65467bf1fbf10c2a399fe532b780f3604fda5b00db8319787cb6867bede4b90e", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\wdscore.dll" ], "size": 201528, "crc32": "ABCA4F6A", "md5": "07f3fac5518c90b22dfb9778ea280d0a", "sha1": "6d20ff953a0c5aabc1970e80a5f96aedd830db9b", "sha256": "65467bf1fbf10c2a399fe532b780f3604fda5b00db8319787cb6867bede4b90e", "sha512": "f86447c3dd0ad11022b208ba04c7b62cddf57b1035f4b1e18aae3e6764b6dce53fbeaa68cb5ce3ab75ba08293474dc18e9a3f5ce6df43a01701abd9180e07ace", "rh_hash": null, "ssdeep": "6144:yZ3oXN1cvpP/YeJvuBLqAOAWgERCGwDlyxfb2g/4S/IAiN85McisT:KXvSLqAOAWgERCNI6g/4giN8KXsT", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T126145A11F185E47DDA7B3130B63BEA3264BDB5644F6682CB72548F9E38641C0DB392E2", "sha3_384": "0064fa53f3e6e704a32ecaad4236e4bdef2e3060d702b62df74a949717c49d516e63498fa1865d2ae0d27b79b134add9", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x00028140", "ep_bytes": "8bff558bec837d0c017505e875080000", "peid_signatures": null, "reported_checksum": "0x000405e3", "actual_checksum": "0x000405e3", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "wdscore.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x1002e270", "name": "_callnewh" }, { "address": "0x1002e274", "name": "feof" }, { "address": "0x1002e278", "name": "fgetws" }, { "address": "0x1002e27c", "name": "_wfopen" }, { "address": "0x1002e280", "name": "wcstok_s" }, { "address": "0x1002e284", "name": "swscanf_s" }, { "address": "0x1002e288", "name": "_except_handler4_common" }, { "address": "0x1002e28c", "name": "_lock" }, { "address": "0x1002e290", "name": "_unlock" }, { "address": "0x1002e294", "name": "__dllonexit" }, { "address": "0x1002e298", "name": "_onexit" }, { "address": "0x1002e29c", "name": "_XcptFilter" }, { "address": "0x1002e2a0", "name": "_amsg_exit" }, { "address": "0x1002e2a4", "name": "fclose" }, { "address": "0x1002e2a8", "name": "_initterm" }, { "address": "0x1002e2ac", "name": "?terminate@@YAXXZ" }, { "address": "0x1002e2b0", "name": "??1type_info@@UAE@XZ" }, { "address": "0x1002e2b4", "name": "memcpy" }, { "address": "0x1002e2b8", "name": "_ftol2" }, { "address": "0x1002e2bc", "name": "_CxxThrowException" }, { "address": "0x1002e2c0", "name": "_wcsnicmp" }, { "address": "0x1002e2c4", "name": "memmove" }, { "address": "0x1002e2c8", "name": "iswctype" }, { "address": "0x1002e2cc", "name": "toupper" }, { "address": "0x1002e2d0", "name": "malloc" }, { "address": "0x1002e2d4", "name": "memmove_s" }, { "address": "0x1002e2d8", "name": "free" }, { "address": "0x1002e2dc", "name": "_wcslwr_s" }, { "address": "0x1002e2e0", "name": "memcpy_s" }, { "address": "0x1002e2e4", "name": "calloc" }, { "address": "0x1002e2e8", "name": "strrchr" }, { "address": "0x1002e2ec", "name": "towlower" }, { "address": "0x1002e2f0", "name": "wcschr" }, { "address": "0x1002e2f4", "name": "_wcslwr" }, { "address": "0x1002e2f8", "name": "_purecall" }, { "address": "0x1002e2fc", "name": "_vsnprintf" }, { "address": "0x1002e300", "name": "__CxxFrameHandler3" }, { "address": "0x1002e304", "name": "wcsrchr" }, { "address": "0x1002e308", "name": "wcsncmp" }, { "address": "0x1002e30c", "name": "_wtoi" }, { "address": "0x1002e310", "name": "_wcsicmp" }, { "address": "0x1002e314", "name": "_vsnwprintf" }, { "address": "0x1002e318", "name": "memset" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x1002e000", "name": "EventWriteTransfer" }, { "address": "0x1002e004", "name": "EventRegister" }, { "address": "0x1002e008", "name": "EventProviderEnabled" }, { "address": "0x1002e00c", "name": "EventUnregister" }, { "address": "0x1002e010", "name": "SetSecurityDescriptorDacl" }, { "address": "0x1002e014", "name": "EqualSid" }, { "address": "0x1002e018", "name": "OpenProcessToken" }, { "address": "0x1002e01c", "name": "InitializeSecurityDescriptor" }, { "address": "0x1002e020", "name": "InitializeAcl" }, { "address": "0x1002e024", "name": "GetLengthSid" }, { "address": "0x1002e028", "name": "AddAccessAllowedAce" }, { "address": "0x1002e02c", "name": "OpenThreadToken" }, { "address": "0x1002e030", "name": "GetTokenInformation" }, { "address": "0x1002e034", "name": "RegOpenKeyExW" }, { "address": "0x1002e038", "name": "RegCloseKey" }, { "address": "0x1002e03c", "name": "AllocateAndInitializeSid" }, { "address": "0x1002e040", "name": "FreeSid" }, { "address": "0x1002e044", "name": "CheckTokenMembership" }, { "address": "0x1002e048", "name": "RegQueryValueExW" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x1002e050", "name": "AcquireSRWLockExclusive" }, { "address": "0x1002e054", "name": "ReleaseSRWLockExclusive" }, { "address": "0x1002e058", "name": "LocalAlloc" }, { "address": "0x1002e05c", "name": "GetModuleHandleExW" }, { "address": "0x1002e060", "name": "CreateFileMappingA" }, { "address": "0x1002e064", "name": "DeleteFileA" }, { "address": "0x1002e068", "name": "GetFileSizeEx" }, { "address": "0x1002e06c", "name": "OutputDebugStringA" }, { "address": "0x1002e070", "name": "MultiByteToWideChar" }, { "address": "0x1002e074", "name": "WideCharToMultiByte" }, { "address": "0x1002e078", "name": "IsDebuggerPresent" }, { "address": "0x1002e07c", "name": "HeapSize" }, { "address": "0x1002e080", "name": "UnhandledExceptionFilter" }, { "address": "0x1002e084", "name": "QueryPerformanceCounter" }, { "address": "0x1002e088", "name": "GetSystemTimeAsFileTime" }, { "address": "0x1002e08c", "name": "DeviceIoControl" }, { "address": "0x1002e090", "name": "HeapValidate" }, { "address": "0x1002e094", "name": "HeapFree" }, { "address": "0x1002e098", "name": "SetLastError" }, { "address": "0x1002e09c", "name": "EnterCriticalSection" }, { "address": "0x1002e0a0", "name": "LeaveCriticalSection" }, { "address": "0x1002e0a4", "name": "InitializeCriticalSection" }, { "address": "0x1002e0a8", "name": "WaitForMultipleObjectsEx" }, { "address": "0x1002e0ac", "name": "WaitForSingleObject" }, { "address": "0x1002e0b0", "name": "GetCurrentThreadId" }, { "address": "0x1002e0b4", "name": "CreateEventW" }, { "address": "0x1002e0b8", "name": "Sleep" }, { "address": "0x1002e0bc", "name": "GetLastError" }, { "address": "0x1002e0c0", "name": "SetEvent" }, { "address": "0x1002e0c4", "name": "CloseHandle" }, { "address": "0x1002e0c8", "name": "CreateThread" }, { "address": "0x1002e0cc", "name": "ResetEvent" }, { "address": "0x1002e0d0", "name": "HeapAlloc" }, { "address": "0x1002e0d4", "name": "GetProcAddress" }, { "address": "0x1002e0d8", "name": "DeleteCriticalSection" }, { "address": "0x1002e0dc", "name": "GetProcessHeap" }, { "address": "0x1002e0e0", "name": "GetModuleHandleW" }, { "address": "0x1002e0e4", "name": "FreeLibrary" }, { "address": "0x1002e0e8", "name": "LoadLibraryExW" }, { "address": "0x1002e0ec", "name": "ReadFile" }, { "address": "0x1002e0f0", "name": "FindFirstFileW" }, { "address": "0x1002e0f4", "name": "FindNextFileW" }, { "address": "0x1002e0f8", "name": "WriteFile" }, { "address": "0x1002e0fc", "name": "RemoveDirectoryW" }, { "address": "0x1002e100", "name": "SetFilePointer" }, { "address": "0x1002e104", "name": "FindClose" }, { "address": "0x1002e108", "name": "CreateFileW" }, { "address": "0x1002e10c", "name": "DeleteFileW" }, { "address": "0x1002e110", "name": "GetTempFileNameW" }, { "address": "0x1002e114", "name": "CreateDirectoryW" }, { "address": "0x1002e118", "name": "GetModuleFileNameA" }, { "address": "0x1002e11c", "name": "GetModuleFileNameW" }, { "address": "0x1002e120", "name": "HeapReAlloc" }, { "address": "0x1002e124", "name": "DebugBreak" }, { "address": "0x1002e128", "name": "GetVolumeInformationW" }, { "address": "0x1002e12c", "name": "GetLogicalDrives" }, { "address": "0x1002e130", "name": "HeapCreate" }, { "address": "0x1002e134", "name": "VirtualFree" }, { "address": "0x1002e138", "name": "GetCommandLineW" }, { "address": "0x1002e13c", "name": "GetFullPathNameW" }, { "address": "0x1002e140", "name": "GetCurrentProcess" }, { "address": "0x1002e144", "name": "ExpandEnvironmentStringsW" }, { "address": "0x1002e148", "name": "GetShortPathNameW" }, { "address": "0x1002e14c", "name": "GetDiskFreeSpaceW" }, { "address": "0x1002e150", "name": "VirtualAlloc" }, { "address": "0x1002e154", "name": "TerminateProcess" }, { "address": "0x1002e158", "name": "SetFileTime" }, { "address": "0x1002e15c", "name": "SetErrorMode" }, { "address": "0x1002e160", "name": "SetEndOfFile" }, { "address": "0x1002e164", "name": "GetTempPathW" }, { "address": "0x1002e168", "name": "GetLocaleInfoW" }, { "address": "0x1002e16c", "name": "GetFileAttributesW" }, { "address": "0x1002e170", "name": "OpenEventW" }, { "address": "0x1002e174", "name": "GetVersionExW" }, { "address": "0x1002e178", "name": "GetComputerNameExW" }, { "address": "0x1002e17c", "name": "HeapWalk" }, { "address": "0x1002e180", "name": "UnmapViewOfFile" }, { "address": "0x1002e184", "name": "DuplicateHandle" }, { "address": "0x1002e188", "name": "GetCurrentThread" }, { "address": "0x1002e18c", "name": "OpenProcess" }, { "address": "0x1002e190", "name": "SetFileAttributesW" }, { "address": "0x1002e194", "name": "GetLogicalDriveStringsW" }, { "address": "0x1002e198", "name": "GetPrivateProfileStringW" }, { "address": "0x1002e19c", "name": "GlobalSize" }, { "address": "0x1002e1a0", "name": "GetDiskFreeSpaceExW" }, { "address": "0x1002e1a4", "name": "GetVersionExA" }, { "address": "0x1002e1a8", "name": "GlobalAlloc" }, { "address": "0x1002e1ac", "name": "GlobalFree" }, { "address": "0x1002e1b0", "name": "RaiseException" }, { "address": "0x1002e1b4", "name": "GetSystemInfo" }, { "address": "0x1002e1b8", "name": "GetOverlappedResult" }, { "address": "0x1002e1bc", "name": "HeapCompact" }, { "address": "0x1002e1c0", "name": "HeapDestroy" }, { "address": "0x1002e1c4", "name": "GetWindowsDirectoryW" }, { "address": "0x1002e1c8", "name": "GlobalLock" }, { "address": "0x1002e1cc", "name": "MoveFileExW" }, { "address": "0x1002e1d0", "name": "GetFileSize" }, { "address": "0x1002e1d4", "name": "ExitProcess" }, { "address": "0x1002e1d8", "name": "CreateProcessW" }, { "address": "0x1002e1dc", "name": "CreateProcessA" }, { "address": "0x1002e1e0", "name": "GetFileType" }, { "address": "0x1002e1e4", "name": "GlobalMemoryStatus" }, { "address": "0x1002e1e8", "name": "CopyFileExW" }, { "address": "0x1002e1ec", "name": "CreateFileMappingW" }, { "address": "0x1002e1f0", "name": "MapViewOfFile" }, { "address": "0x1002e1f4", "name": "GetTickCount" }, { "address": "0x1002e1f8", "name": "GlobalUnlock" }, { "address": "0x1002e1fc", "name": "GetDriveTypeW" }, { "address": "0x1002e200", "name": "GetExitCodeProcess" }, { "address": "0x1002e204", "name": "CreateMutexW" }, { "address": "0x1002e208", "name": "ReleaseMutex" }, { "address": "0x1002e20c", "name": "FlushFileBuffers" }, { "address": "0x1002e210", "name": "TlsSetValue" }, { "address": "0x1002e214", "name": "GetEnvironmentVariableW" }, { "address": "0x1002e218", "name": "FormatMessageW" }, { "address": "0x1002e21c", "name": "TlsAlloc" }, { "address": "0x1002e220", "name": "GetWindowsDirectoryA" }, { "address": "0x1002e224", "name": "GetLocalTime" }, { "address": "0x1002e228", "name": "LocalFree" }, { "address": "0x1002e22c", "name": "GetCurrentProcessId" }, { "address": "0x1002e230", "name": "TlsGetValue" }, { "address": "0x1002e234", "name": "TlsFree" }, { "address": "0x1002e238", "name": "FormatMessageA" }, { "address": "0x1002e23c", "name": "VirtualQuery" }, { "address": "0x1002e240", "name": "SetUnhandledExceptionFilter" }, { "address": "0x1002e244", "name": "SizeofResource" }, { "address": "0x1002e248", "name": "LockResource" }, { "address": "0x1002e24c", "name": "FindResourceExW" }, { "address": "0x1002e250", "name": "LoadResource" }, { "address": "0x1002e254", "name": "CreateMutexA" }, { "address": "0x1002e258", "name": "GetVersion" }, { "address": "0x1002e25c", "name": "CreateFileA" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x1002e264", "name": "SystemTimeToVariantTime" }, { "address": "0x1002e268", "name": "VariantTimeToSystemTime" } ] } }, "exported_dll_name": "WDSCORE.dll", "exports": [ { "address": "0x1001fca0", "name": "ConstructPartialMsgIfA", "ordinal": 4 }, { "address": "0x1001fcd0", "name": "ConstructPartialMsgIfW", "ordinal": 5 }, { "address": "0x1001fa90", "name": "ConstructPartialMsgVA", "ordinal": 6 }, { "address": "0x1001fb60", "name": "ConstructPartialMsgVW", "ordinal": 7 }, { "address": "0x1001cfc0", "name": "CurrentIP", "ordinal": 8 }, { "address": "0x1001fdc0", "name": "EndMajorTask", "ordinal": 9 }, { "address": "0x1001fe70", "name": "EndMinorTask", "ordinal": 10 }, { "address": "0x1001fec0", "name": "GetMajorTask", "ordinal": 11 }, { "address": "0x1001ff00", "name": "GetMajorTaskA", "ordinal": 12 }, { "address": "0x1001ff40", "name": "GetMinorTask", "ordinal": 13 }, { "address": "0x1001ff90", "name": "GetMinorTaskA", "ordinal": 14 }, { "address": "0x1001fd00", "name": "StartMajorTask", "ordinal": 15 }, { "address": "0x1001fdf0", "name": "StartMinorTask", "ordinal": 16 }, { "address": "0x1001bd70", "name": "WdsAbortBlackboardItemEnum", "ordinal": 17 }, { "address": "0x10011ab0", "name": "WdsAddModule", "ordinal": 18 }, { "address": "0x1001d870", "name": "WdsAddUsmtLogStack", "ordinal": 19 }, { "address": "0x10011fd0", "name": "WdsAllocCollection", "ordinal": 20 }, { "address": "0x10012480", "name": "WdsCollectionAddValue", "ordinal": 21 }, { "address": "0x10012510", "name": "WdsCollectionGetValue", "ordinal": 22 }, { "address": "0x1001c580", "name": "WdsCopyBlackboardItems", "ordinal": 23 }, { "address": "0x1001c5b0", "name": "WdsCopyBlackboardItemsEx", "ordinal": 24 }, { "address": "0x1001b780", "name": "WdsCreateBlackboard", "ordinal": 25 }, { "address": "0x1001be30", "name": "WdsDeleteBlackboardValue", "ordinal": 26 }, { "address": "0x10011fb0", "name": "WdsDeleteEvent", "ordinal": 27 }, { "address": "0x1001b7e0", "name": "WdsDestroyBlackboard", "ordinal": 28 }, { "address": "0x100114b0", "name": "WdsDuplicateData", "ordinal": 29 }, { "address": "0x1001ef50", "name": "WdsEnableDiagnosticMode", "ordinal": 30 }, { "address": "0x10011da0", "name": "WdsEnableExit", "ordinal": 31 }, { "address": "0x10011dc0", "name": "WdsEnableExitEx", "ordinal": 32 }, { "address": "0x1001bae0", "name": "WdsEnumFirstBlackboardItem", "ordinal": 33 }, { "address": "0x10012590", "name": "WdsEnumFirstCollectionValue", "ordinal": 34 }, { "address": "0x1001bce0", "name": "WdsEnumNextBlackboardItem", "ordinal": 35 }, { "address": "0x100125c0", "name": "WdsEnumNextCollectionValue", "ordinal": 36 }, { "address": "0x100109a0", "name": "WdsExecuteWorkQueue", "ordinal": 38 }, { "address": "0x10010ea0", "name": "WdsExecuteWorkQueue2", "ordinal": 37 }, { "address": "0x10011430", "name": "WdsExecuteWorkQueueEx", "ordinal": 39 }, { "address": "0x10011e40", "name": "WdsExitImmediately", "ordinal": 40 }, { "address": "0x10011e60", "name": "WdsExitImmediatelyEx", "ordinal": 41 }, { "address": "0x10012000", "name": "WdsFreeCollection", "ordinal": 42 }, { "address": "0x10011660", "name": "WdsFreeData", "ordinal": 43 }, { "address": "0x1001dde0", "name": "WdsGenericSetupLogInit", "ordinal": 44 }, { "address": "0x1001ef40", "name": "WdsGetAssertFlags", "ordinal": 45 }, { "address": "0x1001c000", "name": "WdsGetBlackboardBinaryData", "ordinal": 46 }, { "address": "0x1001c2c0", "name": "WdsGetBlackboardStringA", "ordinal": 47 }, { "address": "0x1001c150", "name": "WdsGetBlackboardStringW", "ordinal": 48 }, { "address": "0x1001bee0", "name": "WdsGetBlackboardUintPtr", "ordinal": 49 }, { "address": "0x1001ba00", "name": "WdsGetBlackboardValue", "ordinal": 50 }, { "address": "0x10011d40", "name": "WdsGetCurrentExecutionGroup", "ordinal": 51 }, { "address": "0x100125e0", "name": "WdsGetPointer", "ordinal": 1 }, { "address": "0x1001d7c0", "name": "WdsGetSetupLog", "ordinal": 52 }, { "address": "0x10011860", "name": "WdsGetTempDir", "ordinal": 53 }, { "address": "0x1000f140", "name": "WdsInitialize", "ordinal": 54 }, { "address": "0x1000a360", "name": "WdsInitializeCallbackArray", "ordinal": 55 }, { "address": "0x10011790", "name": "WdsInitializeDataBinary", "ordinal": 56 }, { "address": "0x100116b0", "name": "WdsInitializeDataStringA", "ordinal": 57 }, { "address": "0x10011720", "name": "WdsInitializeDataStringW", "ordinal": 58 }, { "address": "0x10011800", "name": "WdsInitializeDataUInt32", "ordinal": 59 }, { "address": "0x10011830", "name": "WdsInitializeDataUInt64", "ordinal": 60 }, { "address": "0x1001ef70", "name": "WdsIsDiagnosticModeEnabled", "ordinal": 61 }, { "address": "0x10011f20", "name": "WdsIterateOfflineQueue", "ordinal": 62 }, { "address": "0x10011ee0", "name": "WdsIterateQueue", "ordinal": 63 }, { "address": "0x1001c490", "name": "WdsLockBlackboardValue", "ordinal": 64 }, { "address": "0x10011d20", "name": "WdsLockExecutionGroup", "ordinal": 65 }, { "address": "0x10021bf0", "name": "WdsLogCreate", "ordinal": 66 }, { "address": "0x10021cf0", "name": "WdsLogDestroy", "ordinal": 67 }, { "address": "0x100224d0", "name": "WdsLogRegStockProviders", "ordinal": 68 }, { "address": "0x10022200", "name": "WdsLogRegisterProvider", "ordinal": 69 }, { "address": "0x1001d350", "name": "WdsLogStructuredException", "ordinal": 70 }, { "address": "0x10022560", "name": "WdsLogUnRegStockProviders", "ordinal": 71 }, { "address": "0x100222f0", "name": "WdsLogUnRegisterProvider", "ordinal": 72 }, { "address": "0x100120b0", "name": "WdsPackCollection", "ordinal": 73 }, { "address": "0x10011b30", "name": "WdsPublish", "ordinal": 74 }, { "address": "0x10011b70", "name": "WdsPublishEx", "ordinal": 75 }, { "address": "0x10011cc0", "name": "WdsPublishImmediateAsync", "ordinal": 76 }, { "address": "0x10011c90", "name": "WdsPublishImmediateEx", "ordinal": 77 }, { "address": "0x10011bb0", "name": "WdsPublishOffline", "ordinal": 78 }, { "address": "0x10011470", "name": "WdsSeqAlloc", "ordinal": 79 }, { "address": "0x10009620", "name": "WdsSeqFree", "ordinal": 80 }, { "address": "0x1001ef20", "name": "WdsSetAssertFlags", "ordinal": 81 }, { "address": "0x1001b830", "name": "WdsSetBlackboardValue", "ordinal": 82 }, { "address": "0x10011d70", "name": "WdsSetNextExecutionGroup", "ordinal": 83 }, { "address": "0x10011d00", "name": "WdsSetUILanguage", "ordinal": 84 }, { "address": "0x1001ee60", "name": "WdsSetupLogDestroy", "ordinal": 85 }, { "address": "0x1001e130", "name": "WdsSetupLogInit", "ordinal": 86 }, { "address": "0x1001f710", "name": "WdsSetupLogMessageA", "ordinal": 87 }, { "address": "0x1001f440", "name": "WdsSetupLogMessageW", "ordinal": 88 }, { "address": "0x10011a10", "name": "WdsSubscribeEx", "ordinal": 89 }, { "address": "0x1000f2b0", "name": "WdsTerminate", "ordinal": 90 }, { "address": "0x10011d30", "name": "WdsUnlockExecutionGroup", "ordinal": 91 }, { "address": "0x10012240", "name": "WdsUnpackCollection", "ordinal": 92 }, { "address": "0x10011a50", "name": "WdsUnsubscribe", "ordinal": 93 }, { "address": "0x10011a80", "name": "WdsUnsubscribeEx", "ordinal": 94 }, { "address": "0x1001c820", "name": "WdsValidBlackboard", "ordinal": 95 }, { "address": "0x1002c000", "name": "g_Kernel32", "ordinal": 2 }, { "address": "0x1002c2b0", "name": "g_bEnableDiagnosticMode", "ordinal": 3 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x0002ae00", "size": "0x00000b3e" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0002e324", "size": "0x00000064" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00030000", "size": "0x000003f8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0002f200", "size": "0x00002138" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00031000", "size": "0x0000228c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00008b20", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00001408", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x0002e000", "size": "0x00000320" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x0002a93e", "size_of_data": "0x0002aa00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.23" }, { "name": ".data", "raw_address": "0x0002ae00", "virtual_address": "0x0002c000", "virtual_size": "0x00001068", "size_of_data": "0x00000800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "1.86" }, { "name": ".idata", "raw_address": "0x0002b600", "virtual_address": "0x0002e000", "virtual_size": "0x000013b2", "size_of_data": "0x00001400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.58" }, { "name": ".rsrc", "raw_address": "0x0002ca00", "virtual_address": "0x00030000", "virtual_size": "0x000003f8", "size_of_data": "0x00000400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.37" }, { "name": ".reloc", "raw_address": "0x0002ce00", "virtual_address": "0x00031000", "virtual_size": "0x0000228c", "size_of_data": "0x00002400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.69" } ], "overlay": { "offset": "0x0002f200", "size": "0x00002138" }, "resources": [ { "name": "RT_VERSION", "offset": "0x00030060", "size": "0x00000398", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.52" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Panther Engine Module" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "wdscore.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "WDSCORE.DLL" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "3a214f6dc4499595e8bb7d58e7a636b0", "timestamp": "2032-03-07 01:04:14", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 4 }, "data": null, "strings": [ "L$$PQ", "GetTokenInformation", "3]4i4n4y4", "WdsSetAssertFlags", "4 4O4", "MemoryControlBlock", "Microsoft Time-Stamp Service", "?3?G?V?[?a?h?w?}?", "6%6,6J6b6n6s6~6", "?)?B?H?z?", "vXhX*", "pSerializeFileVersion", "malloc", "pWorkerThreadFunc -- WaitForMultipleObjects failed", ";GhtA3", "WdsIterateQueue", "Could not close file for '%s'", "229879+4583620", "CBlackboard::Close", "DuplicateHandle", "UnmapViewOfFile", "Failed to initialize SEQ", "9~,ub", "HeapSize", "pWorkerThreadFunc -- Stopping", "", "b%9q^", "WdsInitializeDataUInt32", "IsDebuggerPresent", "8`8g8l8", "SetThreadPreferredUILanguages", "9+999K9", "HeapWalk", "SeqExecute -- stopping, since termination group# < current group#", "[gle=0x%.8x]", "WdsLogUnRegisterProvider", "OpenProcess", "8$8*80868;8N8`8|8", "TerminateProcess", "D$ Vh0", "QPWh ", ".idata$5", "3A3H3Z3", "9w\\tZVVj", "WdsExitImmediatelyEx", "9 :0:<:D:x:", "Couldn't Publish EVENT_SERIALIZE_BEFORE_EXIT", "TelemetryAssertDiagTrack", "ExpandEnvironmentStringsW", "GetModuleFileName failed in engine::pCleanOutTempDir", "pUpdateContentsFile StringCchPrintf failed", "_purecall", "onecore\\base\\ntsetup\\panther\\wdslog\\setuplog.cpp", "040904B0", "Microsoft Time-Stamp Service0", "<-G>S>s>z>", ".data$r$brc", "TlsGetValue", "CTypeManager::Open: m_SpinLocks.Create(%s) failed", ".?AVCConsistentMapping@@", "Redmond1", "ConstructPartialMsgIfA", "t)j\\P", "WdsLogUnRegStockProviders", "_>u>|>", "wcstok_s", "j\\Yf;", "606_6f6", "WdsExitImmediate already called", "GetWindowsDirectoryA", "2$2E2W2", ">0?s?", "INVALID_DISPOSITION", "", ";J;O;[;k;", "WdsPublishImmediateEx", "WdsUnlockExecutionGroup", "WdsPackCollection", "StringFileInfo", "EngineBeginSaveOperation", ":';.;9;t;", "VSh\\[", "Error serializing callback in '%s'", "N0L0J", "r~akow", "1.1Q1t1", "Module %s can't subscribe. Did you call WdsInitializeCallbackArray in your ModuleInit()?", "hexBinary", "iswctype", "pHandleSerialize", "9O`tD;", "9s8uh", "181=1U1;2@2]2g2p2x2", "WdsExecuteWorkQueueEx", ".?AVCIlKernel32@@", "Module Temp Directory %s is not useable", "GetComputerNameExW", "WdsPublish() by module %s - invalid group name %s", "9^Pt?SS", "WdsSetupLogInit", "9%:@:", "WdsEnumNextCollectionValue", ".?AUIKernel32Interface@@", "9wPt5", "WdsSubscribeEx", "%Microsoft Windows Production PCA 2011", "WdsVectoredExceptionHandler", "WdsDuplicateData failed, invalid source data - %s", "QSVWj\\", "=L9o<", "7 777C7H7S7]7h7", "InitializeModule", ".text$x", "GUARD_PAGE", "Couldn't create clean panther temp dir", "0+1<1I1X1^1q1", " !\"#%$&'()*+,-./012", "t#VSj", "count", "GetLocaleInfoW", "LogGlobalFilter", "%-21S %-6S %S", "SEQ EVENT_SERIALIZE Received", "Group: %s not found! (SEQ5)", ",vHgFM1wA1m9rSmnIHUnIgKeRXF6XE3eLAAVXY00v4oM=0Z", "7Y8_8e8k8q8", "1f;2u", "?(?-?8?E?", "VarFileInfo", ".?AVCConsistentMemoryMapping@@", "", "?/?A?Y?q?", "PANTHR", "DeleteCriticalSection", "QSVWj2^", "HZo6m|", "D$(Pj", "memmove", "u+j_Xf;", "D$0_^[", "71767", "9P:W:i:", "8%939@9E9Q9a9", "364[4", "HeapReAlloc", "3#3(3.3;3L3R3`3", " S>:$", "SeqLockExecutionGroup: Initializing ExecQueue->csLock;", "3,434O4\\4c4", " %S=\"", "VirtualQuery", "4D4H4P4X4p4", "onecore\\base\\ntsetup\\panther\\engine\\bb.cpp", "8'81898B8J8S8v8", "r%windir%\\system32\\dbghelp.dll", "3$4H4d4m4s4~4", "CStorage::Open: m_pMapping->Create(%s) failed.", "msvcrt.dll", ".?AVCSimpleBuffer@@", "GetCurrentThreadId", "MoveFileExW", "2#2-2i2", "tdj;^", "1!2Y2", "WdsEnumFirstBlackboardItem", "memmove_s", "FreeLibrary", "`.data", "585X5x5", "WdsEnumFirstCollectionValue", "eEngineCompleteSaveOperation", "GetMajorTaskA", "Queue Serialization Failed!", ":%:.:3:>:H:o:x:}:", "<+", "pUpdateContentsFile", ".CRT$XCA", "?+?P?k?t?", "Log: Failed To Get Msg From ID", "GetFileSizeEx", "7\"8+80888C8g8p8u8}8", "210303183039Z0p1", "6v718@9", "SetFilePointer", " xmlns:rs=\"urn:schemas-microsoft-com:rowset\"", "EndMajorTask", "WdsGetBlackboardValue", "bucketArgument1", "%s%-S(%S)", "WdsInitialize", "Could not save queue '%s' to '%s'", "2'2.2", "5$5-525=5G5", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "Failed to allocate memory for copy of subscription (SEQ8)", "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p). Minidump attached (%d bytes) to diagerr.xml and %s.", "hLBSMhDRBKh4O", "WdsLogRegStockProviders", " xmlns:z=\"#RowsetSchema\">", "fgetws", "t+PPj", "Could not allocate major event (SEQ9)", "CStorage::Open: CConsistentMappingFactory::CreateObject failed.", "Failed to create online queue name", "$Microsoft Ireland Operations Limited1&0$", "Could not wait on event queue handle (SEQ7)", "CStorage::Open", "Assert", "pConstructEvent", "InternalName", "Microsoft Corporation1.0,", "250701214655Z0|1", "<>", "Translation", "303<3\\3h3", "WdsLogDestroy", "FormatMessageW", "memcpy", "kernel32.dll", "GetModuleHandleW", "1&1.1y1", "Saving Contents File %s", "GetSystemInfo", "LoadResource", "8N8q8x8", "4#T$\\", "5!5+505:5?5a5k5u5", "6(6,6D6T6X6h6l6p6", "8R9X9^9e9l9u9", "Failed to initialize setup groups", "484X4x4", " http://www.microsoft.com/windows0", "5 6,6M6Y6", "=@=t=", "%-20S %-10S [0x%06x] %-6S %S", "%u/%u/%u", "WdsSetBlackboardValue", "%s %[^", "L$ Pj", "<.=J=e=", "SetupLog", "=*>S>\\>a>l>v>", "CallSubscribers", "SeqDeleteEvent", "FLT_UNDERFLOW", "Washington1", "WDS_DATA.Type == RESERVED, which is not available to modules!", "5!5,5:5}5", "ReleaseMutex", "WdsPublishImmediateAsync", "0!0'0-030a0g0m0s0y0", "CBlackboard::Open: %s succeeded.", ";Mw>", "Could not allocate group list item (SEQ3)", ":$:1:U:c:p:u:", "20201009090308Z0w0=", "pInitializeWorkQueue", "Contents", "GetModuleHandleExW", "%s*.%s", "D$ h8", "CMemoryManager::InitializeMemMapsAsForNewFile", "Could not duplicate data (SEQ17)", "EngineCompleteSaveOperation couldn't create %s", "0%0/0o0{0", "FileDescription", "9E t5", "CSpinLockFileMappingArray::Create: m_pMapping->Create(%s) failed.", "_XcptFilter", ";#;,;1;<;F;t;", "Log: Cannot convert ansi->unicode.", "WdsEnableExit already called", "Windows Setup activity log", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "WdsSetUILanguage", "GlobalFree", ".idata$6", "WdsInitializeDataUInt64", "WdsEnableExitEx couldn't duplicate exit data", "CMemoryManager::InitializeMemMapsAsForNewFile: pFileMapping->UnmapViewOfFile failed.", "Rich*&Z", "wcschr", "PRIV_INSTRUCTION", "assertVersion", ";1;8;B;Y;`;", "A Module did not subscribe to any events, so it was unloaded.", "SeqEnableExit", "StartMajorTask", "FreeSid", "onecore\\base\\ntsetup\\panther\\engine\\seq.c", "=,=Y=", "CBlackboard::FindNodeByUniqueID", "4)4D4K4g4t4", "Queue Serialization Succeeded", "pGetAllSubscriptions", "CreateFileA", ";C;O;U;^;w;", ".rdata$zETW0", "WdsInitializeDataStringW", "SUPPRESS", "Microsoft Corporation", "Could not allocate subscription list (SEQ11)", "pConstructEvent() -- invalid WDS_DATA specified: %s", "GlobalLock", "STACK_OVERFLOW", "8.MapViewOfFile failed.", "InitializeModule: Initializing ExecQueue->csLock;", "DIAGER", "=E>K>W>", "7H8O8e8n8", "j\\Zf;", "01090@0F0L0z0", "CConsistentFileMapping::Open: CreateFile failed.", "0.040N1_1n1t1", "Successfully backed up PERMANENT event", "j-Xf;", "4$404M4W4", "20201008033933.375Z0", "R!s4Z", "WdsInitializeCallbackArray", "GetTempPathW", "WideCharToMultiByte", "\"Microsoft Window", "=)=0=6=<=B=G=M=]=g=w=", "6#6.686i6", "G\\;Ghv", "2$2@2P2t2|2", "::;\\;o;", "<+csLock.DebugInfo is NULL.", "WdsSetNextExecutionGroup", "1(1A1[1d1i1t1~1", "Could not allocate event list item", "Invalid Group Name '%s' passed to WdsIterateOfflineQueue", "", "PQh<<", "ADVAPI32.dll", "252R2Y2`2h2y2", "3h4}4", "9,9;9B9H9P9l9t9", "EnterCriticalSection", "7^7c7", "0H1Y1h1n1", "2*3M3p3", "5#6/6", "5b5u5", "EventUnregister", "WdsExitImmediate called! Execution will stop, and the queue %s be saved.", "8DRBKu", "DebugFilter", ">?>U>[>b>r>{>", "5#676C6T6i6", "wdscore.dll", "WdsSetupLogMessageW", "t0VhdT", "9>u:WW", "1'2,2", "GetOverlappedResult", "WdsEnableDiagnosticMode", "%-20S %-21S %-6S %s", "Invalid Queue Name '%s' specified to WdsPublishOffline", "t=j@j", "Panther Engine Module", "=\"=2=W=", ":&;|;}<", "Failed to open contents file '%s'", "Qj\\^f;", "", "1/0-0", ";D$$u", "Could not allocate temporary subscription list (SEQ13)", "CSpinLockFileMappingArray::Create", "Failed to resolve binary for module '%s'", "SeqPublishImmediate() -- MajorEvent and MinorEvent cannot be 0", "TlsSetValue", "_onexit", "G\\;Gh", "303A3R3V3a3g3q3", "8%8d8", "bucketArgument2", "3456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^", "g_bEnableDiagnosticMode", "AddVectoredExceptionHandler", ";8;X;x;", "WdsPublish", ">@>G>P>X>i>u>|>", "WDS_DATA.Type == WDS_TYPE_NONE, but the other members of WDS_DATA are non zero!", "9ShwW", "%d %d", "LegalCopyright", ";&;5;", "debug.log", "SeqSerializeFromFile", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "HeapCompact", "Y__^[", ".idata$3", "4;5E5Q5[5", "epLookupContentsFileEntry", "6(7F7k7", "dateTime", "8)8J8S8a8I9R9`9", "towlower", "GetWindowsDirectoryW", "0$0.050=0I0P0X0", "SeqPublishImmediateEx", "<\"", "&0-080|0", "Legal_Policy_Statement", ";GhtH", ";S;c;", ";/;6;F;M;];d;o;+$>J>l>", "&02070B0L0}0", "243=3B3M3Z3z3", "1(0&0", "ExecutableName: ", "MiniDumpWriteDump", "The header for '%s' couldn't be written", "t: QQ", "InitializeSecurityDescriptor", "CheckTokenMembership", "9D9L9T9`9", "SetUnhandledExceptionFilter", "DATATYPE_MISALIGNMENT", "GetCommandLineW", "pCopySubscription", ".%I64x", "NONCONTINUABLE_EXCEPTION", "6Q7X7", "advapi32.dll", "GetMajorTask", "6&6-696u6", "7X7y7", "=$=D=L=T=\\=h=", ".WdsSetupLogInit", "4y52696", "DebugFormatterAndDevice", ".CRT$XIZ", "WdsUnPackCollection -- Data->Type != WDS_TYPE_PACKED_COLLECTION", "Attempt to use SeqGetCurrentExecutionGroup from another thread", "PANTHER_ENABLE_TELASSERT", "Global\\WdsSetupLogInit", "CompanyName", "Couldn't copy pFV->FileName in pLookupContentsFileEntry", "Attempt to use SeqLockExecutionGroup from another thread", "FLT_OVERFLOW", "6K7^7e7", "diagerr.mdmp", "WdsExecuteWorkQueue2 with WDS_START_EMPTY_QUEUE given 0 modules or 0 groups", "pLock", ":8:X:x:", "GlobalAlloc", "CreateFileW", "H 9OX", ";s s%k", "wcsrchr", "3)3;3G3", ".text", "!w(^_", "pConstructContentsFile", "CreateProcessW", "=,=?=W=c=h=s=}=", "Could not associate Module name, Major or Minor event with new event", "EngineCompleteSaveOperation couldn't save contents file", "Microsoft Corporation1-0+", "GetDiskFreeSpaceW", "%-10S [0x%06x] %-6S %S", "FLT_DENORMAL_OPERAND", "4?5K5l5x5", "989X9x9", "9k:r:", "WdsIsDiagnosticModeEnabled", "EngineCompleteSaveOperation couldn't save %s", "Windows Setup error log", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "Saving FileVersion %s%d.%s", "10.0.19041.572", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "Online", "t$0Pj", "1>2J2O2Z2d2", "SetErrorMode", "EventSetInformation", "8%8/8L8X8d8m8|8", ":>v>", "SetFileAttributesW", "_vsnwprintf", "MIGUI", "ConstructPartialMsgVW: MALLOC failed", "InitializeModule - Failed to find entry point %s", ":2:7:A:S:Y:a:h:o:u:", "u(VSP", "GetVersionExW", "2q3x3~3", "9':b:", "Microsoft Corporation1200", "FatalError", ">%>?>R>{>", "WdsLockBlackboardValue", "$@_^[]", "HeapAlloc", "31464A4L4\\4y4", "rSeqDestruct", "WdsLogStructuredException", "QueryPerformanceCounter", "$Microsoft Ireland Operations Limited1", "No working dir has been given to panther. Call WdsInitialize(ReInit=TRUE) to specify one", "GetLocalTime", "Invalid callback 0x%X given to WdsSubscribe by %s. Did you put this callback in the initial callback table?", ".CRT$XCZ", "ModuleCollection", """, "toupper", "WdsAddModule", "INT_OVERFLOW", "CreateEventW", "FLT_STACK_CHECK", "\"CBlackboard::Open", ";&;>;X;_;", "BLaA#X'", "GetLengthSid", "WdsUnsubscribeEx(%s, %s, %d, %d) removed subscription (%s, %d, Callback:%d)", "0_0q0", "Section", "1I1N1T1", "GlobalMemoryStatus", "CConsistentFileMapping::Open", "WdsCopyBlackboardItems", ".text$yd", "WdsUnsubscribeEx could not allocate major event", "%-20S %-21S [0x%06x] %s", "TelemetryAssertList", "7 7@7L7l7t7|7", ".CRT$XIAA", "6(626B6R6b6x6", "pSeqConstruct", "setupact.log", "2\"3+303;3E3", "WdsValidBlackboard", "Failed to add group to offline queue '%s'", "FormatMessageA", "1<1J1t1", ";H&?-?V?b?g?r?~?", "Failed to read in ContentsFile->FileVersions", "WdsSeqAlloc", "Blackboard Corruption: %s", "9(989J9X9h9x9", "WdsExitImmediatelyEx couldn't duplicate exit data", "Exception (code 0x%08X: %s) occurred at 0x%p in %s.", "DeleteFileW", "Could not load SEQ state from '%s'", "455E5N5[5d5", "686X6x6", "Loading Event: EventType(%s,%d) PublishedBy(%s)", "pExecuteSEQControlEvent", "Unable to load global log filter.", "Failed to alloc WorkQueue->OfflineQueuesTable", "\\}eU%", "Couldn't construct contents file!", "?terminate@@YAXXZ", "8$8+8B8K8P8[8e8", "RegCloseKey", "StringCchCopy fails for %s", "SACSetupErr", "@_^[]", "_wcslwr", "?:\\wdslog.inf", "FLT_DIVIDE_BY_ZERO", "GetProcAddress", "FindClose", "InitializeCriticalSection", "PVh05", "Microsoft Corporation1&0$", "GetModuleFileNameW", "ResetEvent", "WdsLogCreate", "GetFileSize", "8+868<8D8K8^8f8w8", "ReleaseSRWLockExclusive", "EndMinorTask", "DEPLOY", "pResolveBinaryName", ".CRT$XCU", "CreateMutexW", "%-20S %-21S %-6S %S", "SeqExecute -- stopping, since WdsExitImmediate() was called", "9w`t ", "Warning", "=(>5>M>", "< ", "WdsUnsubscribeEx", "WdsGenericSetupLogInit", "_wfopen", "210121231915Z0", "tWdsIterateQueue", "GetMinorTaskA", "9KHtk", "wcsncmp", "D$,Pj", "WdsUnPackCollection -- couldn't add value", "WdsEnumNextBlackboardItem", "No working dir has been given to panther. The temp dir for modules will be unavailable. Call WdsInitialize(ReInit=TRUE) to specify a working directory", "=5>I>U>e>j>u>", "SerializeFromFile '%s'", "Global\\SetupLog", "Could add subscription list item to hash table (SEQ12)", "333<3", "SeqSetNextExecutionGroup", "The version of '%s' is %d, but the required version is %d", "SeqLockExecutionGroup", "5?5G5", "CreateFileMappingW", "originatingBinary", "VPQhp", "3\"3*3:3B3\\3}3", "PVVh4\\", "CTypeManager::Open", "WdsDeleteEvent", "strrchr", "Sleep", "6:6C6", ">o>v>~>7?L?U?Z?f?q?", "WdsEnableExit called! When group #%d is empty, execution will stop, and the queue %s be saved.", "5.555q5", " || SourceName: ", "9^Tt?SS", "SYSTEM\\Setup\\Panther", "Status", "WdsPublishOffline", "INVALID_HANDLE", " || LogMessage: ", "%S(%d) : %S", ".idata$4", "?,?@?L?Y?^?i?v?", "WDSCORE.DLL", ":H;O;Y;`;", "", ";>r>", "'", "%S(%d) : ", "8$8)848>8V8v9", "PWjdZ", "OriginalFilename", "default", "_CxxThrowException", "SEQ Control", "Undefined", "pMergePersistentQueue - processing Perm Event: (%s,%s) by: %s", "lL7Ki\"0", "142F2s2", "@.reloc", "Verbose", "6-7S7", "U0S0Q", "Trace", "StandardSetupLogFilter", "PPPPf", "Unknown SEQ Control Event received %d", "SeqSetUILanguage", "", "WdsDeleteBlackboardValue", "SSWh0", "606<6X6x6", "%-21S %-6S %s", "_callnewh", "WdsExecuteWorkQueue", "BREAKPOINT", "InitializeAcl", "<0http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "4B4J4i4", "The header for '%s' couldn't be read", "1$1,1014181<1T1X1d1", "x/j\\Xf;E", "t)j?W", "1$1A1W1", "9-939?9G9P9c9i9o9u9", "MultiByteToWideChar", "@.rsrc", "AddAccessAllowedAce", "<.=;=H=p=|=", "Microsoft Time-Stamp PCA 20100", ">5>S>", "ARRAY_BOUNDS_EXCEEDED", ":%;.;3;?;L;", "Could not allocate event list item (SEQ16a)", "D$PWP", ":8;V;", "WdsCreateBlackboard", "OF_Open", "20201008090308Z", "CBlackboard::~CBlackboard", "CreateMutexA", ".idata$2", "D$,uG;", "CBlackboard::Open: m_Storage.CreateType(%s) failed.", "757J7[7", ".CRT$XCL", "PQQSVW", "Failed to Merge the Persistent Queue into the Event Queue", "D$$Wj", "232^2e2", "9+:9:G:T:Y:e:o:", "LeaveCriticalSection", "GetEnvironmentVariableW", "131u1", "HeapCreate", "onecore\\base\\ntsetup\\panther\\engine\\engine.cpp", "ProductVersion", "GetVolumeInformationW", "WdsGetBlackboardStringA", "SerializeToFile: %s", "VirtualAlloc", "292T2w2", "imageName", "Unable to startup async event processing threads", ">,>3>c>m>}>", "7P8o8x8", "SeqExecute -- stopping, since termination group reached", "Module '%s' with binary '%s' was prevented from loading by improper use of EVENT_LOADING_MODULE's associated data", "CallSubscribers() -- invalid data given by subscription callback! The event's data won't be modified! (%s)", ")WdsPublish", "<1OfflineQueuesTable", "5c5|5", "1.161;1P1W1", "pMergePersistentQueue", ">!?FileVersions", "1$1,141<1D1L1T1\\1d1l1t1|1", "_vsnprintf", "DebugBreak", "2#272N2", "9U9e9l9", "_unlock", ".gfids", "4A4Q4W4\\4q4", ".rsrc$02", "memcpy_s", "GetLastError", "5+5k5t5y5", "GetTempFileNameW", "WdsExecuteWorkQueue2", "CStorage::CheckAndRestoreIntegrity", "WINPE", "WdsPublishEx", "4B5K5P5[5h5", "%S\\%s", "fclose", ">:>m>", "_amsg_exit", "Attempt to use WdsUnlockExecutionGroup from another thread", "%s %s \"%[^\"]\"", "9 9.9", "j.Xf;", "Microsoft", "pGetHighestNumberedFile", "UnhandledExceptionFilter", "__dllonexit", "5,50545L5P5T5\\5t5", "WdsInitializeDataStringA", "Could not allocate event list item (SEQ16)", "%s\\%s%d.", "t;j?Yf;", "WdsAllocCollection", " xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"", "Saving Permanent Event Queue", "IsWorkQueueAccessible", ":1:E:Q:V:a:r:", "%s\\%s%d.%s", "%s%-20S%S", "SINGLE_STEP", "GetFullPathNameW", "Failed to add all setup modules", ".giats", "'WdsExecuteWorkQueue2", "SeqSubscribeEx", "AllocateAndInitializeSid", "Function %s was called, but the panther work queue is not running!", "?(?0?8?D?d?p?", "L$4_^[3", ")Microsoft Root Certificate Authority 20100", "WdsPublish() -- Invalid event data submitted by '%s': %s", "<8r>x>", "WdsSetNextExecutionGroup failed - the queue is currently locked", "WaitForSingleObject", ">&?F?U?`?e?", "FindNextFileW", "ConstructPartialMsgIfW", "4.4=4P4y4", "", "L$,_^[3", "Trying to unlock queue which is already unlocked! (SEQ4)", "MapViewOfFile failed.", "071P1", "_wcsicmp", ".idata", "GetFileAttributesW", "t\\9NdtW9N", "2n3w3|3", "10.0.19041.572 (WinBuild.160101.0800)", "9f;:u", "='=1=?=X=", ">0>P>p>", "QSVW3", "E(SVW", "WdsCollectionGetValue", "D$49D$", "pGetNewFileName couldn't find next file!", ":*:?:N:V:_:e:", "7\"9\\9", "Failed to open contents file for output '%s'", "261019185142Z0", "111@1L1i1p1|1", "sWdsDuplicateData", "FindResourceExW", "<8<@", "6+7F7Y7b7g7r7{7", "QSVWj", "000I0", "9*9V9b9g9t9", "SeqPublish", "y>", "WdsGetAssertFlags", "WdsAddModule given invalid parameters", "Saving Main Event Queue", "?K?`?p?", "1M3T3", "9=9Z9|9", "011S1i1", "%WINDIR%\\Minidump", "setuplog.cfg", "WdsUnpackCollection", "LBSMtwA", "WdsEnableExitEx", "FM.%I64x", "576>6S6X6o6", "wdscore.pdb", "ConstructPartialMsgVA", "thVVVVh", "KERNEL32.dll", "GetDriveTypeW", "diagerr.xml", "EngineBegineSaveOperation couldn't create contents file", "SetEvent", "0(0H0X0|0", "Failed to backup PERMANENT event!!", ".rdata$zETW2", "WdsTerminate", "8f;:u", "QQSVW", "CopyFileExW", "SeqPublishImmediateAsync", "<%<.<6<>", "?Q?X?", "D$,PQRS", "W9{HuI", "HWARE", "/0Q0`0u0", "WdsCollectionAddValue", "=$=(=H=d=h=", "GetCurrentProcess", "ExitProcess", "=U=^=c=o=y=3>C>L>Q>\\>", "ypGetOfflineQueue", "WdsCopyBlackboardItemsEx", "WdsAddUsmtLogStack", "Microsoft Windows0", "WdsGetTempDir", "PVh|X", "InitializedCriticalSection for pExecQueue->csLock;", "Could not set ExecQueue->hProcessAsyncEvent", "Could not alloc memory in WdsInitializeCallbackArray", "Could not start save operation for '%s'", "TlsFree", " Operating System", "CBlackboard::CheckAndRestoreIntegrity(%s) done with Result=%d", "%u-%u-%u", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", ":0:7:C:L:f:m:y:", "D$4PQ", "> >=>P>Y>^>i>s>", "%d-%02d-%02d %02d:%02d:%02d,", "CMemoryManager::InitializeSharedControlBlock", "SetLastError", "1^1j1o1z1", "oK0D$\"<", "_lock", "?O?s?", "Successfully backed up PERMANENT event during SetNextExecutionGroup", "526O6a6j6o6z6", ".rdata$brc", "?!???Q?", "1#2\\2", "VWj(j", "WdsGetBlackboardStringW", "GetMinorTask", "No working dir has been given to panther. Call WdsInitialize(Reinit=TRUE) to specify one (2nd msg)", "z.9Wv", "3=4K4", "8H8V8c8l8", "string", ">*>3>B>K>q>z>", "pSaveNewContentsFile", "WDS_DATA.Type == UINT32 but size != sizeof(UINT32)", "WdsLockExecutionGroup", "Directory %s is not useable by panther", ":!:-:8:Q:V:[:", "3H3T3Y3d3n3{3", ";FhtE", "6%656:6F6T6", "u$WSQ", "4(444T4\\4x4", "7O8W8c8", "timestamp", "Hbg&~", ".rdata$zETW9", "9/:6:g:", "Y9pe},L`", "W ;P ", "9[:b:", "WdsDestroyBlackboard", "WdsPublishImmediateAsync() -- Invalid event data submitted by '%s': %s", "TlP0X", "7$7>7I7N7Z7g7", "&", "WdsGetPointer", "?X?a?f?q?{?", "1+2C2p2", "nOF_Close", ".rdata$sxdata", "(sizeof(SValue) + ((SValue *)Node.GetBuffer())->uiNameSize + ((SValue *)Node.GetBuffer())->uiSize) != uiItemSize", "stringcchprintf failed for '%s'", "LockResource", ":&:H:T:o:v:", "RemoveDirectoryW", "PSSSSSSSj", "Couldn't reset ExecQueue->hStopWorkerThreads", "GetSystemTimeAsFileTime", "memset", "D$0j\\P", "GetTickCount", "888X8x8", "\\\\.\\SAC", "onecore\\base\\ntsetup\\panther\\engine\\objectfile.c", "8)92979B9M9", "SACSetupAct", "LocalFree", "setuplog.xml", "WdsPublishImmediateEx() -- Invalid event data submitted by '%s': %s", "pMergePersistentQueue - Prepending Group %d: %s", "ProductName", "495R5", "CreateProcessA", "=F=M=U=d=l=", "<(2I2S2", "040d0l0t0|0", "848<8D8P8X8p8", "g_Kernel32", "WdsExecuteWorkQueue with WDS_START_EMPTY_QUEUE given 0 modules or 0 groups", "_wtoi", "5%5-595B5G5M5W5a5q5", ">+?9?B?K?T?d?r?|?", "SetFileTime", "tR9N tM9N$tH9N(tC9N,t>9NDt9", "diagwrn.xml", "", "DeleteCriticalSection for pExecQueue->csLock;", "%Microsoft Windows Production PCA 20110", "6:7F7K7V7`7", "WDS_DATA.Type == UINT64, but size != sizeof(UINT64)", "6 7,717<7F7", "5 5}5", "GetPrivateProfileStringW", "I0G1-0+", "WdsGetSetupLog", " Microsoft Corporation. All rights reserved.", "PShL:", "WdsFreeCollection", "XMLLogFormatter", "HeapValidate", "7A7G7R7[7p7}7", "FlushFileBuffers", "SeqGetCurrentExecutionGroup", "!This program cannot be run in DOS mode.", "9_ht ", "D$8j\\P", "1A2[2", "GetExitCodeProcess", ">8>S>o>", "=0=?=F=W=^=h=z=", "9$939=9_9e9n9}9", "Couldn't find queue '%s' in contents file", "WDS_DATA.Type == BINARY, STRING, or STRING_ANSI, but other members of WDS_DATA are zero!", "GetDiskFreeSpaceExW", ";?;N;q;", "OpenThreadToken", "SEQ EVENT_SERIALIZE_BEFORE_EXIT Received. Will only save modules with persistent subscriptions!", "WdsSetupLogMessageA", "3A3U3", "OpenProcessToken", "PShTO", "CloseHandle", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0", "<9\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00000\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000T\u0000a\u0000s\u0000k\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00001\u0000<\u0000/\u0000T\u0000a\u0000s\u0000k\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000P\u0000a\u0000n\u0000t\u0000h\u0000e\u0000r\u0000<\u0000/\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00003\u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000W\u0000u\u0000I\u0000d\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000e\u00009\u0000c\u0000f\u0000b\u00004\u00000\u0000-\u00000\u0000d\u00006\u00003\u0000-\u00004\u00005\u0000b\u0000e\u0000-\u0000b\u00001\u00006\u00009\u0000-\u00005\u00001\u00005\u0000d\u00003\u00003\u00005\u00003\u00003\u00007\u0000a\u00008\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000H\u0000o\u0000s\u0000t\u0000O\u0000S\u0000B\u0000r\u0000a\u0000n\u0000c\u0000h\u0000N\u0000a\u0000m\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000v\u0000b\u0000_\u0000r\u0000e\u0000l\u0000e\u0000a\u0000s\u0000e\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000W\u0000e\u0000b\u0000S\u0000e\u0000t\u0000u\u0000p\u0000O\u0000n\u0000l\u0000i\u0000n\u0000e\u0000S\u0000t\u0000o\u0000r\u0000e\u0000V\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u0000.\u00004\u0000.\u00001\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000F\u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000N\u0000a\u0000t\u0000i\u0000v\u0000e\u0000P\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000o\u0000r\u0000A\u0000r\u0000c\u0000h\u0000i\u0000t\u0000e\u0000c\u0000t\u0000u\u0000r\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00009\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000S\u0000q\u0000m\u0000\\\u00009\u00003\u00009\u00004\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00009\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u00003\u00006\u00000\u0000S\u0000c\u0000e\u0000n\u0000a\u0000r\u0000i\u0000o\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00007\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000S\u0000q\u0000m\u0000\\\u00001\u00002\u00002\u00006\u00007\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00007\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u00003\u00006\u00000\u0000M\u0000o\u0000d\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00008\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000I\u0000s\u0000W\u0000e\u0000b\u0000S\u0000e\u0000t\u0000u\u0000p\u0000C\u0000r\u0000e\u0000a\u0000t\u0000e\u0000d\u0000M\u0000e\u0000d\u0000i\u0000a\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000L\u0000e\u0000g\u0000a\u0000c\u0000y\u0000S\u0000e\u0000t\u0000u\u0000p\u0000I\u0000n\u0000t\u0000e\u0000r\u0000r\u0000u\u0000p\u0000t\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000H\u0000o\u0000s\u0000t\u0000O\u0000S\u0000B\u0000u\u0000i\u0000l\u0000d\u0000N\u0000u\u0000m\u0000b\u0000e\u0000r\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00004\u0000A\u00006\u00005\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000R\u0000e\u0000f\u0000l\u0000e\u0000c\u0000t\u0000D\u0000r\u0000i\u0000v\u0000e\u0000r\u0000s\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000P\u0000o\u0000s\u0000t\u0000R\u0000o\u0000l\u0000l\u0000b\u0000a\u0000c\u0000k\u0000C\u0000o\u0000n\u0000t\u0000e\u0000x\u0000t\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u0000U\u0000p\u0000g\u0000r\u0000a\u0000d\u0000e\u0000A\u0000t\u0000t\u0000e\u0000m\u0000p\u0000t\u0000s\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000S\u0000q\u0000m\u0000\\\u00001\u00002\u00002\u00006\u00005\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u0000P\u0000r\u0000i\u0000o\u0000r\u0000i\u0000t\u0000y\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000M\u0000o\u0000S\u0000e\u0000t\u0000u\u0000p\u0000P\u0000h\u0000a\u0000s\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00002\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000E\u0000u\u0000l\u0000a\u0000T\u0000i\u0000m\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u00001\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00001\u0000<\u0000/\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u0000S\u0000t\u0000a\u0000r\u0000t\u0000T\u0000i\u0000m\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u0000D\u0000C\u0000E\u0000E\u0000F\u00004\u0000B\u0000F\u0000F\u0000E\u0000F\u00007\u00004\u0000C\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000T\u0000A\u0000S\u0000K\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u00000\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000P\u0000r\u0000e\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000<\u0000/\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000r\u0000a\u0000n\u0000s\u0000f\u0000e\u0000r\u0000r\u0000i\u0000n\u0000g\u0000>\u00000\u0000<\u0000/\u0000T\u0000r\u0000a\u0000n\u0000s\u0000f\u0000e\u0000r\u0000r\u0000i\u0000n\u0000g\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000F\u0000i\u0000l\u0000e\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00000\u0000<\u0000/\u0000F\u0000i\u0000l\u0000e\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00002\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000R\u0000A\u0000N\u0000S\u0000P\u0000O\u0000R\u0000T\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000r\u0000a\u0000n\u0000s\u0000p\u0000o\u0000r\u0000t\u0000I\u0000d\u0000>\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000T\u0000r\u0000a\u0000n\u0000s\u0000p\u0000o\u0000r\u0000t\u0000I\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000/\u0000T\u0000R\u0000A\u0000N\u0000S\u0000P\u0000O\u0000R\u0000T\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u00001\u0000c\u00002\u00008\u00000\u00008\u00008\u00009\u0000-\u0000f\u0000d\u00002\u00007\u0000-\u00004\u0000a\u0000a\u00005\u0000-\u00008\u00003\u0000c\u00009\u0000-\u0000d\u0000f\u0000d\u00003\u0000d\u00007\u00004\u0000c\u00002\u00006\u0000b\u0000f\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u00001\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000E\u0000u\u0000l\u0000a\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00006\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00006\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u00000\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u00006\u00004\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u00006\u00004\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000u\u0000l\u0000a\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000P\u0000a\u0000n\u0000t\u0000h\u0000e\u0000r\u0000\\\u0000E\u0000u\u0000l\u0000a\u0000.\u0000r\u0000t\u0000f\u0000<\u0000/\u0000E\u0000u\u0000l\u0000a\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000X\u0000m\u0000l\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000p\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000.\u0000x\u0000m\u0000l\u0000<\u0000/\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000X\u0000m\u0000l\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000D\u0000e\u0000f\u0000a\u0000u\u0000l\u0000t\u0000>\u00000\u0000<\u0000/\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000D\u0000e\u0000f\u0000a\u0000u\u0000l\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000S\u0000e\u0000l\u0000e\u0000c\u0000t\u0000e\u0000d\u0000>\u00001\u0000<\u0000/\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000S\u0000e\u0000l\u0000e\u0000c\u0000t\u0000e\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000/\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u0000f\u0000d\u00003\u00000\u00009\u00007\u0000a\u0000a\u0000-\u00004\u00006\u00007\u0000b\u0000-\u00004\u0000b\u0000a\u0000a\u0000-\u0000a\u00003\u00002\u00006\u0000-\u00002\u0000e\u00001\u00004\u00005\u00005\u00009\u0000f\u00008\u0000a\u0000b\u0000a\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u00001\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000G\u0000e\u0000t\u0000W\u0000e\u0000b\u0000S\u0000e\u0000t\u0000u\u0000p\u0000U\u0000s\u0000e\u0000r\u0000I\u0000n\u0000p\u0000u\u0000t\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u00000\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u00006\u00004\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u00000\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000I\u0000n\u0000c\u0000l\u0000u\u0000d\u0000e\u0000R\u0000e\u0000t\u0000a\u0000i\u0000l\u0000O\u0000n\u0000l\u0000y\u0000O\u0000f\u0000f\u0000e\u0000r\u0000s\u0000>\u00000\u0000<\u0000/\u0000I\u0000n\u0000c\u0000l\u0000u\u0000d\u0000e\u0000R\u0000e\u0000t\u0000a\u0000i\u0000l\u0000O\u0000n\u0000l\u0000y\u0000O\u0000f\u0000f\u0000e\u0000r\u0000s\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000a\u0000r\u0000g\u0000e\u0000t\u0000U\u0000s\u0000b\u0000D\u0000r\u0000i\u0000v\u0000e\u0000>\u00000\u0000<\u0000/\u0000T\u0000a\u0000r\u0000g\u0000e\u0000t\u0000U\u0000s\u0000b\u0000D\u0000r\u0000i\u0000v\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000M\u0000e\u0000d\u0000i\u0000a\u0000T\u0000y\u0000p\u0000e\u0000>\u00000\u0000<\u0000/\u0000M\u0000e\u0000d\u0000i\u0000a\u0000T\u0000y\u0000p\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000I\u0000n\u0000s\u0000t\u0000a\u0000l\u0000l\u0000N\u0000o\u0000w\u0000>\u00000\u0000<\u0000/\u0000I\u0000n\u0000s\u0000t\u0000a\u0000l\u0000l\u0000N\u0000o\u0000w\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000F\u0000i\u0000l\u0000e\u0000S\u0000i\u0000z\u0000e\u0000X\u00008\u00006\u0000>\u00000\u0000<\u0000/\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000F\u0000i\u0000l\u0000e\u0000S\u0000i\u0000z\u0000e\u0000X\u00008\u00006\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000F\u0000i\u0000l\u0000e\u0000S\u0000i\u0000z\u0000e\u0000X\u00006\u00004\u0000>\u00000\u0000<\u0000/\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000F\u0000i\u0000l\u0000e\u0000S\u0000i\u0000z\u0000e\u0000X\u00006\u00004\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000a\u0000t\u0000h\u0000T\u0000o\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000X\u0000m\u0000l\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000p\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000.\u0000x\u0000m\u0000l\u0000<\u0000/\u0000P\u0000a\u0000t\u0000h\u0000T\u0000o\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000X\u0000m\u0000l\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000/\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000T\u0000A\u0000S\u0000K\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000W\u0000I\u0000N\u0000D\u0000L\u0000P\u0000>\u0000\r\u0000\n\u0000", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "wdstptc.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/48ee94546c9345fbe5ad1a51f4826b131da554a8e4395e5d22e4cde09b3816d5", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\wdstptc.dll" ], "size": 516032, "crc32": "3285598C", "md5": "7a020a931614e1a7ca1db482d1c00ede", "sha1": "782fadd14783d0a10520294e4e69036adb556e53", "sha256": "48ee94546c9345fbe5ad1a51f4826b131da554a8e4395e5d22e4cde09b3816d5", "sha512": "7de656c091c95d91c6a78115beb497afd11fbccb1b47d3f7557d0ab1d3e52eb2a2060e640222d445d6859a7c1813901653cc77bba0d21e1dcb46aaa413a17430", "rh_hash": null, "ssdeep": "12288:6ZTPK4dHSyYHxUpt3NIqct9awKFaLXDXjjf2Uxg8NcTki1NgLOi7TW/P2PxxQ:6FlJSbkt3yLXDXjjfF+L2nQ", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T155B48E5375D055F5E6B379316A38627A56BDB7600B60C0CF13204FB5BA30AC1EA36B2B", "sha3_384": "f226c5e9c229e011e7c1343ac762d68cf9f252fc7cf5cba2fea7539638995e38ab5899cdec50299156ab9548c53942e5", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x00073dc0", "ep_bytes": "8bff558bec837d0c017505e8d5050000", "peid_signatures": null, "reported_checksum": "0x00084c00", "actual_checksum": "0x00084c00", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "wdstptc.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x1007738c", "name": "memcpy" }, { "address": "0x10077390", "name": "memcmp" }, { "address": "0x10077394", "name": "_ftol2" }, { "address": "0x10077398", "name": "_vsnprintf" }, { "address": "0x1007739c", "name": "_vsnwprintf" }, { "address": "0x100773a0", "name": "wprintf" }, { "address": "0x100773a4", "name": "memmove" }, { "address": "0x100773a8", "name": "_except_handler4_common" }, { "address": "0x100773ac", "name": "srand" }, { "address": "0x100773b0", "name": "rand" }, { "address": "0x100773b4", "name": "towupper" }, { "address": "0x100773b8", "name": "wcsstr" }, { "address": "0x100773bc", "name": "iswspace" }, { "address": "0x100773c0", "name": "wcschr" }, { "address": "0x100773c4", "name": "wcsrchr" }, { "address": "0x100773c8", "name": "_wtoi" }, { "address": "0x100773cc", "name": "_stricmp" }, { "address": "0x100773d0", "name": "strtoul" }, { "address": "0x100773d4", "name": "_strtoui64" }, { "address": "0x100773d8", "name": "swscanf_s" }, { "address": "0x100773dc", "name": "wcsnlen" }, { "address": "0x100773e0", "name": "wcsncmp" }, { "address": "0x100773e4", "name": "_wcstoi64" }, { "address": "0x100773e8", "name": "??1type_info@@UAE@XZ" }, { "address": "0x100773ec", "name": "__CxxFrameHandler3" }, { "address": "0x100773f0", "name": "_onexit" }, { "address": "0x100773f4", "name": "__dllonexit" }, { "address": "0x100773f8", "name": "_unlock" }, { "address": "0x100773fc", "name": "_lock" }, { "address": "0x10077400", "name": "_initterm" }, { "address": "0x10077404", "name": "_amsg_exit" }, { "address": "0x10077408", "name": "_XcptFilter" }, { "address": "0x1007740c", "name": "_CxxThrowException" }, { "address": "0x10077410", "name": "_callnewh" }, { "address": "0x10077414", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0x10077418", "name": "??1exception@@UAE@XZ" }, { "address": "0x1007741c", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0x10077420", "name": "??0exception@@QAE@XZ" }, { "address": "0x10077424", "name": "malloc" }, { "address": "0x10077428", "name": "free" }, { "address": "0x1007742c", "name": "_wcsnicmp" }, { "address": "0x10077430", "name": "_wcsicmp" }, { "address": "0x10077434", "name": "memcpy_s" }, { "address": "0x10077438", "name": "qsort_s" }, { "address": "0x1007743c", "name": "_vscwprintf" }, { "address": "0x10077440", "name": "qsort" }, { "address": "0x10077444", "name": "strcpy_s" }, { "address": "0x10077448", "name": "memmove_s" }, { "address": "0x1007744c", "name": "_purecall" }, { "address": "0x10077450", "name": "memset" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x100770c4", "name": "TlsSetValue" }, { "address": "0x100770c8", "name": "TlsFree" }, { "address": "0x100770cc", "name": "TlsAlloc" }, { "address": "0x100770d0", "name": "GetSystemTimes" }, { "address": "0x100770d4", "name": "GetFileSizeEx" }, { "address": "0x100770d8", "name": "WriteFile" }, { "address": "0x100770dc", "name": "SetFileValidData" }, { "address": "0x100770e0", "name": "SetEndOfFile" }, { "address": "0x100770e4", "name": "SetFilePointerEx" }, { "address": "0x100770e8", "name": "GetCurrentProcess" }, { "address": "0x100770ec", "name": "GetCurrentThread" }, { "address": "0x100770f0", "name": "CreateFileW" }, { "address": "0x100770f4", "name": "QueueUserWorkItem" }, { "address": "0x100770f8", "name": "WaitForSingleObject" }, { "address": "0x100770fc", "name": "GetVersionExW" }, { "address": "0x10077100", "name": "CreateEventW" }, { "address": "0x10077104", "name": "SetEvent" }, { "address": "0x10077108", "name": "Sleep" }, { "address": "0x1007710c", "name": "TlsGetValue" }, { "address": "0x10077110", "name": "ReadFile" }, { "address": "0x10077114", "name": "WaitForSingleObjectEx" }, { "address": "0x10077118", "name": "ChangeTimerQueueTimer" }, { "address": "0x1007711c", "name": "CreateTimerQueueTimer" }, { "address": "0x10077120", "name": "GetSystemInfo" }, { "address": "0x10077124", "name": "SleepEx" }, { "address": "0x10077128", "name": "GetComputerNameW" }, { "address": "0x1007712c", "name": "SwitchToThread" }, { "address": "0x10077130", "name": "GetCurrentThreadId" }, { "address": "0x10077134", "name": "DeleteTimerQueueTimer" }, { "address": "0x10077138", "name": "GetLastError" }, { "address": "0x1007713c", "name": "GlobalMemoryStatusEx" }, { "address": "0x10077140", "name": "InterlockedPopEntrySList" }, { "address": "0x10077144", "name": "InterlockedPushEntrySList" }, { "address": "0x10077148", "name": "InitializeSListHead" }, { "address": "0x1007714c", "name": "SetLastError" }, { "address": "0x10077150", "name": "ResetEvent" }, { "address": "0x10077154", "name": "QueryPerformanceCounter" }, { "address": "0x10077158", "name": "GetCurrentProcessId" }, { "address": "0x1007715c", "name": "GetSystemTimeAsFileTime" }, { "address": "0x10077160", "name": "GetTickCount" }, { "address": "0x10077164", "name": "UnhandledExceptionFilter" }, { "address": "0x10077168", "name": "SetUnhandledExceptionFilter" }, { "address": "0x1007716c", "name": "LeaveCriticalSection" }, { "address": "0x10077170", "name": "EnterCriticalSection" }, { "address": "0x10077174", "name": "DeleteCriticalSection" }, { "address": "0x10077178", "name": "InitializeCriticalSection" }, { "address": "0x1007717c", "name": "TerminateProcess" }, { "address": "0x10077180", "name": "CloseHandle" }, { "address": "0x10077184", "name": "RaiseException" }, { "address": "0x10077188", "name": "GetLongPathNameW" }, { "address": "0x1007718c", "name": "GetTempPathW" }, { "address": "0x10077190", "name": "GetFileInformationByHandleEx" }, { "address": "0x10077194", "name": "GetFileInformationByHandle" }, { "address": "0x10077198", "name": "SleepConditionVariableSRW" }, { "address": "0x1007719c", "name": "WakeAllConditionVariable" }, { "address": "0x100771a0", "name": "AcquireSRWLockExclusive" }, { "address": "0x100771a4", "name": "ReleaseSRWLockExclusive" }, { "address": "0x100771a8", "name": "GetVolumePathNamesForVolumeNameW" }, { "address": "0x100771ac", "name": "GetVolumeNameForVolumeMountPointW" }, { "address": "0x100771b0", "name": "SetFileTime" }, { "address": "0x100771b4", "name": "DosDateTimeToFileTime" }, { "address": "0x100771b8", "name": "WaitForMultipleObjectsEx" }, { "address": "0x100771bc", "name": "CreateSemaphoreExW" }, { "address": "0x100771c0", "name": "LoadLibraryExW" }, { "address": "0x100771c4", "name": "GetVolumeInformationByHandleW" }, { "address": "0x100771c8", "name": "UnmapViewOfFile" }, { "address": "0x100771cc", "name": "MapViewOfFile" }, { "address": "0x100771d0", "name": "OutputDebugStringA" }, { "address": "0x100771d4", "name": "GetEnvironmentVariableW" }, { "address": "0x100771d8", "name": "GetModuleHandleW" }, { "address": "0x100771dc", "name": "GetProcAddress" }, { "address": "0x100771e0", "name": "SetEnvironmentVariableW" }, { "address": "0x100771e4", "name": "OutputDebugStringW" }, { "address": "0x100771e8", "name": "QueryPerformanceFrequency" }, { "address": "0x100771ec", "name": "CreateSemaphoreW" }, { "address": "0x100771f0", "name": "ReleaseSemaphore" }, { "address": "0x100771f4", "name": "CreateIoCompletionPort" }, { "address": "0x100771f8", "name": "CreateThread" }, { "address": "0x100771fc", "name": "PostQueuedCompletionStatus" }, { "address": "0x10077200", "name": "WaitForMultipleObjects" }, { "address": "0x10077204", "name": "GetQueuedCompletionStatus" }, { "address": "0x10077208", "name": "WideCharToMultiByte" }, { "address": "0x1007720c", "name": "MultiByteToWideChar" }, { "address": "0x10077210", "name": "LocalFileTimeToFileTime" }, { "address": "0x10077214", "name": "GetFullPathNameW" }, { "address": "0x10077218", "name": "GetFileAttributesW" }, { "address": "0x1007721c", "name": "FindFirstFileW" }, { "address": "0x10077220", "name": "SetFileAttributesW" }, { "address": "0x10077224", "name": "FindNextFileW" }, { "address": "0x10077228", "name": "FindClose" }, { "address": "0x1007722c", "name": "CreateDirectoryW" }, { "address": "0x10077230", "name": "LocalFree" }, { "address": "0x10077234", "name": "GetCurrentDirectoryW" }, { "address": "0x10077238", "name": "GetSystemDirectoryW" }, { "address": "0x1007723c", "name": "GetVolumePathNameW" }, { "address": "0x10077240", "name": "GetVolumeInformationW" }, { "address": "0x10077244", "name": "DeleteFileW" }, { "address": "0x10077248", "name": "RemoveDirectoryW" }, { "address": "0x1007724c", "name": "LoadLibraryW" }, { "address": "0x10077250", "name": "FreeLibrary" }, { "address": "0x10077254", "name": "GetHandleInformation" }, { "address": "0x10077258", "name": "DeviceIoControl" }, { "address": "0x1007725c", "name": "GetOverlappedResult" }, { "address": "0x10077260", "name": "SetFileInformationByHandle" }, { "address": "0x10077264", "name": "CreateFileMappingW" }, { "address": "0x10077268", "name": "HeapFree" }, { "address": "0x1007726c", "name": "GetProcessHeap" }, { "address": "0x10077270", "name": "CompareStringW" }, { "address": "0x10077274", "name": "HeapAlloc" }, { "address": "0x10077278", "name": "FlushFileBuffers" }, { "address": "0x1007727c", "name": "HeapReAlloc" }, { "address": "0x10077280", "name": "GetDriveTypeW" }, { "address": "0x10077284", "name": "SetThreadIdealProcessor" }, { "address": "0x10077288", "name": "GetFinalPathNameByHandleW" }, { "address": "0x1007728c", "name": "InitializeCriticalSectionAndSpinCount" }, { "address": "0x10077290", "name": "SetFilePointer" }, { "address": "0x10077294", "name": "LockFileEx" }, { "address": "0x10077298", "name": "UnlockFileEx" }, { "address": "0x1007729c", "name": "LocalAlloc" }, { "address": "0x100772a0", "name": "OpenProcess" }, { "address": "0x100772a4", "name": "CopyFileExW" }, { "address": "0x100772a8", "name": "DuplicateHandle" }, { "address": "0x100772ac", "name": "GetPrivateProfileSectionW" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x10077000", "name": "OpenProcessToken" }, { "address": "0x10077004", "name": "GetSecurityDescriptorControl" }, { "address": "0x10077008", "name": "RegCloseKey" }, { "address": "0x1007700c", "name": "RegOpenKeyExW" }, { "address": "0x10077010", "name": "RegCreateKeyExW" }, { "address": "0x10077014", "name": "RegQueryValueExW" }, { "address": "0x10077018", "name": "RegSetValueExW" }, { "address": "0x1007701c", "name": "RegDeleteValueW" }, { "address": "0x10077020", "name": "GetSecurityDescriptorOwner" }, { "address": "0x10077024", "name": "GetSecurityDescriptorGroup" }, { "address": "0x10077028", "name": "GetSecurityDescriptorDacl" }, { "address": "0x1007702c", "name": "GetSecurityDescriptorSacl" }, { "address": "0x10077030", "name": "GetSecurityDescriptorLength" }, { "address": "0x10077034", "name": "GetAclInformation" }, { "address": "0x10077038", "name": "RegLoadKeyW" }, { "address": "0x1007703c", "name": "RegFlushKey" }, { "address": "0x10077040", "name": "RegUnLoadKeyW" }, { "address": "0x10077044", "name": "OpenEncryptedFileRawW" }, { "address": "0x10077048", "name": "WriteEncryptedFileRaw" }, { "address": "0x1007704c", "name": "CloseEncryptedFileRaw" }, { "address": "0x10077050", "name": "CryptReleaseContext" }, { "address": "0x10077054", "name": "CryptAcquireContextW" }, { "address": "0x10077058", "name": "CryptImportKey" }, { "address": "0x1007705c", "name": "CryptDestroyKey" }, { "address": "0x10077060", "name": "CryptSignHashW" }, { "address": "0x10077064", "name": "CryptVerifySignatureW" }, { "address": "0x10077068", "name": "CryptGetHashParam" }, { "address": "0x1007706c", "name": "CryptDestroyHash" }, { "address": "0x10077070", "name": "CryptSetHashParam" }, { "address": "0x10077074", "name": "CryptHashData" }, { "address": "0x10077078", "name": "CryptCreateHash" }, { "address": "0x1007707c", "name": "RevertToSelf" }, { "address": "0x10077080", "name": "ImpersonateLoggedOnUser" }, { "address": "0x10077084", "name": "AdjustTokenPrivileges" }, { "address": "0x10077088", "name": "PrivilegeCheck" }, { "address": "0x1007708c", "name": "LookupPrivilegeValueW" }, { "address": "0x10077090", "name": "OpenThreadToken" } ] }, "WS2_32": { "dll": "WS2_32.dll", "imports": [ { "address": "0x10077320", "name": "WSACleanup" }, { "address": "0x10077324", "name": "GetAddrInfoW" }, { "address": "0x10077328", "name": "FreeAddrInfoW" }, { "address": "0x1007732c", "name": "ntohl" }, { "address": "0x10077330", "name": "htonl" }, { "address": "0x10077334", "name": "WSAAddressToStringW" }, { "address": "0x10077338", "name": "WSAIoctl" }, { "address": "0x1007733c", "name": "WSAStartup" }, { "address": "0x10077340", "name": "inet_addr" }, { "address": "0x10077344", "name": "closesocket" }, { "address": "0x10077348", "name": "setsockopt" }, { "address": "0x1007734c", "name": "bind" }, { "address": "0x10077350", "name": "htons" }, { "address": "0x10077354", "name": "WSASocketW" }, { "address": "0x10077358", "name": "ntohs" }, { "address": "0x1007735c", "name": "WSASendTo" }, { "address": "0x10077360", "name": "WSARecvFrom" }, { "address": "0x10077364", "name": "WSAGetLastError" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x10077458", "name": "RtlImpersonateSelf" }, { "address": "0x1007745c", "name": "NtSetEaFile" }, { "address": "0x10077460", "name": "RtlDeleteResource" }, { "address": "0x10077464", "name": "RtlReleaseResource" }, { "address": "0x10077468", "name": "RtlAcquireResourceShared" }, { "address": "0x1007746c", "name": "RtlAcquireResourceExclusive" }, { "address": "0x10077470", "name": "RtlInitializeResource" }, { "address": "0x10077474", "name": "RtlFreeHeap" }, { "address": "0x10077478", "name": "NtClose" }, { "address": "0x1007747c", "name": "NtCreateFile" }, { "address": "0x10077480", "name": "RtlDosPathNameToNtPathName_U" }, { "address": "0x10077484", "name": "NtSetInformationFile" }, { "address": "0x10077488", "name": "RtlAllocateHeap" }, { "address": "0x1007748c", "name": "NtQueryVolumeInformationFile" }, { "address": "0x10077490", "name": "NtSetSecurityObject" }, { "address": "0x10077494", "name": "RtlFindAceByType" }, { "address": "0x10077498", "name": "RtlSetControlSecurityDescriptor" }, { "address": "0x1007749c", "name": "RtlGetLastNtStatus" }, { "address": "0x100774a0", "name": "RtlGetVersion" }, { "address": "0x100774a4", "name": "RtlReAllocateHeap" }, { "address": "0x100774a8", "name": "RtlRaiseStatus" }, { "address": "0x100774ac", "name": "NtYieldExecution" }, { "address": "0x100774b0", "name": "NtQueryInformationProcess" }, { "address": "0x100774b4", "name": "NtQueryInformationFile" }, { "address": "0x100774b8", "name": "RtlNtStatusToDosError" }, { "address": "0x100774bc", "name": "RtlAdjustPrivilege" }, { "address": "0x100774c0", "name": "RtlInitializeCriticalSection" } ] }, "VERSION": { "dll": "VERSION.dll", "imports": [ { "address": "0x100772e0", "name": "GetFileVersionInfoExW" }, { "address": "0x100772e4", "name": "VerQueryValueW" }, { "address": "0x100772e8", "name": "GetFileVersionInfoSizeExW" } ] }, "WDSCSL": { "dll": "WDSCSL.dll", "imports": [ { "address": "0x100772f0", "name": "WdsClientExecute" }, { "address": "0x100772f4", "name": "WdsClientInitializeLibrary" }, { "address": "0x100772f8", "name": "WdsClientFreeLibrary" }, { "address": "0x100772fc", "name": "WdsCpParameterQuery" }, { "address": "0x10077300", "name": "WdsCpPacketInitialize" }, { "address": "0x10077304", "name": "WdsCpParameterValidate" }, { "address": "0x10077308", "name": "WdsCpRecvPacketInitialize" }, { "address": "0x1007730c", "name": "WdsCpPacketGetBuffer" }, { "address": "0x10077310", "name": "WdsCpPacketRelease" }, { "address": "0x10077314", "name": "WdsClientPacketFree" }, { "address": "0x10077318", "name": "WdsCpParameterAdd" } ] }, "bcrypt": { "dll": "bcrypt.dll", "imports": [ { "address": "0x1007736c", "name": "BCryptCloseAlgorithmProvider" }, { "address": "0x10077370", "name": "BCryptDestroyHash" }, { "address": "0x10077374", "name": "BCryptFinishHash" }, { "address": "0x10077378", "name": "BCryptOpenAlgorithmProvider" }, { "address": "0x1007737c", "name": "BCryptGetProperty" }, { "address": "0x10077380", "name": "BCryptCreateHash" }, { "address": "0x10077384", "name": "BCryptHashData" } ] }, "FLTLIB": { "dll": "FLTLIB.DLL", "imports": [ { "address": "0x100770a8", "name": "FilterAttach" }, { "address": "0x100770ac", "name": "FilterLoad" } ] }, "Cabinet": { "dll": "Cabinet.dll", "imports": [] }, "IPHLPAPI": { "dll": "IPHLPAPI.DLL", "imports": [ { "address": "0x100770b4", "name": "AddIPAddress" }, { "address": "0x100770b8", "name": "GetAdaptersAddresses" }, { "address": "0x100770bc", "name": "GetIfTable" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x100772c4", "name": "I_RpcMapWin32Status" }, { "address": "0x100772c8", "name": "UuidCreate" }, { "address": "0x100772cc", "name": "UuidToStringW" }, { "address": "0x100772d0", "name": "RpcStringFreeW" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x100772b4", "name": "SysFreeString" }, { "address": "0x100772b8", "name": "SetErrorInfo" }, { "address": "0x100772bc", "name": "GetErrorInfo" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x100772d8", "name": "CharUpperW" } ] } }, "exported_dll_name": "WDSTPTC.dll", "exports": [ { "address": "0x10018550", "name": "WdsTptcDownload", "ordinal": 1 }, { "address": "0x1000e7c0", "name": "WdsTransportClientAddRefBuffer", "ordinal": 7 }, { "address": "0x1000e8f0", "name": "WdsTransportClientApplyImage", "ordinal": 2 }, { "address": "0x1000e6d0", "name": "WdsTransportClientCancelSession", "ordinal": 8 }, { "address": "0x1000e6f0", "name": "WdsTransportClientCancelSessionEx", "ordinal": 9 }, { "address": "0x1000e5e0", "name": "WdsTransportClientCloseSession", "ordinal": 10 }, { "address": "0x1000e860", "name": "WdsTransportClientCompleteReceive", "ordinal": 11 }, { "address": "0x1000eaf0", "name": "WdsTransportClientElSetLogFunction", "ordinal": 3 }, { "address": "0x1000eb10", "name": "WdsTransportClientElSetLogFunctionEx", "ordinal": 4 }, { "address": "0x1000e9d0", "name": "WdsTransportClientGetAggressiveBufferSize", "ordinal": 5 }, { "address": "0x1000e510", "name": "WdsTransportClientInitialize", "ordinal": 12 }, { "address": "0x1000e5c0", "name": "WdsTransportClientInitializeSession", "ordinal": 13 }, { "address": "0x1000e760", "name": "WdsTransportClientQueryStatus", "ordinal": 14 }, { "address": "0x1000e600", "name": "WdsTransportClientRegisterCallback", "ordinal": 15 }, { "address": "0x1000e8d0", "name": "WdsTransportClientRegisterTrace", "ordinal": 6 }, { "address": "0x1000e810", "name": "WdsTransportClientReleaseBuffer", "ordinal": 16 }, { "address": "0x1000e5a0", "name": "WdsTransportClientShutdown", "ordinal": 17 }, { "address": "0x1000e670", "name": "WdsTransportClientStartSession", "ordinal": 18 }, { "address": "0x1000e710", "name": "WdsTransportClientWaitForCompletion", "ordinal": 19 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00075a50", "size": "0x00000353" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000774cc", "size": "0x0000012c" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0007a000", "size": "0x00000428" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0007be00", "size": "0x000021c0" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x0007b000", "size": "0x00003f3c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x0000db60", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x0000187c", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x000017d0", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00077000", "size": "0x000004c8" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00074da3", "size_of_data": "0x00074e00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.58" }, { "name": ".data", "raw_address": "0x00075200", "virtual_address": "0x00076000", "virtual_size": "0x00000f44", "size_of_data": "0x00000400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "4.43" }, { "name": ".idata", "raw_address": "0x00075600", "virtual_address": "0x00077000", "virtual_size": "0x00002060", "size_of_data": "0x00002200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.54" }, { "name": ".rsrc", "raw_address": "0x00077800", "virtual_address": "0x0007a000", "virtual_size": "0x00000428", "size_of_data": "0x00000600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "2.55" }, { "name": ".reloc", "raw_address": "0x00077e00", "virtual_address": "0x0007b000", "virtual_size": "0x00003f3c", "size_of_data": "0x00004000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.77" } ], "overlay": { "offset": "0x0007be00", "size": "0x000021c0" }, "resources": [ { "name": "RT_VERSION", "offset": "0x0007a060", "size": "0x000003c8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.50" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Deployment Services Transport Client" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "wdstptc.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "wdstptc.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "3c65f6ec79947836caf6d8cb89f3bacb", "timestamp": "1999-06-29 22:16:48", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 14 }, "data": null, "strings": [ "MCTPConstruct[ACK]: Session=0x%x, Client=0x%x, Seq#=%I64u, HiOData#=%I64u, LossRate=%.16lf", "WimImageEnqueueOperation", "s,QQh", "6A7H7W7m7", "5:6i6s6", ".CRT$XLA", "jchx\"", "RestoreFileMetadata: RestoreFileInfo failed", "PQQhl", "Microsoft Time-Stamp Service", ";~4sj", "DeleteTimerQueueTimer", "94:?:m:", "\\\\.\\?:", "xaj&Y", "QPWSQQh", "http://www.w3.org/XML/1998/namespace", "RtlNtStatusToDosError", "EnableShortnamesOnApplyTarget", "%wNtE", "RestoreHardlink", "Compact", "WIMSetFileShortName", ">#>*>w>", "f92u9A", "#document", "?&?V?", "8 8N8i8", "CMicrodom_Blob", "malloc", "y0Vh[", "9sTtr", "QQQQj", "UCS-4", "WdsTransportClientRegisterTrace", "aNDO\\h", "NtQueryInformationProcess", "QQVW3", "*>G>", "<%<,<7<", "Cf9Y*", "QQSWj", "334L4z4", "D$PPhXz", "L$D_^[3", "9!949B9|9", "?-?;?K?g?", "WIM_Chunked_Number_Of_Buffers", "TFTPParse[Var ACK]: Block#=%u, WindowSize=%u", "SetFileValidData", "WIM_Chunked_Parallel_Decode", "ysWhE", "GetImageErrorCode", "4!464A4a4", "tGWj;P", "wcsstr", ":):s:", "system32", "QQQhl", "base\\eco\\wds\\transport\\client\\tptc\\tpcntperfinfo.cpp", "1`2e2", "OpenProcess", "SessionId", "QueueUserWorkItem", "[ybVhl", "MCTPParse[LEAVE:%I64x]: Session=0x%x, Client=0x%x, Reason=0x%x", "TerminateProcess", "2=3N3U3i3", "y6Vhj", "RestoreSecurityDescriptor failed", "s$97t", ".idata$5", "1(1_1j1", "t*WPd", "p%s%s%s", "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x", "8o8y8", "2=2l2", "2$2*21272=2Q2n2", "JOIN-ACK: ClientId=0x%x, RTT=%u, MinNACKBO=%ums, MaxNACKBO=%ums", "N,Ch@", "file corrupted in block at offset %p", "WDSTPTC", "Failed to get create a GUID.", "8,8e8{8", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART", "ResNodesSort", "RestoreAllData", "_purecall", "WIMCreateFile", "040904B0", "Microsoft Time-Stamp Service0", "t;j#j", "HeapFree", "m_uActiveReaders == 0 && m_ActiveWriter.m_uThreadId == 0 && m_uWaitingReaders == 0 && m_uWaitingWriters == 0", "Using backoff time %ums before processing POLL packet.", "swscanf_s", ".data$r$brc", "base\\eco\\wds\\wdslib\\crypt\\lib\\cryptstore.cpp", "jd+sX_", "TlsGetValue", "OpenEncryptedFileRawW", "Windows Deployment Services Transport Client", "base\\eco\\wds\\transport\\lib\\mcsepacket.cpp", "7B7M7", "\\Windows\\Syswow64\\", "SymKey", "0x%08X", "Session Details: Multicast Address=[%s:%u], Server Address=[%s:%u], Content Size=[%I64u], Total Blocks=[%I64u], Block Size=[%u], Session Id=[0x%x], Metadata Length=[%u], Security Mode=[0x%x], Sign Key=[%s], Symmetric Key=[%s], HMAC Algorithm=[%u], Hash Algorithm=[%u]", "1L2\\2}2F3V3", "Redmond1", "HashAlgId", "WdsTransportClientElSetLogFunctionEx", "ReadWimHeader", "DequeueWimData", ">2>9>r>", "DOCTYPE", "8[9i9", "ChunkWriterFlush", "LockFileEx", ">/>x>", "SSh @", "ENTITIES", "StringCchCopyN failed", "8\"878@8G8[8", "<==C>J>v>L?~?", "t$X9u t", "j\\Yf;", "m_ActiveWriter.m_uNestedReaders == 0 && m_ActiveWriter.m_uNestedWriters == 0", "364=4I4P4", "Multithreaded decoding for chunked WIM is enabled!", "<78?C?L?W?d?z?", "2%2F2Z2h2", ",SVW3", ".xdata$x", "4H4`4", "RestoreHardlinks", "m_pReaderSlots[uIndex].m_uNestedReaders == 0", "D$,W3", "6F6j6", "xM9sdtF", "<&=0=Z=m=", "_vscwprintf", "Incorrect filesize. Could be corrupted", "Microsoft Corporation1", "D$@j(P3", "<;=N=", "WdsTransportClientReleaseBuffer", "^VShx", "230865+4584940", "<\"<9= MAX_PATH!", "u,=0u", ";6;A;I;", ":N:g:#=", "IDREF", "WSASendTo", "6 6@6", "WIM\\IMAGE[*]\\TOTALBYTES", "AllocateReadChunk", "6$696N6c6q6", "Failed to build path to ci.dll inside GUID folder.", "L$t_^[3", "'0.0L0", "SetSysVolInfoPath", "~(9~0t", "msftwindow", "L$$RP", "GetAdaptersAddresses", "818;8q8", "t'j\\W", "=/=5=a=", ".text$x", "WdsTransportClientCompleteReceive", "=p=t=x=|=", "?0?7?B?I?Y?", "2%2R2_2u2", ";;7H7c7y7", "9t$ u39t$", "failed to extract file from reference extension", "9(909>9D9I9t9", "VarFileInfo", "Wait for work queue failed!", "fmalloc failed", "1d2{2", "3D4K4Q4a4g4o4v4{4", "20201009090804Z0t0:", "L$,!t$0!t$4", "V,9N,r", "pProcessResFileBackedByWim", "@(97u", "8)9M9X9S:f:", "MCTPConstruct[POLL-ACK]: Session=0x%x, Client=0x%x, Seq#=%I64u, AppDataLen=%u", "DeleteCriticalSection", "WSAAddressToStringW", "memmove", "AdjustTokenPrivileges", ";8;?;", "0", "base\\eco\\wds\\transport\\client\\tptc\\tpcntlossreport.cpp", "90C0y0", "91:*;:;E;m;u;", "0,02070{0", ";!;+;8;S;Y;i;v;", "WimAtExitReserve", "encoding", "Failed to get img event", "5;6B6M6", "1%1C1P1Z1(2E2X2_2k2", "040`0", "5d5{5", ">C>S>Z>g>n>w>", "_WSWf", "#wXsA", "D$0PQ", "181?1f1u1", "SVWj@3", "PQQVW", "CI EA is not supported because the host OS and applied image have a signature type mismatch.", "GetReaderSlot(uThreadId, &uIndex) == 0L", "=!=n=t=", ":(;/;", "5X5_5i5", "4.4s4}4", "?\"?W?|?", "EnumHashTable", "W950b", "HeapReAlloc", "UnlockFileEx", "QQPQQQQW", "TFTPParse[Request]: OpCode=%u, File=%s, Mode=%u, BlkSize=%u, WinSize=%u, Timeout=%u, TSize=%I64u, MsftWindow=%u", "j Yf;", "8e9b;o;", "System\\CurrentControlSet\\Services\\Wof", "l.sys", "535:5", "0\"141N1c1j1~1", "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x", "=E=P=", "Fail to read WIM header", "t$(VW", "Journaling is disabled on the applied volume.", "(SVW3", "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x", "WofMob", "BCryptCloseAlgorithmProvider", "All NACKs processed. Wait Time=%ums", "<04H4", "3i3s3s4}5", "`.data", "WofAdk", "414E4[4", "ELEMENT", "@\\;B\\t", "TFTPConstruct[REQUEST]: File=%s, BlkSize=%u, WinSize=%u, MsftWindow=%u", "I_RpcMapWin32Status", "ReadChunk", "596s6y6", "1C2M2^2", "=B>Z>z>", "uIndex != 0xffffffffUL", "=+=5=", "t2hl@", "8D9b9i9u9|9", "ChunkWriterEnqueue", "WIM_Skip_WIMBoot_Check", "D$8PhXz", "!E\\H4", ">%>E>", "; ;%;Q;\\;b;g;", "nOa-Q", "bcrypt.dll", "FltCommStubCreateChild", "Fp5N5", "T$ Wj", "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z", "FX;GXu", "Parallel chunk decode queue empty; switching to synchronous decode", "t=jPj", "base\\eco\\wds\\transport\\client\\tptc\\tftpcntdata.cpp", ".CRT$XCA", "BCryptOpenAlgorithmProvider", "FLTLIB.DLL", "GetFileSizeEx", "9+9S9i9", "=B>S>e>", "SetFilePointer", "CryptVerifySignatureW", "=*>=>K>g>", ";$;I;a;r;", "WdsCpPacketRelease", "3 3E3}3", "4X4i4|4", "1'2-232E2N2S2g2o2{2", "SYSTEM\\CurrentControlSet\\Control\\MiniNT", "3 3'383?3X3p3", "7V8d8", "G@PQQh", "ReadDirEntry", "v`QPh", "9\\$Lt", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "XkZu=", "9K:P:", "2l3s3", "j:Xf;F", "IsApplyWIMBootCompliant", ">*>H>R>}>", "Namespace", "Fail to flush file buffers", "4>5H5", "5C5r5{5", "200304182929Z", "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c", "D$>", "SetImpersonationCount", "CheckCIEASupport", "TFTPParse[Var ACK]: WindowSize (%u) is out of range", ">n?x?", "250701214655Z0|1", "octet", "GetVolumePathNameW", "273<3H3`3", "VerifyIntegrityChunk", "Failed to convert GUID to string.", ">P?s?", "base\\eco\\wds\\transport\\client\\tptc\\tftpclient.cpp", "WdsTransportClientCloseSession", "WdsTransportClientCancelSession", "WdsCpRecvPacketInitialize", "3l3v3", "4.464?4E4b4", "WdsTransportClientApplyImage: WIM file requires a reference image; none specified", "6!7R7Y7_7u7", "2%383@3}3", "Translation", "PRQh@$", "DecompressChunkedFile", ".tls$", "m_pReaderSlots[uIndex].m_uThreadId == uThreadId", "9Q9X9t9{9", "WimBufferToHexString", "9[:b:w:", "memcpy", "2 3Q4", "kernel32.dll", "GetModuleHandleW", "CI EA is only supported on when image contains OS version info.", "L$djo_", ".CRT$XLZ", "5`6;7A7", "CreateWimQueue", "GetSystemInfo", "cannot read WIM header", "9F s1Q", "5n6u6", "aYd(z_C", "#comment", "8e8|8", ";U;\\;h;~;", "t$VQh", "Failed to delete external file.", " http://www.microsoft.com/windows0", "_strtoui64", "tPVVPQ", "7&7P7r7", "MCTPConstruct[QCR]: Session=0x%x, Client=0x%x, QCC#=%I64u, BOTime=%u, HiODATA#=%I64u, LossRate=%.16lf, AppDataLen=%u", "ReadData failed", "base\\eco\\wds\\transport\\client\\tptc\\tpcntdata.cpp", "4+4;4A4O4y4", "5#5Q5V5", "RestoreFileDataCallback", "HQC!!", "5O6Y6x6", "4@5G5", "EnumRefExtEntries", "2G3`3", "version", " SVW3", "D$ QP", "6'7.7:7Z7", "=\">,>", "u QQS", "WIM\\IMAGE", "9w,v)", "CompressCaptureNode", "Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}", ";/Q?]?|?", "%ws\\%ws", "base\\eco\\wds\\transport\\client\\tptc\\TpCntJoin.h", "The existing WIM file became corrupted", "yJWhe", "1=1D1O1V1r1", "4%5/5E5j5|5", "<<>c>", "GetHandleInformation", "y+VhQ", "WIM\\IMAGE[*]\\HARDLINKBYTES", ".tls$ZZZ", "strtoul", "2\\3c3", "D$LSP", "9\\$,t", "base\\Eco\\WDS\\wdslib\\net\\UdpSocket.h", "WWWVt", "Converting to NT filename failed", "WdsClientPacketFree", "pWdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms", "This client is now the master client.", "header version mismatch", "FileDescription", "; hash = ", "WdsTransportClientInitializeSession", "Deleting NACK for seq# %I64u-%I64u because all repairs are done.", "0+1G1", "f9XBt", "_XcptFilter", "3*383", "zupkfb^ZVSOLIEB@=:7520-+)&$\" ", "1+1:1\\1", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "=+=>=C=I=]=b=n=", "F8PSj", "Failed to create GUID folder.", "GetFileInformationByHandle", "(0:0T0", "9X`t7", "9M,tN", "r%*U$", ".idata$6", "@&0_DM", "PrepopulateList", "0-2D5u5", "wcschr", "WIM_MetaData_Queue_Length", "ry9|$ |s", "CryptImportKey", "D$0PS", "9s v5", ";(!>}>", "WimInitXmlInfo", "8&848;8I8P8l8", "WdsTransportClientQueryStatus", "http://www.w3.org/2000/09/xmldsig#", "127.0.0.1", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp", "?!?'?-?F?", "UCS-2", "Microsoft Corporation", "WS2_32.dll", "K{m8Z8a8", "RegQueryValueExW", "?w$tQ", "9J:`:g:n:u:", "pPQQj", "0&0A0", "8*808", "272C2M2a2q2{2", "RestoreFileMetadata: RecordFileDataLocation failed", "9p\\t:", "D$HPj", "GWVVP", ";-;8;", "\\Windows\\Microsoft.NET\\", "reparse point tag too short in filestream", "10272c2j2w2~2", "WVh m", "3)343", "9':.:", "GetProcessHeap", "WofCompressFileWithHandle", ":(:>:c:", "MCTPParse[NACK:%I64x]: Session=0x%x, Client=0x%x, HiODATA#=%I64u, LossRate=%.16lf, RangeCount=%u", "747R7p7", "InterlockedPushEntrySList", "_ftol2", "LoadLibraryExW", "788P8u8", "*Q`L]", "WVhxl", "0$1L1Z1f1|1", "7!7+7;7B7O7U7`7", "Failed to mark image for compact state.", "SetEndOfFile", "2%2.282R2Y2e2l2s2", "GetSecurityDescriptorControl", "WdsClientExecute", "4'464L4[4a4", "WIMCommitImageChanges", "5m8{8", "5C5Q5j5", "9^ vf", "jaYjz^j:Z", "WriteEncryptedFileRaw", "RegSetValueExW", "8<9F9", "SVWj43", "InterlockedPopEntrySList", "2:2T2Z2", "wdstptc.dll", "L$,QP", "hSVW3", "\\lL\\q", "GetSecurityDescriptorSacl", ";F,s.", "WVh0l", "UD;UD", "??1exception@@UAE@XZ", "ExclusionList", "9B\\t\"9C8t", "9X`v^j", "1*1Y1c1", "9WHvQ", "u7SQh", "TFTPConstruct[ACK]: Block#=%u", "%s.%s", "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...", "`V@Pj", ";1;6;", "PPSVj", "%s[%s:%u] %s", "=!=,=v=", "GetTempPathW", "2D2K2", "ReleaseDataRange", "WideCharToMultiByte", "C;X`s", "\"Microsoft Window", "Deleting NACK for seq# %I64u-%I64u because no blocks are missing.", "RestoreSecurityDescriptor", "5 6<6B6d6", "9&9K9]9d9t9{9", "MCTPConstruct[NACK]: Session=0x%x, Client=0x%x, HiODATA#=%I64u, LossRate=%.16lf, RangeCount=%u", "9r4uC", "GetSecurityDescriptorLength", ">\">j>x>", "RestoreFileData", "WaitForMultipleObjectsEx", "4C4N4v4", "ValidateBinaryFileAndSetEA failed", "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x", "9-:<:B:G:^:", "Failed to restore wimboot entries", "9\\$$v", "No activity for long time: %I64u ms.", "m_uInitCount == 0", "D$$PR", "=Q>V>s>y>", "7,7N7Y7j7", "FreeAddrInfoW", "RtlDeleteResource", "5I6_6", "6*6P6k6", "%s:(%d)", "ADVAPI32.dll", "SjdPj2j", "4*5\\5c5", "EnterCriticalSection", "MCTPParse[JOIN:%I64x]: Session=0x%x, Client Name='%s', IP=%s, MAC=%s", "9_pt#h", "=+=2=X=", "EventUnregister", "+0I0|0", "t$ RP", "FBf;E", "050<0G0", "Delay before sending LEAVE packet: %ums", "RtlReleaseResource", "\\$4YY", "9_puY9", "3,fTidTq ,>gEB;", ";/;;;S;^;", "GetIfTable", "Ignoring ODATA Seq#=%I64u because its less than our first ODATA Seq#=%I64u", "9S0vmR", "tSh`W", "6#7^7", "GetOverlappedResult", ";7<=8>M>", ";M;x;", ".?AVbad_alloc@std@@", "D$ 9u", "252@2x2", "UuidToStringW", "2,2w2", "NMTOKENS", "RestoreMountStub: error creating destination file", "t&jPj", "Continue to apply the image without setting CI EA.", "GetVolumeRootFromPath", "=K=c=z=", "netascii", "f9:tD", "2!2I2", "9V:e:k:", "SVWj2", "_onexit", "G^{P&a", "t1j\\P", "AddIPAddress", "\\\\?\\GlobalRoot", ":QVEE", "L$|_^[3", "RtlGetVersion", "CryptHashData", "757\\7", "1<2K2[2", "q@boA", "Address", "WWWWV", "!|$<9}", "t;f97t6", "DecompressChunkedFile failed", "?3?W?c?v?", "REQUIRED", "$filehashes$.dat", "(SVWj", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\stopwatch.cpp", "InitializeCriticalSectionAndSpinCount", "; <*J>|>", "Microsoft Corporation1(0&", "GhPQj", "LegalCopyright", "?G?m?t?", "9D9e9o9", "FilterLoad", "RSDSD,", "k>", "\\Windows\\System32\\config\\SYSTEM", "=&=?>I>g>q>", "MCTPConstruct[LEAVE]: Session=0x%x, Client=0x%x, Reason=%u", "ReleaseSemaphore(m_hReaderSlots, 1, 0)", ">I>a>", "$`2X`F", "\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}", "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART", "<%<8U?c?s?z?", "ReadWriteDataInternal", "Failed to get volume root!", "GetFileVersionInfoSizeExW", "ImageWorkerThread", "K?R?`?g?w?~?", "PVVj@Wh", "1.2q2", "EventRegister", "LookupPrivilegeValueW", "6&6K6", ";&;B;", "txhl>", ".edata", ">'?1?n?y?", "959H9", "<7=N=U=v=", ":*;N;U;", "::;R;e;o;Y<", "s(QQh", "9^,tkSQ", "GetFileInformationByHandleEx", "1)171A1_1", "9w8t7", "2&2J2T2$3.3{3", "RegOpenKeyExW", ":I;{;", "setting hardlink failed", "UserSid", "8,9i9s9", "WdsTransportClientApplyImage: Ending WIM request loop (next=%u)", "RestoreMountStub: Could not move hardlink stub to prepopulate location", "ResExtractToFile failed", "5:5L5n5", "F4QQS", ".00cfg", "747H7R7", "WIM_FileData_Number_Workers", "D$L9A", "39HPt", "GetQueuedCompletionStatus", "Failed to set CI EA on temporarily extracted ci.dll.", "base\\eco\\wds\\transport\\lib\\tftppacket.cpp", "F;w$r", "WimStrDupe", "BlkBitmap: Total %u missing ranges.", "base\\eco\\wds\\transport\\client\\tptc\\apcntdata.cpp", "QPQPj", "GetCurrentThread", "8)848U8{8", "#Vx\"&6", "=.=5===J=V=", ";*bSecData)))", "1(0&0", "x=[4n", "6C6o6", "9*:z:", "WriteData failed during NULL block copy", "?@?J?", "GetFinalPathNameByHandleW", "D$4WSP", "Microsoft Code Signing PCA 20100", "D$H)FH>^>m>", "7Z>@B1", "D$L;T$8r", "Failed to get img buf", "\"9^Dt$S", "<,<6&>,>9>N>`>g>}>", ",>3>A>H>h>o>{>", "8/8B8O8V8", "$Microsoft Ireland Operations Limited1", "MCTPParse[ACK:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, HiODATA#=%I64u, LossRate=%.16lf", "t{93tw", "WIMInitializeWofDriverInternal", ">=?D?X?d?l?", "040D0a0o0y0", "^d9^ht", "<24484<4@4D4H4L4P4T4X4P9", "WIMSendFileInfoMessage", "<.=k=", ".CRT$XCZ", "WIM\\IMAGE[*]\\DIRCOUNT", "_FC;]", "20201008090804Z", """, ";(;`;i;p;y;", "CryptReleaseContext", "CMicrodom", "5\"666A6S6X6l6", "TFTPConstruct[Var ACK]: Block#=%u, WindowSize=%u", "CreateEventW", "\\Program Files\\WindowsApps\\", "SQh4C", "Microsoft Enhanced RSA and AES Cryptographic Provider", "D$|PQ", "WIM %s, offset %.8x%.8x, length %x", "A\\;B\\u", "D$d9C", "??0exception@@QAE@XZ", "0E0L0s0z0", "~D+^8", "%I64d", "5 5&5,595@5F5P5V5a5g5r5y5~5", "1T1Y1^1n1", "292@2K2~2V314;4x4", "GetSecurityDescriptorOwner", "RestoreFileInfo", ".text$yd", "WriteData failed", "C +C(", ".CRT$XIAA", "N4;F4r", "E$j$Z", "5,565N5U5d5s5", "6>8_9g9o9", "7y8}8", "HMACAlgId", "DeletePath: Cannot delete .", "t0QQj", "=\">,>v>", "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x", "4`4g4h5", "97u\"3", "WdsTransportClientApplyImage: Starting multicast session", "j\\Zf;Ty", "5\"6)6", " 0T0[0", "PVVVVh", ";q<{<", "NtCreateFile", "DeleteFileW", "tjj:V", "GetSystemTimes", "7*848L8Y8_8v8", "161D1^1,292E2", "Failed to get the host OS version.", "m_ActiveWriter.m_uNestedReaders > 0", "WWWPW", "RtlAcquireResourceShared", "ApplyReparseFixup", "PrivilegeCheck", "Could not disable journaling (to restore original state) on the applied volume.", "ReleaseSemaphore", "(ULONG) _InterlockedExchangeAdd((LONG volatile*)&(m_uOwnerThread), 0) == GetCurrentThreadId()", ": :%:", "??0exception@@QAE@ABV0@@Z", "RegCloseKey", "RestoreDirTree", "_InterlockedExchangeAdd((LONG volatile*)&(m_lPendingWriteOperations), 0) == 0", ";p/>", "BuildFileNodeHashTable", "NOTATION", "FIXED", "474K4R4", " Windows", "t-j._f;9u", "NtSetCachedSigningLevel2", "p!c5Mf", "CompressionExclusionList", "9D$$t", "6!6\\7", "NACK seq#%I64u-%I64u - Holding off NACK because Fw window is full.", "4#5v5%6m6", ",f~|z[WP", "707k7r7", "WimMount", "WdsTransportClientRegisterCallback", "6$6,646<6D6H6P6X6`6l6t6|6", "1!1t1{1", "This client is no longer the master client.", "*41;D$(?R?g?", "2d3K4v4", "9/:k:", "_^[+P", "CreateFileMappingW", "9(979q9x9", "7G8M8", "7N8X8u9", ">$?1?C?T?_?t?", "base\\eco\\wds\\transport\\client\\tptc\\wdstptc.cpp", "CloseEncryptedFileRaw", "CChildCount::WaitForChildren failed; %u", "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x", "Sleep", "5H6M6", "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x", "=\">F>U>v>", "=8>^>t>", "1+1?1\\1r1|1", "250706205017Z0~1", "@;F4~", "WSARecvFrom", "1 1(1L1U1", "GetCurrentProcessId", "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x", "VerQueryValueW", "100706204017Z", "2'3@3P3", "LocalFileTimeToFileTime", "SQhh)", ": :l:", ";D$6H6", "Substitute name string copy failed", "RtlGetLastNtStatus", "8r ,Y", "CI EA is not supported due to mismatched versions of host OS and applied image.", "RestoreFileCompression", "BCryptDestroyHash", ".idata$4", "5 5,585D5P5\\5h5t5", ">6>\\>h>", "j@h@X", "\\\\?\\UNC", "j?Xf;", "595?5T5Z5p5", "Microsoft Corporation0", "9):.:q:", "KnILk", "D2J5A", ":M:m:", "QueryPerformanceCounter(&liTimeStamp)", "G PVQ", "G0U0[0`0", "QueryPerformanceFrequency", "C\\;G\\u", "NtYieldExecution", "0'0L0", "GetVolumePathNamesForVolumeNameW", "NtQueryInformationFile", "NDATA", "#,|6d", ".CRT$XIA", "4_4f4", "base\\eco\\wds\\transport\\client\\tptc\\transportclient.cpp", "tIVS3", "?]?b?", "TlsAlloc", "InitLZMSDecompression", "WdsTptcDownload", "9&9A9g9", "RestoreDirTree: RestoreFileStorageTierClass failed", "u&Qh N", "GetCurrentDirectoryW", "=.=5=L=V=e=t=}=", "BX;AX", "G QQVP", "?what@exception@@UBEPBDXZ", ">C>M>", "[F$d*", "WWh >", "CreatePath: Unable to create [%s]; GLE = 0x%x", "Af;H(s", "FindFirstFileW", "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]", ".rdata", "D$pSVW", "0=0H0x0", "WdsTransportClientWaitForCompletion", "G ;F\\", ";;W>{>", ",?8?y?", "OriginalFilename", "WDSMCSE[Request]: Namespace=%s, Content=%s, Mac=%s", "tWVPj", "base\\eco\\wds\\wdslib\\crypt\\lib\\cryptkey.cpp", "RestoreFilesCallback", "_CxxThrowException", "5K5a5", "171I1W1w1}1", "<)6>Q>_>{>", "\\\\?\\Volume{", "G$9G t", "9#9-9>9C9", "RtlInitializeCriticalSection", "WdsTransportClientShutdown", "1T1n1z1", "RtlFreeHeap", "m_pTpCntData->m_uFirstODataSeqNo > 0", "WimSetSecurityDescriptor", "D$(9G", "9~Ht.V", "MCTPConstruct[NACK]: Range=%I64u - %I64u", "SSh ", "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x", "4#414", "t[VW3", "_callnewh", ";DMdSpu", "8#8m8", "UDP Endpoint[Data] - Local=%s:%u, Multicast:%s:%u, Unicast:%s:%u", ">1>N>Z>", "t4f97t", "CreateTimerQueueTimer", ":):6:j:", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", ">@.6Y", "tmj\\W", "8k9#:", "2L3S3(4/4m4t4", "base\\eco\\wds\\transport\\client\\tptc\\tftpcnttimeout.cpp", "wprintf", "3*3F3S3Z3", "NH9^,t", "MultiByteToWideChar", "ValidateFileAndSetEACallback", "RevertToSelf", "@.rsrc", "memcmp", "7\\7r7", "Microsoft Time-Stamp PCA 20100", "C;_,r", "8.:';", "000P0]0e0k0q0", "696D6N6y6", "v!jz^hx", "PQQh [%s]", "4,464P4j4", "<3===", "WaitForSingleObject(m_hReaderDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )", ".idata$2", "9slu!j", "@\\jdPQ", ">#?;?t?", "FH;A8", "6!7)7D7`7", "=<>r>", "ObjectLength", "IMAGE\\WIMBOOT", "9K9U9", "WIMLoadImageInternal", "InitLZMSCompression", "Failed to remove directory", ":3:M:S:", "0!02090y1", "LeaveCriticalSection", "BlockSize", "GetEnvironmentVariableW", "7E7h7", ")`yJb", ">1>W>^>", "C(;C$", "8$8G8k8u8|8", ".rdata$T$brc", "Could not move source file", "TotalBlocks", "60>0b0", "D$DPj", "ProductVersion", "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x", "=Q=\\=t=", "556O6", "GetVolumeInformationW", "6K6n6x6", "wcsnlen", "=h=}=", "RDATA Repair received - seq#=%I64u", "2/3X3", "2`2g2", "MCAPParse[DATA]: Blk#=%I64u, DataLen=%u", "NtQueryVolumeInformationFile", "(PWWj", "<$<.<^", "VWhlC", "VS_VERSION_INFO", "Content", "3_^[]", "LocalAlloc", "8H8i8", "DeleteFileEx: Unable to open [%s]; GLE = 0x%x", "OutputDebugStringW", "OLEAUT32.dll", "5d6n6", "0#0*0`0g0", "9\\$0t]", "j\\Yuk", "O0M0K", "WIMCloseWIM", "0$0-0;0Q0a0n0u0", "6y7|9", "SWPQh|F", "WimBoot", "RestoreEncryptedFile", "595U5q5", "4\"5/595A5K5\\5d5r5|5", "Multithreaded chunked decoding disabled via environment variable; will skip!", "MCTPParse[QCR:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, BOTime=%u,HiODATA#=%I64u, LossRate=%.16lf, AppDataLen=%u, CPU/Mem/Net=%u/%u/%u", "VERSION.dll", ":/:::q:", "IMAGE", "DeviceIoControl", "D$lSP", "CreateDestinationFileEx", "<%=/=L=e=j=", "Failed to get decoder context", ">7>_>", "jOh %", "GetMetadataPadding", "FindNextFileNameW", "IMAGE\\WINDOWS\\VERSION\\BUILD", "->3>Q>X>c>", "Iphlpapi", "RtlInitializeResource", "[%s:(%d) -> %s] %s", "base\\eco\\wds\\transport\\client\\tptc\\tptclientmanager.cpp", "base\\eco\\wds\\wdscsl\\lib\\controlpacket.cpp", "7!8+8_8", "RPRRj", "SYSTEM", "ProcessDirectory", "Failed to set directory extended attribute", "RestoreDirMetadata", "jaYjz_j:Z", "trPWQ", "ReadMetaDataFile", "YY_[^", "WIM\\TOTALBYTES", "RestoreDirMetadata: RestoreFileStorageTierClass failed", "@u)j@j", "RecordFileDataLocation", "WimParseHexString", "Reset setting hardlink failure because of folder redirection", "8,838C8W8", "?1?8?T?{?", "\\Windows\\WinSxS\\", "GetSystemDirectoryW", "7A7b7m7", "=0=7=X=_=p=w=", "?Q?a?", ".rsrc$01", "ReleaseSemaphore(m_hWriterDone, m_uWaitingReaders, 0)", "_vsnprintf", "u!jx[h", "IDREFS", "_unlock", "2\"2:2N2S2", ":1;8;I;P;", "WdsClientFreeLibrary", "NACK seq#%I64u-%I64u - not all RDATA received, missing ranges=%u, new NACKBO=%ums.", ".gfids", "!t$$Pj", "(m_uCurrentStatus != 0x0001) && (IsKilled())", "0&000", ".rsrc$02", "WdsTransportClientApplyImage", "NtSetSecurityObject", "tsize", "memcpy_s", "5%666q6", "GetLastError", "030V0d0", "%I64u", "DeleteFileEx: Unable to allocate hardlink path buffer", "x69T$", "3O4a576\\6", "333~3", "MCTPParse[KICK:%I64x]: Session=0x%x, ClientCount=%u", "Failed to set wof data for file backed by wim file", "MCTPParse[NCF:%I64x]: Session=0x%x, Range Count=%u", "1F1z1", ";N1^1", "uYf9s", "CDATA", "9t$ t", "UnhandledExceptionFilter", "__dllonexit", "97vhS", "6)636Y6^6", "WIM_Verbose_Logging", "=e>4?O?j?", "ChangeTimerQueueTimer", ">16)&0xffff)", "]_^[]", "\\$ ;E", "RegUnLoadKeyW", "0N1`1i1", "=hK2/;", "advapi32", "Process %s is accessing file wim %s", "GetFileNodeFromPath", "RtlFindAceByType", ";8;J;S;e;", "EnumAndDeleteWimExternalFilesProc", "UpdateWIMHeader failed", "WimImageSetInformationFile", "GetFullPathNameW", "MarkImage", "CreateDirectory failed", ".giats", "A,;F8u", "7(7?7\\7", "WdsTransportClientApplyImage: multicast buffers full; downloading extent [%I64u,%I64u) directly", "qsort_s", "0(0/0A0", "PWVVj", "j:Yf9H", "9(9=9C9b9h9", "w|PPP", "8 888|8", "GetAclInfo failed", "+T$\\+", ";=;H;N;S;", "failed", "PinningFolderList", "=9=w=", "WdsTransportClientApplyImage: applying cached extent [%I64u,%I64u)", "t6VVSh0", "Failed to apply privileges!", "L$4_^[3", "uvPSW", ")Microsoft Root Certificate Authority 20100", "FilterAttach", "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x", "j?Zf9TH", "AcquireSRWLockExclusive", "100701213655Z", ";7;K;[;j;|;", "WaitForSingleObject", ">/>=>C>H>|>", "Q>_>", "8#8o8", "D$,_^[3", "SwitchToThread", "L$hQS", "QPh$2", "\\Windows\\System32\\", "ReadMetaDataBuffer", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\fileutil.cpp", "9MdHdu", "6 6(686@6}6", "6r7}7", "343?3o3", "CreateParallelDecodeInfo", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z", "RestoreDirTree: WimImageCreateFile failed", ">1)4+!;", "_wcsicmp", "base\\eco\\wds\\transport\\client\\tptc\\tptcdownload.cpp", "80979K9R9", "1&2,212[2w2", "QQSV3", "WimApplyPrivileges", ".idata", "taj=R", "GetFileAttributesW", "CheckDataAvailableForHash", "10.0.19041.572 (WinBuild.160101.0800)", "T$(;T$8", "0,171", "TFTPParse[ERROR]: Code=%u(0x%x), Desc=`%s`", "TpMcAddress", "9{$t|", "=%=0=A=G=W=a=", "QSVW3", "-Tz4q", "0$0.0=0D0O0", "ProcessSecurityData", "0*1A1I1Q1l1{1", "f;D$Pu", "CryptCreateHash", "?#?>?L?V?q?", "WVhhm", "Failed to set Wof data for file", "GetVolumeInformationByHandleW", "", "WSAIoctl", "?,?6?I?{?", ">#?/?@?K?~?", "UUUUf", "848;8T8[8j8q8", "ReadFile", ";,;7;>;F;O;];n;{;", "<:=m=x=U>Z>", "<*4o4w4", "QSVWj", "f9FHu", "!G@jEXf", "4%4/474>4N4", ")MCTPConstruct[JOIN]: Session=0x%x, Client Name='%s', IP=%s, MAC=%s", "WimBoot apply failed because the wim file has to be local!", "WimFindClose", "RestoreDirMetadata: RestoreFileInfo failed", "WIM_Enumerate_Directory_Reparse_Point", "YRPWWWWW", "F(QPj", "3N3U3", "_wcstoi64", ";*;?;f;u;", "oeY<9", "base\\eco\\wds\\wdslib\\crypt\\lib\\crypthmac.cpp", "MCAPParse[PROGRESS]: Time-in-Session=%us, Progress=%u", "Multicast Client: Server=[%s], Namespace=[%s], Content=[%s]", ">!>2>9>G>s>", "252<2", ">#>E>\\>q>", ":,:2:I:P:r:x:", "((((m_uSecurityMode) & 0xffff) == (1)) || ((((m_uSecurityMode)>>16)&0xffff) == (1)))", "=f=k=B>L>j>t>", ".0B0Y0d0", ";,;3;", "K>\\>m>x>", "> >(>B>H>", "WimbootProcessBeforeApply", "RestoreMountStub", "j,h0Y", "towupper", "HPWh|z", ";|$Xt", "2B2I2N2X2", "KERNEL32.dll", "GetDriveTypeW", "Insufficient resources for multithreaded chunked decoding; will skip!", "onecore\\internal\\base\\inc\\private\\eco\\wds\\UserWorkItemConnector.h", "t(9\\$", "8+8q8", "TFTPParse[ACK]: Block#=%u", "tKf9>tF", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp", "L$8;U", "9x\\tCW", "L%c%s", "MoveCaptureNode", "SetEvent", "848O8", "WimLazyInitialize", "<>=q=", "MCAPParse[S-CIR]", "1-141E1L1\\1c1w1", "495\\5p5", "1'1X1", "Expected [%u] contiguous parts, but missing part number [%u] for [%s]!", "GetVolumeNameForVolumeMountPointW", "0V0`0\"13191>1b1l1|1", "IMAGE\\WINDOWS\\VERSION\\MINOR", "!~<9~@t", "WIMApplyImageInternal", ";0;F;[;h;", "uM9xXu", "QQSVW", "FreeMibTable", "CopyFileExW", "WDSTPTC.dll", "=>>H>", "wof.sys", "ReadData reparse tag from filestream failed", "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x", "#text", "< <=V?[?r?", "UncompressFileBase", "5U6H7O7O8", "CreateDirectoryW", "5O5V5", "9\\$`t", "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART", "1|2E5", "?%?N?X?k?", "MSCFu", "WdsTransportClientInitialize", ";:http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "8'828", "3)333S3a3g3l3", "Setup", "jWX_]", "vXQQh", "6$6H6`6e6", "8M8c8", "SetLastError", "6G6]6", "base\\eco\\wds\\transport\\client\\tptc\\mcclient.cpp", "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x", ">MdDtu", ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0", "WimCreateDirectory", "WdsTransportClientApplyImage: recovering from multicast session startup failure (0x%08x); using direct apply", "9$9@9Z9", "oK0D$\"<", "_lock", "m_ActiveWriter.m_uThreadId == GetCurrentThreadId()", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\mrswlock.cpp", ".rdata$brc", "s`9s\\t", "Microsoft Code Signing PCA 2010", "\\Windows\\Assembly\\", "8B:J:_:|:", "base\\eco\\wds\\transport\\lib\\mctpconstructor.cpp", "2:2?2o2", "BCryptFinishHash", "z.9Wv", "base\\eco\\wds\\transport\\client\\tptc\\tpcntqcc.cpp", "ProcessWimQueueNode", "5!5=5M5S5i5~5", "j@Yf;", "u;9_0t6", "D$0;D$(", "9N$w;", "9,979m9}9", "=^>l>x>", "RestoreRefNode", "WDSCSL.dll", "CreateFile failed", "uVf9S", "I0i0p0'1", "?;?}?", "windowsize", ";]>a>e>i>m>q>u>y>}>", "stat. failed", "5@6G6c6j6", "5&5A5h5o5", "4]4d4", "ImpersonateLoggedOnUser", "465@5V5v5", "VPiw&", "D$ ;D$", "GetFileVersionInfoExW", "j0hXW", "m_uStartBlock <= uStartBlock", "CP9C9?]?", "onecore\\internal\\base\\inc\\private\\eco\\wds\\locks.h", "S(_^[", "6/7h7o7y7", "D$PPQ", "System Volume Information", "SetFileSize failed", ":MdLcu", "INDEX", "5/6>6o6'717N7X7y7", "WdsTransportClientAddRefBuffer", "t=Wj,j", "2,3-6a7", "A4;F;H;^;d;", "fltlib.dll", "8V8l8", "NtSetInformationFile", "K>", "7!7@7Y7^7", "1B1L1r1", "B\\;A\\", "RemoveDirectoryW", "7V8]8", "GetSystemTimeAsFileTime", "memset", ">F?a?", "=\\>c>", "> >'>8>", "GetTickCount", "888X8x8", "MCTPParse[RDATA:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, Trail#=%I64u, Data Len=%u", " !\"\"\"#$ &&&%%%%%%%", "5Fz<|", "New Master Client as reported by server: 0x%x (this client: 0x%x)", "pQCR Backoff selected=%ums", "Client demoted to MAddr=%s:%u, UAddr=%s:%u", "5(6/6\\6c6", "LocalFree", "MCTPParse[SPM:%I64x]: Session=0x%x, Seq#=%I64u, Client=0x%x, MinNACKBO=%u, MaxNACKBO=%u, Trail#=%I64u, Lead#=%I64u, RTT=%ums", ">=?D?", "ParseChunkRegionInternal", "ProductName", "1R1Z1q1", "TpUniAddress", "VerifyFileByHandle", "K4;C u(;K$u#", "8!8I8S8", "Xf9ABt", "8)8E8L8a8,939>9E9", "2g3p3", "Failed to load WofAdk!", "%s\\%s", "041;1", "_except_handler4_common", "PostQueuedCompletionStatus", "v!VQhDL", ":*:2:{:", "WIM\\IMAGE[*]\\WIMBOOTENTRIES", "WdsCpPacketInitialize", "MCTPParse[POLL:%I64x]: Session=0x%x, Seq#=%I64u, BOTime=%ums, DataLen=%u", "=!=Q=[=", "GetAclInformation", "RestoreDirData", "t#j\\Q", "RestoreRefNodeCallback", "GetSysVolInfoPathFromMountPath", "1'232=2C2P2", "_wtoi", "20201008073425.887Z0", "SetFileTime", ";4>16)&0xffff) == (3)))", "0%000O0Y0", "WimMoveFile", "^j?[;", "FlushFileBuffers", "50585Z5d5", "timeout", "!This program cannot be run in DOS mode.", ":,;=;D;\\;u;", "t1VPQ", "4=547", "C<+C(", "SRh`]", "WdsTransportClientApplyImage: received data block not aligned on block boundary; offset=%I64u, blocksize=%u", "7+7a7", "f@f#E", "3 3P3Z3", "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x", "9r$tL;", "DeleteFileEx: Trying to set back attributes on: %s", "ResExtract", "windows", "SignKey", "OpenThreadToken", "WimGetFileIdByHandle", "OpenProcessToken", "9P t49P", "QQQQQQQW", "D$LVW", "CloseHandle", "? ?h?r?", "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]", "j6J6Q6]6l6{6", "WIM\\IMAGE[*]", "wdstptc.pdb", "8:9Q9|9", "NACK for seq# %I64u-%I64u deleted because trail# is now %I64u.", "T$(9T$8", "D$ QQQQj", "T$(9GL|X", "][YZ_^_^[", "WaitForMultipleObjects", ";&;d<", "FileVersion", "G(;G r>Q", "< <$<(<,<0<4<8<<<@)?3?", ":(:@:y:", "CompareStringW", "SVWh@", "3D3d3", "CreateThread", "210121231916Z0" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "560afe20f035e65836990ab3cc33778a7d2eb74b03ad109a22067763e5764dc2", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/560afe20f035e65836990ab3cc33778a7d2eb74b03ad109a22067763e5764dc2", "guest_paths": [ "overlay" ], "size": 8640, "crc32": "6DF20D1E", "md5": "7c0508a2af65e2c1eb353698f5d7983e", "sha1": "477bf5c8cf2beb0860b913576cb9a0fb0d3c2302", "sha256": "560afe20f035e65836990ab3cc33778a7d2eb74b03ad109a22067763e5764dc2", "sha512": "61a8e93149776e10c0a854b3601e6112a6a0ec0141e1a88992403a2c539731b399c4839891251a53f2b15bf9cbbff0521fe2a9bfc67a1769ec0ea0b95cb6c1e0", "rh_hash": null, "ssdeep": "192:YWf9BvVVWQ4yWfjmFpeLirKqnajlIMDCh:9NVOLIKlmMGh", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1EF0229A2CE6C9043EA927C5053C8DDD77C3D93C7294090A612AEFAE81DC37C1EB0196E", "sha3_384": "08870b1440e51dce6b6d73ef8a6ea8637f8741bfefdc0f9bfc050165006c342106ab63d5fb1c631dabdb44f96e58e171", "data": null } ], "extracted_files_time": 0.0005460909997054841, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 }, { "name": [ "diagwrn.xml" ], "path": "/opt/CAPEv2/storage/analyses/3/files/802714b04896fddfe08391c30cb90d04c61439692b83c2d971270e7ef45a925a", "guest_paths": [ "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" ], "size": 5021, "crc32": "5095FD28", "md5": "c143e777a8dfbaae160c84e5670f6f1c", "sha1": "4ced11076f67d5e7ea4949e650698b39d9b3f8d1", "sha256": "802714b04896fddfe08391c30cb90d04c61439692b83c2d971270e7ef45a925a", "sha512": "35afe8b73a2b2ff53f00f47e847ccaa547deff9e4893c2e6a9db517ab57e58c965c9e8d3d8b3489763b1d5374a12c71d6c951d8cf2d306832023f682f08d955d", "rh_hash": null, "ssdeep": "96:5MwiGdgbnE0jiecW0jiecw0jiecu0jiecENan0yCS4StSDaMVn7y:53gbELWLwLuLENKMrSkDaMx2", "type": "Unicode text, UTF-8 (with BOM) text, with very long lines (375)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T10DA1122C71E91D679E5002C9CFF23E9213816D2A06A2E07F30C5FDA965740C6DAB9399", "sha3_384": "e9d28ffaf0a4961347450ce93ecdcb5d55ddfa7d7c196ce77f57e964221ee81e098563e27c8da60524a821b2d4dd71bc", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\\xfeff\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "setupact.log" ], "path": "/opt/CAPEv2/storage/analyses/3/files/7feeef538f19b2376cb414f91422560b9a658ea4b4338e04a3499a76042c86fe", "guest_paths": [ "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" ], "size": 6442, "crc32": "7BCFEA80", "md5": "af1a200f55e1cc86a39c5aae2bb28f2e", "sha1": "3edb8720398ab0dc91755e033b54a23d494f9e6e", "sha256": "7feeef538f19b2376cb414f91422560b9a658ea4b4338e04a3499a76042c86fe", "sha512": "b0524d213d0e9c825dd73bada425ee9ac9d09d2e5bff2e645972464dd51fd1de42f6d605eacd3f977871f7cca629bcfb247ab199c73ae1b43b093a86de1c2ec8", "rh_hash": null, "ssdeep": "96:ORzclyNAJXmrBatuMSrecKc2ec2q4ecmo4ecgRDzRaJnwGcvAkVYpcn7Fw:kxBa4L8sigRD9E", "type": "Unicode text, UTF-8 (with BOM) text, with CRLF line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1CED17B15BFBE481366F74A42E7A8660D2A1B3C177AEDB2BF317DC1552B1826082F0284", "sha3_384": "d1aeb78e2ef40da0aedc23abb97a47fb6196752e5b50965a5d533844332021e2814e4beb8f9bc1a9303cab0bb6395575", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\\xfeff2026-05-28 15:53:02, Info SP CSetupPlatform::Initialize: Setup log starts:\n2026-05-28 15:53:02, Info SP SEH: Enter CExceptionHandler::CExceptionHandler\n2026-05-28 15:53:02, Info SP SEH: Exit CExceptionHandler::CExceptionHandler\n2026-05-28 15:53:06, Info SP Host system information:\n VM: YES\n Firmware type: PCAT\n Manufacturer: BOCHS_\n Model : BXPC____\n BIOS name : Default System BIOS\n BIOS version : 1.23.1\n BIOS release date : 20140401000000.000000+000\n Total memory : 4294967296\n Number of physical CPUs : 2\n Number of logical CPUs : 4\n Processor manufacturer : GenuineIntel\n Processor name : Intel Core Processor (Skylake, IBRS)\n Processor caption : Intel64 Family 6 Model 94 Stepping 3\n Processor architecture : x64\n Processor clock : 3686\n\n2026-05-28 15:53:06, Info SP Antivirus software information:\n Name: Windows Defender, Path: %ProgramFiles%\\Windows Defender\\MsMpeng.exe, Timestamp: Thu, 28 May 2026 15:30:41 GMT, State: 401664\n\n2026-05-28 15:53:06, Info SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Basic.x86\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Basic\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\reagent.admx\n2026-05-28 15:53:06, Warning SPGetFootprintCapabilities: Footprint [Footprint.Basic] incomplete; the platform capability will not be available\n2026-05-28 15:53:06, Info SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Servicing.x86\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Servicing\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\dismapi.dll\n2026-05-28 15:53:06, Warning SPGetFootprintCapabilities: Footprint [Footprint.Servicing] incomplete; the platform capability will not be available\n2026-05-28 15:53:06, Info SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.ICB.x86\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Starting verification of footprint section Footprint.ICB\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\cmi2migxml.dll\n2026-05-28 15:53:06, Warning SPGetFootprintCapabilities: Footprint [Footprint.ICB] incomplete; the platform capability will not be available\n2026-05-28 15:53:06, Info SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Migration.x86\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Migration\n2026-05-28 15:53:06, Info SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\cmi2migxml.dll\n2026-05-28 15:53:06, Warning SPGetFootprintCapabilities: Footprint [Footprint.Migration] incomplete; the platform capability will not be available\n2026-05-28 15:53:06, Info Initializing diagnostics helper; data file = (NULL)\n2026-05-28 15:53:06, Info No existing diagnostics data\n2026-05-28 15:53:06, Info Reading onesetting for tracing settings\n2026-05-28 15:53:06, Warning Onesettings: Failed to get DeviceId from registry: 0x80070002\n2026-05-28 15:53:06, Warning Onesettings: Failed to initialize and query: 0x80070002\n2026-05-28 15:53:06, Warning Failed to create OneSettings infrastructure. Error: 0x0880070002\n2026-05-28 15:53:06, Info Reading onesetting for tracing settings completed, Error: 0x80070002\n2026-05-28 15:53:06, Warning No onesetting configured or error getting onesetting\n2026-05-28 15:53:06, Info Key CollectTrace is not available.\n2026-05-28 15:53:06, Warning SP CSetupPlatform::Initialize: Failed to initialize tracing\n2026-05-28 15:53:06, Info Use Paged memory for telemetry\n2026-05-28 15:53:06, Info VDS available\n2026-05-28 15:53:06, Info Key CollectTrace is not available.\n2026-05-28 15:53:06, Info SP Releasing the setup platform\n2026-05-28 15:53:06, Info SP StopTelemetry: 0\n2026-05-28 15:53:06, Info SP UploadTelemetryData: 0\n2026-05-28 15:53:06, Info SP CorrelationVector: \n2026-05-28 15:53:06, Info SP Try to merge diagnostics data from default new system data file\n2026-05-28 15:53:06, Info SP Skip merge diagnostics data since C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat is not exist\n2026-05-28 15:53:06, Info SP Finish merge diagnostics data\n2026-05-28 15:53:06, Info SP Start uploading diagnostics data for setup platform\n2026-05-28 15:53:06, Info SP Not opted-in to SQM. Diagnostics data will NOT be uploaded\n2026-05-28 15:53:06, Info Key CollectTrace is not available.\n2026-05-28 15:53:06, Info SP Closing Panther Logging\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 2088 }, { "name": [ "wdscsl.dll" ], "path": "/opt/CAPEv2/storage/analyses/3/files/d5bcfdab29ea1deea22679a4a4473a9cc84871a5d707c006eb99facb4af9081b", "guest_paths": [ "C:\\$Windows.~WS\\Sources\\wdscsl.dll" ], "size": 50504, "crc32": "F1119382", "md5": "0b778ad42d5e17ce89936f6d4c42957d", "sha1": "dcc971675653547295ac4ee95e139a1cca7a20c5", "sha256": "d5bcfdab29ea1deea22679a4a4473a9cc84871a5d707c006eb99facb4af9081b", "sha512": "3aaf945a4735bc867ad4c4213ec43079b8b8fef17cbaf3b394365762451e36f51075e7e129fc8dcbc847dc44501536309114b6c54a4d415d21d0459049e51026", "rh_hash": null, "ssdeep": "1536:bvftzpTPMNBV4VJMZ/MZJ//3swsxsiM9gVP599:7ftNTENBVcMZW/3sjaiM9gVj9", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T10F335B52A65804E3E7663670B06A97765D7DEF601FA001C71323916A3C627C3AF3A36F", "sha3_384": "68ce54945f68f1233b5b9e4e5158bd877638f10a6d5f0de7571220b897bf8b644e8a9e937992fd3793cfed0bc123aa22", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": "Thu Oct 08 02:47:12 2020", "aux_valid": true, "aux_error": null, "aux_error_desc": null, "aux_signers": [ { "name": "Certificate Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Certificate Chain 2", "Issued to": "Microsoft Code Signing PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sun Jul 06 13:50:17 2025", "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b" }, { "name": "Certificate Chain 3", "Issued to": "Microsoft Corporation", "Issued by": "Microsoft Code Signing PCA 2010", "Expires": "Wed Mar 03 11:29:21 2021", "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388" }, { "name": "Timestamp Chain 1", "Issued to": "Microsoft Root Certificate Authority 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Sat Jun 23 15:04:01 2035", "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5" }, { "name": "Timestamp Chain 2", "Issued to": "Microsoft Time-Stamp PCA 2010", "Issued by": "Microsoft Root Certificate Authority 2010", "Expires": "Tue Jul 01 14:46:55 2025", "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee" }, { "name": "Timestamp Chain 3", "Issued to": "Microsoft Time-Stamp Service", "Issued by": "Microsoft Time-Stamp PCA 2010", "Expires": "Thu Feb 11 14:40:40 2021", "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc" } ] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x00008340", "ep_bytes": "8bff558bec837d0c017505e8f5050000", "peid_signatures": null, "reported_checksum": "0x00018307", "actual_checksum": "0x00018307", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "wdscsl.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x1000b174", "name": "wprintf" }, { "address": "0x1000b178", "name": "memmove" }, { "address": "0x1000b17c", "name": "??1type_info@@UAE@XZ" }, { "address": "0x1000b180", "name": "_onexit" }, { "address": "0x1000b184", "name": "__dllonexit" }, { "address": "0x1000b188", "name": "_unlock" }, { "address": "0x1000b18c", "name": "_lock" }, { "address": "0x1000b190", "name": "__CxxFrameHandler3" }, { "address": "0x1000b194", "name": "_except_handler4_common" }, { "address": "0x1000b198", "name": "_initterm" }, { "address": "0x1000b19c", "name": "_amsg_exit" }, { "address": "0x1000b1a0", "name": "_CxxThrowException" }, { "address": "0x1000b1a4", "name": "_callnewh" }, { "address": "0x1000b1a8", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0x1000b1ac", "name": "??1exception@@UAE@XZ" }, { "address": "0x1000b1b0", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0x1000b1b4", "name": "??0exception@@QAE@XZ" }, { "address": "0x1000b1b8", "name": "malloc" }, { "address": "0x1000b1bc", "name": "_vsnwprintf" }, { "address": "0x1000b1c0", "name": "memcpy" }, { "address": "0x1000b1c4", "name": "memcmp" }, { "address": "0x1000b1c8", "name": "_vsnprintf" }, { "address": "0x1000b1cc", "name": "_XcptFilter" }, { "address": "0x1000b1d0", "name": "free" }, { "address": "0x1000b1d4", "name": "_purecall" }, { "address": "0x1000b1d8", "name": "memset" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x1000b028", "name": "GetSystemTimeAsFileTime" }, { "address": "0x1000b02c", "name": "GetTickCount" }, { "address": "0x1000b030", "name": "UnhandledExceptionFilter" }, { "address": "0x1000b034", "name": "SetUnhandledExceptionFilter" }, { "address": "0x1000b038", "name": "GetCurrentProcess" }, { "address": "0x1000b03c", "name": "TerminateProcess" }, { "address": "0x1000b040", "name": "CancelIo" }, { "address": "0x1000b044", "name": "GetCurrentProcessId" }, { "address": "0x1000b048", "name": "QueryPerformanceCounter" }, { "address": "0x1000b04c", "name": "Sleep" }, { "address": "0x1000b050", "name": "InterlockedPopEntrySList" }, { "address": "0x1000b054", "name": "SetLastError" }, { "address": "0x1000b058", "name": "EnterCriticalSection" }, { "address": "0x1000b05c", "name": "GetModuleHandleExW" }, { "address": "0x1000b060", "name": "LeaveCriticalSection" }, { "address": "0x1000b064", "name": "InitializeCriticalSection" }, { "address": "0x1000b068", "name": "WaitForSingleObject" }, { "address": "0x1000b06c", "name": "GetVersionExW" }, { "address": "0x1000b070", "name": "CreateEventW" }, { "address": "0x1000b074", "name": "GetLastError" }, { "address": "0x1000b078", "name": "SetEvent" }, { "address": "0x1000b07c", "name": "WaitForSingleObjectEx" }, { "address": "0x1000b080", "name": "CloseHandle" }, { "address": "0x1000b084", "name": "GetProcAddress" }, { "address": "0x1000b088", "name": "DeleteCriticalSection" }, { "address": "0x1000b08c", "name": "SleepConditionVariableSRW" }, { "address": "0x1000b090", "name": "WakeAllConditionVariable" }, { "address": "0x1000b094", "name": "AcquireSRWLockExclusive" }, { "address": "0x1000b098", "name": "ReleaseSRWLockExclusive" }, { "address": "0x1000b09c", "name": "GetCurrentThreadId" }, { "address": "0x1000b0a0", "name": "InitializeSListHead" }, { "address": "0x1000b0a4", "name": "InterlockedPushEntrySList" }, { "address": "0x1000b0a8", "name": "OutputDebugStringW" }, { "address": "0x1000b0ac", "name": "SetEnvironmentVariableW" }, { "address": "0x1000b0b0", "name": "GetEnvironmentVariableW" }, { "address": "0x1000b0b4", "name": "GetModuleHandleW" }, { "address": "0x1000b0b8", "name": "ReleaseSemaphore" }, { "address": "0x1000b0bc", "name": "CreateSemaphoreW" }, { "address": "0x1000b0c0", "name": "GetQueuedCompletionStatus" }, { "address": "0x1000b0c4", "name": "WaitForMultipleObjects" }, { "address": "0x1000b0c8", "name": "PostQueuedCompletionStatus" }, { "address": "0x1000b0cc", "name": "CreateThread" }, { "address": "0x1000b0d0", "name": "FreeLibrary" }, { "address": "0x1000b0d4", "name": "CreateIoCompletionPort" }, { "address": "0x1000b0d8", "name": "GetSystemInfo" }, { "address": "0x1000b0dc", "name": "OutputDebugStringA" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x1000b000", "name": "ImpersonateLoggedOnUser" }, { "address": "0x1000b004", "name": "LogonUserW" }, { "address": "0x1000b008", "name": "LsaClose" }, { "address": "0x1000b00c", "name": "LsaFreeMemory" }, { "address": "0x1000b010", "name": "LsaQueryInformationPolicy" }, { "address": "0x1000b014", "name": "LsaOpenPolicy" }, { "address": "0x1000b018", "name": "RevertToSelf" } ] }, "WS2_32": { "dll": "WS2_32.dll", "imports": [ { "address": "0x1000b130", "name": "inet_addr" }, { "address": "0x1000b134", "name": "FreeAddrInfoW" }, { "address": "0x1000b138", "name": "GetAddrInfoW" }, { "address": "0x1000b13c", "name": "WSAGetLastError" }, { "address": "0x1000b140", "name": "setsockopt" }, { "address": "0x1000b144", "name": "WSAGetOverlappedResult" }, { "address": "0x1000b148", "name": "htons" }, { "address": "0x1000b14c", "name": "WSARecvFrom" }, { "address": "0x1000b150", "name": "ntohs" }, { "address": "0x1000b154", "name": "WSAStartup" }, { "address": "0x1000b158", "name": "WSASocketW" }, { "address": "0x1000b15c", "name": "WSASendTo" }, { "address": "0x1000b160", "name": "closesocket" }, { "address": "0x1000b164", "name": "bind" }, { "address": "0x1000b168", "name": "WSACleanup" }, { "address": "0x1000b16c", "name": "GetNameInfoW" } ] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x1000b0fc", "name": "RpcErrorGetNextRecord" }, { "address": "0x1000b100", "name": "RpcBindingFree" }, { "address": "0x1000b104", "name": "RpcErrorStartEnumeration" }, { "address": "0x1000b108", "name": "RpcAsyncCancelCall" }, { "address": "0x1000b10c", "name": "RpcStringFreeW" }, { "address": "0x1000b110", "name": "RpcAsyncCompleteCall" }, { "address": "0x1000b114", "name": "I_RpcExceptionFilter" }, { "address": "0x1000b118", "name": "RpcStringBindingComposeW" }, { "address": "0x1000b11c", "name": "RpcBindingSetAuthInfoW" }, { "address": "0x1000b120", "name": "RpcBindingFromStringBindingW" }, { "address": "0x1000b124", "name": "RpcAsyncInitializeHandle" }, { "address": "0x1000b128", "name": "NdrAsyncClientCall" } ] }, "NTDSAPI": { "dll": "NTDSAPI.dll", "imports": [ { "address": "0x1000b0e4", "name": "DsMakeSpnW" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x1000b0ec", "name": "GetErrorInfo" }, { "address": "0x1000b0f0", "name": "SysFreeString" }, { "address": "0x1000b0f4", "name": "SetErrorInfo" } ] }, "IPHLPAPI": { "dll": "IPHLPAPI.DLL", "imports": [ { "address": "0x1000b020", "name": "GetAdaptersAddresses" } ] } }, "exported_dll_name": "WDSCSL.dll", "exports": [ { "address": "0x10006030", "name": "WdsClientExecute", "ordinal": 1 }, { "address": "0x10005f40", "name": "WdsClientFreeLibrary", "ordinal": 2 }, { "address": "0x10005f20", "name": "WdsClientInitializeLibrary", "ordinal": 3 }, { "address": "0x10006050", "name": "WdsClientPacketAllocate", "ordinal": 4 }, { "address": "0x10006070", "name": "WdsClientPacketFree", "ordinal": 5 }, { "address": "0x10005fd0", "name": "WdsClientRegisterTrace", "ordinal": 6 }, { "address": "0x10006230", "name": "WdsClientSessionCreate", "ordinal": 7 }, { "address": "0x10006270", "name": "WdsClientSessionExecute", "ordinal": 8 }, { "address": "0x10006250", "name": "WdsClientSessionShutdown", "ordinal": 9 }, { "address": "0x10006210", "name": "WdsCpPacketGetBuffer", "ordinal": 10 }, { "address": "0x10006090", "name": "WdsCpPacketInitialize", "ordinal": 11 }, { "address": "0x100061f0", "name": "WdsCpPacketRelease", "ordinal": 12 }, { "address": "0x100060d0", "name": "WdsCpParameterAdd", "ordinal": 13 }, { "address": "0x10006190", "name": "WdsCpParameterDelete", "ordinal": 14 }, { "address": "0x10006110", "name": "WdsCpParameterQuery", "ordinal": 15 }, { "address": "0x100060f0", "name": "WdsCpParameterValidate", "ordinal": 16 }, { "address": "0x100060b0", "name": "WdsCpRecvPacketInitialize", "ordinal": 17 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00008ef0", "size": "0x00000253" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0000b1e4", "size": "0x000000b4" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0000c000", "size": "0x00000430" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0000a400", "size": "0x00002148" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x0000d000", "size": "0x00000750" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00002150", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00001144", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00001098", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x0000b000", "size": "0x000001e0" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00008143", "size_of_data": "0x00008200", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.34" }, { "name": ".data", "raw_address": "0x00008600", "virtual_address": "0x0000a000", "virtual_size": "0x000004cc", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "1.19" }, { "name": ".idata", "raw_address": "0x00008800", "virtual_address": "0x0000b000", "virtual_size": "0x00000c9a", "size_of_data": "0x00000e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "4.98" }, { "name": ".rsrc", "raw_address": "0x00009600", "virtual_address": "0x0000c000", "virtual_size": "0x00000430", "size_of_data": "0x00000600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "2.55" }, { "name": ".reloc", "raw_address": "0x00009c00", "virtual_address": "0x0000d000", "virtual_size": "0x00000750", "size_of_data": "0x00000800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.44" } ], "overlay": { "offset": "0x0000a400", "size": "0x00002148" }, "resources": [ { "name": "RT_VERSION", "offset": "0x0000c060", "size": "0x000003cc", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.50" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Deployment Services Client-side Library" }, { "name": "FileVersion", "value": "10.0.19041.572 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "wdscsl.dll" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "wdscsl.dll" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.572" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "4813220b7756d33b9923837a586c65ed", "timestamp": "2100-11-25 16:03:48", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 8 }, "data": null, "strings": [ "Microsoft", ".CRT$XLA", ".text$yd", "UnhandledExceptionFilter", "__dllonexit", "565@5M5_5", "Microsoft Time-Stamp Service", ".CRT$XIAA", "m_uLockCount == 0", "Param[%d][Pointer]: %I64u", "127.0.0.1", "<- WdsClientRegisterTrace=%x", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp", "advapi32", "RpcBindingFree", "Microsoft Corporation", "WS2_32.dll", "f;D$$u", ":*:::W:n:~:", "malloc", "m_ActiveWriter.m_uNestedReaders > 0", ".giats", "ReleaseSemaphore", "?%?E?O?d?", "010V0q0~0", "??0exception@@QAE@ABV0@@Z", "j(X9E", "229879+4583620", "_InterlockedExchangeAdd((LONG volatile*)&(m_lPendingWriteOperations), 0) == 0", " Microsoft Operations Puerto Rico1&0$", "X9qHu&9YLr!;yLr", "Param[%d][Unicode]: %s", "=$>3>W>", ")Microsoft Root Certificate Authority 20100", "InterlockedPushEntrySList", "GetNameInfoW", "GetProcAddress", "AcquireSRWLockExclusive", "100701213655Z", "InitializeCriticalSection", "VWShD", "WaitForSingleObject", ";F,s)", ">\">(>0>M>", "WdsClientExecute", "Microsoft Corporation1&0$", "9w,v$", "OutputDebugStringA", "jW[_^", "bad allocation", "Richo", ":.:m:w:", "ReleaseSRWLockExclusive", "TerminateProcess", "9^,te", "InterlockedPopEntrySList", ".idata$5", ".CRT$XCU", ">#>D>O>U>]>j>u>", "L$,QP", "SetEnvironmentVariableW", ";Yv>", " Windows", "QSVW3", ";*;:;@;K;Q;];m;v;", "m_ActiveWriter.m_uNestedReaders == 0 && m_ActiveWriter.m_uNestedWriters == 0", "261019185142Z0", "191219011459Z", "2*2g2", "m_uInitCount == 0", "RpcBindingSetAuthInfoW", "D$$VP", "jWX^_[", "FreeAddrInfoW", "ADVAPI32.dll", "EnterCriticalSection", "EventUnregister", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a", "WdsCpParameterValidate", "base\\eco\\wds\\wdscsl\\client\\controllib.cpp", "LsaFreeMemory", ".xdata$x", "GeneratingComponent=%u", "m_pReaderSlots[uIndex].m_uNestedReaders == 0", "WdsPacketFree", ";~4sg", "Microsoft Corporation1", ";G!>:>C>W>f>o>", "VarFileInfo", "GetCurrentProcess", "WdsCpParameterQuery", "??1type_info@@UAE@XZ", "CreateIoCompletionPort", "0\"171<1A1h1x1}1", "|hK,_", "RETAIL ASSERT", "WdsClientSessionShutdown", "DeleteCriticalSection", "OriginalFilename", "HZo6m|", "979M9m9", "memmove", "EventRegister", "_CxxThrowException", "Microsoft Windows0", "WDS_TRACING_DEBUGGER_OUTPUT", "lL7Ki\"0", "WdsCpPacketGetBuffer", "8,8B8L8Y8`8h8v8", "@.reloc", ".edata", "7X8]8o8", "CreateSemaphoreW", "u*Wh\\", "[%S:%u] Expression: %S, hr=0x%x", "262V2v2", ";#;4;:;B;", " Operating System", "GetReaderSlot(uThreadId, &uIndex) == 0L", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "_initterm", "WdsClientSessionCreate", "210317011459Z0", "U0S0Q", "DsMakeSpnW", "Microsoft Corporation1)0'", "1(1@1Y1", "7!8[8", "SetLastError", ".00cfg", "_callnewh", "oK0D$\"<", "_lock", "m_ActiveWriter.m_uThreadId == GetCurrentThreadId()", "onecore\\base\\eco\\wds\\wdslib\\common\\src\\mrswlock.cpp", ".rdata$brc", "GetQueuedCompletionStatus", "wdscsl.dll", "msvcrt.dll", "RpcAsyncCompleteCall", ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0", "z.9Wv", "GetCurrentThreadId", "RPC Extended Error Info", ".data$brc", "u9f9X", "A;N4r", "EventWriteTransfer", "APj!Z", " SVWj", "Microsoft Time-Stamp PCA 2010", "wprintf", "9D:}:", "NH9^,t", "WDSCSL.dll", "FreeLibrary", "`.data", "eWDSCSL", "RevertToSelf", "@.rsrc", "memcmp", "-----------------------", "Legal_Policy_Statement", "Invalid type: %d", "WaitForSingleObject(m_hWriterDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )", "Microsoft Time-Stamp PCA 20100", "C;_,r", "WSAGetOverlappedResult", "__CxxFrameHandler3", "ImpersonateLoggedOnUser", "Status=%u", "NTDSAPI.dll", "uIndex != 0xffffffffUL", "WSASocketW", "0>1C1S1x1-2j2y2", "Hbg&~", "Param[%d][Short]: %d", "1(0&0", "j|j?h", "WaitForSingleObject(m_hReaderDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )", "onecore\\internal\\base\\inc\\private\\eco\\wds\\locks.h", ".idata$2", "RpcAsyncInitializeHandle", "WdsCpParameterDelete", " 9^Dt\"S", "t'9s u", ".CRT$XCA", "SetUnhandledExceptionFilter", "WdsPacketAllocate", "210303183039Z0p1", "COM Error: '%s'", "LeaveCriticalSection", "TlP0X", "8+8?8K8", "GetEnvironmentVariableW", "> >(>,>4>8>@>D>L>P>`>", "WdsCpPacketRelease", ",tmiMHeBeBe9k8m0Ots191T0AhkQNR94NUfr7OOdjuoc=0Z", "WDS_TRACING_%u", "WdsClientInitializeLibrary", ".rdata$T$brc", ",*~_i", "3%4x5", "_91$[bS", "EventWrite", "LsaQueryInformationPolicy", "ProductVersion", ".rdata$sxdata", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "GetSystemTimeAsFileTime", "memset", "9 9&91979B9I9N9T9Z9_9e9k9p9v9|9", "GetTickCount", ".CRT$XIZ", "04080<0@0X0", ";L$8u*Q", "CompanyName", "8V9t9", "RpcAsyncCancelCall", "X9^`u", ":H;*<8<[:F:[:n:t:~:", ":E:R:[:f:m:", "CClientLibrary::InitializeRpcSession: Domain Joined=%s", "OLEAUT32.dll", "SVWh ", "?!?5?H?", "O0M0K", "_except_handler4_common", "PostQueuedCompletionStatus", "WdsCpPacketInitialize", "WdsCpRecvPacketInitialize", "LsaOpenPolicy", "7*7=7P7s7}7", "ReleaseSemaphore(m_hReaderDone, 1, 0)", ".text", "Translation", ";5;B;", ".tls$", "9FTt~", "m_pReaderSlots[uIndex].m_uThreadId == uThreadId", "memcpy", "GetModuleHandleW", ".CRT$XLZ", "%Microsoft Windows Production PCA 20110", "GetSystemInfo", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@", "Param[%d][Truncated]", "10.0.19041.572", "9^(u$", "<%=,=2=:=D=M=S=", "_$j(Yf", "I0G1-0+", " http://www.microsoft.com/windows0", "t 9y u", "s15pL", "t6VVSh", " Microsoft Corporation. All rights reserved.", "=!=1=7=A=G=|=", "G`jqY", "WaitForSingleObject(m_hReaderSlots, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )", "+a,Y?", "Detection Location=%u", "_vsnwprintf", "!This program cannot be run in DOS mode.", "4'414;4^4", ";) WdsClientRegisterTrace", "?$?-?>?H?m?w?", ".idata$6", "WDS_TRACING_CONSOLE_OUTPUT", "??0exception@@QAE@XZ", "6#6?6M6S6o6w6", "CancelIo", "CreateThread" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "1650937124204bd3744dd84daefce5baae33a1b4c33b4e011ee1c191bcd8e0bc", "path": "/opt/CAPEv2/storage/analyses/3/selfextracted/1650937124204bd3744dd84daefce5baae33a1b4c33b4e011ee1c191bcd8e0bc", "guest_paths": [ "overlay" ], "size": 8520, "crc32": "9EFA4358", "md5": "85eb704f3ef476e9d180af5a8dd5e1ba", "sha1": "3e156a98e4d47553e9a1736bbe5038f9949e1bc3", "sha256": "1650937124204bd3744dd84daefce5baae33a1b4c33b4e011ee1c191bcd8e0bc", "sha512": "817cd49c53a19d0355f4bf3ac1b00c7f6a12e969d837505a3f39e732eb0acce7d349601fb35287b7077da08dddc0572540bd2c0977ff9c509020ed1edc62f5c9", "rh_hash": null, "ssdeep": "96:btMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGueDXKgDjhhBDqh0hDs:pr8VHwDDBQABJsDj3Q2SkqnajKs9ImG", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1BC024AD1CF785443DBA77C801358E9937D3D53CB186081A5259AF8A82CD73C7EB086AE", "sha3_384": "fd1c55b5f9ebf8105a4fc0c5fb90f80e72be36bfe6c903557678a8a80d7fd5ae1c9561d75468a5a9f0210c9778ce7015", "data": null } ], "extracted_files_time": 0.0004994180017092731, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 6024 } ], "CAPE": { "payloads": [], "configs": [] }, "info": { "version": "2.5", "started": "2026-05-28 15:52:46", "ended": "2026-05-28 15:56:27", "duration": 221, "id": 3, "category": "file", "custom": "", "machine": { "id": 1, "status": "stopping", "name": "cuckoo1", "label": "cuckoo1", "platform": "windows", "manager": "KVM", "started_on": "2026-05-28 15:52:46", "shutdown_on": "2026-05-28 15:56:27" }, "package": "exe", "timeout": true, "tlp": null, "parent_sample": null, "options": {}, "source_url": null, "route": "none", "user_id": 0, "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2" }, "behavior": { "processes": [ { "process_id": 6024, "process_name": "MediaCreationTool_22H2.exe", "parent_id": 3932, "module_path": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe", "first_seen": "2026-05-28 22:52:59,131", "calls": [ { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "MSVCRT.DLL" }, { "name": "BaseAddress", "value": "0x76d70000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798b021", "parentcaller": "0x6b4bd90a", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798b021", "parentcaller": "0x6b4bd916", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b207b3", "parentcaller": "0x77999057", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04b70000" }, { "name": "RegionSize", "value": "0x00080000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b207ed", "parentcaller": "0x77999057", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04b70000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b504b04", "parentcaller": "0x6b4bdd46", "category": "misc", "api": "GetCursorPos", "status": false, "return": "0x00000000", "arguments": [ { "name": "x", "value": "0" }, { "name": "y", "value": "0" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798b021", "parentcaller": "0x6b505ee2", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798b021", "parentcaller": "0x6b505eee", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\mfc42u.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\mfc42u.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000024c" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\MFC42u.dll.mui" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000244" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005b0000" }, { "name": "SectionOffset", "value": "0x000edb38" }, { "name": "ViewSize", "value": "0x00008000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b2ab9b", "parentcaller": "0x77af2f1c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b2abcd", "parentcaller": "0x77af2f1c", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "SafeDllSearchMode" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MFC42LOC.DLL" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b05539", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MFC42LOC.DLL.DLL" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\MFC42LOC.DLL" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b05539", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\MFC42LOC.DLL.DLL" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b05539", "parentcaller": "0x7798a51e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\mfc42u" }, { "name": "BaseAddress", "value": "0x6b490000" }, { "name": "InitRoutine", "value": "0x6b4b4d00" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b628c37", "parentcaller": "0x6b6273e7", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x07020000", "arguments": [ { "name": "Options", "value": "0" }, { "name": "InitialSize", "value": "0x00001000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798917f", "parentcaller": "0x6b6284e1", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNELBASE.DLL" }, { "name": "ModuleHandle", "value": "0x77870000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernelbase.dll" }, { "name": "ModuleHandle", "value": "0x77870000" }, { "name": "FunctionName", "value": "FlsAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779ad2c0" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernelbase.dll" }, { "name": "ModuleHandle", "value": "0x77870000" }, { "name": "FunctionName", "value": "FlsGetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798c970" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernelbase.dll" }, { "name": "ModuleHandle", "value": "0x77870000" }, { "name": "FunctionName", "value": "FlsSetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77995030" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernelbase.dll" }, { "name": "ModuleHandle", "value": "0x77870000" }, { "name": "FunctionName", "value": "FlsFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779b03f0" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798917f", "parentcaller": "0x6b62b444", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-guard-l1-1-0.dll" }, { "name": "ModuleHandle", "value": "0x77870000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernelbase.dll" }, { "name": "ModuleHandle", "value": "0x77870000" }, { "name": "FunctionName", "value": "GuardCheckLongJumpTarget" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77a52160" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x779a7efa", "parentcaller": "0x6b62b470", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b636000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x779a7efa", "parentcaller": "0x6b62b48a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b636000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b627407", "parentcaller": "0x6b6275e2", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x006e27b8", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" " } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07021000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07022000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798917f", "parentcaller": "0x6b5de285", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "LPK.DLL" }, { "name": "ModuleHandle", "value": "0x6b5c0000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798917f", "parentcaller": "0x6b5de294", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32" }, { "name": "ModuleHandle", "value": "0x75d30000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "ProcessIdToSessionId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d50e30" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b5c6cbc", "parentcaller": "0x6b5de2dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000068" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b13909", "parentcaller": "0x77aed7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x8c\\xee\\x0e\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xd0\\xee\\x0e\\x00\\x0e\\x8f\\x99w\\xc4\\xee\\x0e\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\x00\\x00&\\x00'\\x00\\x04@]w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00q\\xdb\\x01\\x01\\x10\\xef\\x0e\\x00" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77aed7d7", "parentcaller": "0x779ae3d7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b5c6dfb", "parentcaller": "0x6b5de2dc", "category": "misc", "api": "GetSystemMetrics", "status": true, "return": "0x00000400", "arguments": [ { "name": "SystemMetricIndex", "value": "0" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b5c6e08", "parentcaller": "0x6b5de2dc", "category": "misc", "api": "GetSystemMetrics", "status": true, "return": "0x00000300", "arguments": [ { "name": "SystemMetricIndex", "value": "1" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b5c6e3e", "parentcaller": "0x6b5de2dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000029" }, { "name": "uiParam", "value": "0x000001f4" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b5c6eaf", "parentcaller": "0x6b5de2dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000066" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b5c6ec6", "parentcaller": "0x6b5de2dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x7798a206", "parentcaller": "0x779afb91", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "imm32.dll" }, { "name": "BaseAddress", "value": "0x76e30000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmCreateContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e37770" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmDestroyContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e377e0" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmNotifyIME" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3bc30" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmAssociateContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e35150" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmReleaseContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e34e80" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmGetContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e33b30" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmGetCompositionStringA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e384b0" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmSetCompositionStringA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e39050" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmGetCompositionStringW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e38550" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmSetCompositionStringW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e39080" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x76e30000" }, { "name": "FunctionName", "value": "ImmSetCandidateWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e38d60" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.3636_none_c0df324c38bbc0ce\\comctl32" }, { "name": "BaseAddress", "value": "0x6b5c0000" }, { "name": "InitRoutine", "value": "0x6b627340" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\userenv" }, { "name": "BaseAddress", "value": "0x74830000" }, { "name": "InitRoutine", "value": "0x748386d0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\wdscore" }, { "name": "BaseAddress", "value": "0x6b650000" }, { "name": "InitRoutine", "value": "0x6b6599a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b477ac2", "parentcaller": "0x6b4789d4", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Compression" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x6b477ac2", "parentcaller": "0x6b4789d4", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cabinet" }, { "name": "BaseAddress", "value": "0x6b470000" }, { "name": "InitRoutine", "value": "0x6b477ec0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\wimgapi" }, { "name": "BaseAddress", "value": "0x6b3d0000" }, { "name": "InitRoutine", "value": "0x6b454f70" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b01317", "parentcaller": "0x779a8f85", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07030000" }, { "name": "RegionSize", "value": "0x00180000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77aefaf4", "parentcaller": "0x77b01357", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07030000" }, { "name": "RegionSize", "value": "0x00170000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b013b5", "parentcaller": "0x779a8f85", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071a0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b013b5", "parentcaller": "0x779a8f85", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\uxtheme" }, { "name": "BaseAddress", "value": "0x747b0000" }, { "name": "InitRoutine", "value": "0x747e7390" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5932", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5932", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5956", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5936", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5936", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5948", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 22:52:59,272", "thread_id": "5948", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00cc2f4b", "parentcaller": "0x00cc27b7", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x00cc2ef0" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00cc272a", "parentcaller": "0x00cc27eb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00593000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00cc272a", "parentcaller": "0x00cc27eb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00594000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c6636e", "parentcaller": "0x00c661f5", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c6638d", "parentcaller": "0x00c661f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77aee100" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c663a0", "parentcaller": "0x00c661f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b19a30" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c663b3", "parentcaller": "0x00c661f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b26b30" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c663c6", "parentcaller": "0x00c661f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b21320" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00ca7ae8", "parentcaller": "0x00c662b5", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00ca7b0f", "parentcaller": "0x00c662b5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" }, { "name": "FunctionName", "value": "EventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b21320" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00ca7b24", "parentcaller": "0x00c662b5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77aee100" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00ca7b39", "parentcaller": "0x00c662b5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" }, { "name": "FunctionName", "value": "EventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b19a30" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c673e2", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Logs\\MoSetup" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76b27", "parentcaller": "0x00c67378", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76b27", "parentcaller": "0x00c67378", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76b27", "parentcaller": "0x00c67378", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Logs" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76b27", "parentcaller": "0x00c67378", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Logs\\MoSetup" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76b3f", "parentcaller": "0x00c67378", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Windows\\Logs\\MoSetup" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76b50", "parentcaller": "0x00c67378", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Logs\\MoSetup" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c67435", "parentcaller": "0x00c674fb", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c675dc", "parentcaller": "0x00c67936", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c66f6f", "parentcaller": "0x00c67936", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c673e2", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Logs\\MoSetup" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c67435", "parentcaller": "0x00c67950", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c67977", "parentcaller": "0x00c73fe1", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c67977", "parentcaller": "0x00c73fe1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bac9", "parentcaller": "0x00c72e7e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bb3a", "parentcaller": "0x00c7bbef", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bb3a", "parentcaller": "0x00c7bbef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bb3a", "parentcaller": "0x00c7bbef", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bb6a", "parentcaller": "0x00c7bbef", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bb6a", "parentcaller": "0x00c7bbef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bb6a", "parentcaller": "0x00c7bbef", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e0" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x75d30000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d4eb20" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d497e0" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000264" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000264" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000268" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071b0000" }, { "name": "SectionOffset", "value": "0x000ef334" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c7bc23", "parentcaller": "0x00c72e7e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000264" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlGetSystemTimeAndBias" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b47160" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000268" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\tzres.dll" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000268" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00c30000" }, { "name": "SectionOffset", "value": "0x000ee470" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00c30000" }, { "name": "RegionSize", "value": "0x0000c000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000268" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\tzres.dll" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000268" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00c30000" }, { "name": "SectionOffset", "value": "0x000ee470" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00c30000" }, { "name": "RegionSize", "value": "0x0000c000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c72ea6", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-28 22:52:59,350", "thread_id": "5012", "caller": "0x00c67187", "parentcaller": "0x00c72ea6", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "\\xfeff" }, { "name": "Length", "value": "3" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c72ea6", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c72ea6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: BuildInfo: [10.0.19041.572 (vb_release_svc_prod1.201007-1724)]\r\n" }, { "name": "Length", "value": "85" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c7303a", "parentcaller": "0x00c74008", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x006e1032", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" " } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c7304c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "X\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 164 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c7304c", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: CommandLine: [\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ]\r\n" }, { "name": "Length", "value": "101" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c73073", "parentcaller": "0x00c74008", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x006e1032", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" " } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5012" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "shcore.dll" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000270" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76cc0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00087000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76d3c000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76d39000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76d39000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76d39000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76d39000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\n\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00mand\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00C:\\U\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00in\\A\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00ocal\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00diaC" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x76cc0000" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\SHCore" }, { "name": "BaseAddress", "value": "0x76cc0000" }, { "name": "InitRoutine", "value": "0x76d02480" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76497000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c74008", "parentcaller": "0x00cc2886", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76497000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c7307a", "parentcaller": "0x00c74008", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x006e56f8", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" " }, { "name": "NumArgs", "value": "1" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c73b26", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 188 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c73b26", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xbd\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 22:52:59,381", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Opening Box: [C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe]\r\n" }, { "name": "Length", "value": "98" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c73b4b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": " \\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 194 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c73b4b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1f\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Opening Box Result: [0x0]\r\n" }, { "name": "Length", "value": "48" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9b6b0", "parentcaller": "0x00c73b5f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00cac389", "parentcaller": "0x00c9bf66", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000274" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bf92", "parentcaller": "0x00c9b713", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0070d000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfe3", "parentcaller": "0x00c9b713", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000274" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1L\\x81\\xf6\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xeeE\\xec\\xa4\\xb4-\\xef\\xa5\\xa1F\\xec\\xa4\\xbd-\\xef\\xa5\\xa1F\\xeb\\xa4\\xaf-\\xef\\xa5\\xa1F\\xea\\xa4\\xb9-\\xef\\xa5\\xa1F\\xee\\xa4\\x98-\\xef\\xa5\\xb5-\\xee\\xa5\\xd4/\\xef\\xa5\\xa1F\\xe6\\xa4\\xe9-\\xef\\xa5\\xa1F\\x10\\xa5\\xb4-\\xef\\xa5\\xa1F\\xed\\xa4\\xb4-\\xef\\xa5Rich\\xb5-\\xef\\xa5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00\\xb1JJ\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r" }, { "name": "Length", "value": "131072" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0072e000" }, { "name": "RegionSize", "value": "0x0007c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfe3", "parentcaller": "0x00c9b713", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000274" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc4\\x10\\x8b\\xcb\\xe8ui\\x00\\x00\\x85\\xf6t\\x07\\x8b\\xce\\xe83g\\x00\\x00\\x8bM\\xe4\\x85\\xc9t\\x05\\xe8'g\\x00\\x00\\x85\\xfft\\x07\\x8b\\xcf\\xe8\\x1cg\\x00\\x00j\\x00\\x8dM\\xd0\\xe8S\\x89\\x00\\x00\\x8dM\\xd8\\xe8\\xeec\\xff\\xff\\x8b\\xc3\\xe8\\x11\"\\x05\\x00\\xc3j\\x14\\xb8u\\G\\x00\\xe8'\"\\x05\\x00\\x8b\\xda3\\xc0\\x89E\\xe0\\x89E\\xe4\\x89E\\xe8\\x8b\\xf0\\x89E\\xfc\\x89u\\xf0\\xc6E\\xfc\\x01\\x85\\xc9u\t\\xb9W\\x00\\x07\\x80\\x8b\\xf9\\xebT\\x85\\xdbt\\xf3\\x8dU\\xe0\\xe8\\xdaJ\\x00\\x00\\x8b\\xf8\\x85\\xffx@\\x8dE\\xf0P\\x8dU\\xec\\x8dM\\xe0\\xe8QM\\x00\\x00\\x8b\\xf8\\x85\\xffy\\x0c\\x8b\\xcf\\xe8\\xc1h\\x00\\x00\\x8bu\\xf0\\xeb&\\x8bU\\xec\\x8bu\\xf0\\x83\\xfa\\x01u\\x03R\\xeb\\x02j\\x00SQ\\x8b\\xce\\xe8\\xc7\\xc4\\x02\\x00\\x8b\\xf8\\x85\\xffy\\x07\\x8b\\xcf\\xe8\\x96h\\x00\\x00\\x8b\\xcf\\xe8\\xa7h\\x00\\x00\\x85\\xf6t\\x10Vj\\x00\\xff\\x150\\xd3G\\x00P\\xff\\x15@\\xd3G\\x00j\\x00\\x8dM\\xe0\\xe8\\x93\\x88\\x00\\x00\\x8dM\\xe8\\xe8.c\\xff\\xff\\x8b\\xc7\\xe8" }, { "name": "Length", "value": "375296" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x074f0000" }, { "name": "RegionSize", "value": "0x00b10000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x074f0000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07fff000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0070d000" }, { "name": "RegionSize", "value": "0x000d2000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9bfe3", "parentcaller": "0x00c9b713", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000274" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x08\\x00\\xe86\\x00\\x80X\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x80\\x00\\x00\\x80\\x03\\x00\\x00\\x00 \\x01\\x00\\x80\\x05\\x00\\x00\\x00\\x00\\x02\\x00\\x80\\x06\\x00\\x00\\x008\\x02\\x00\\x80\n\\x00\\x00\\x00\\x88\\x02\\x00\\x80\\x0e\\x00\\x00\\x00\\xa0\\x02\\x00\\x80\\x10\\x00\\x00\\x00\\xc0\\x02\\x00\\x80\\x18\\x00\\x00\\x00\\xd8\\x02\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x03\\x00,N\\x00\\x00\\xf0\\x02\\x00\\x80-N\\x00\\x00\\x08\\x03\\x00\\x80.N\\x00\\x00 \\x03\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\xd2\\x07\\x00\\x008\\x03\\x00\\x80\\xd3\\x07\\x00\\x00P\\x03\\x00\\x80\\xd4\\x07\\x00\\x00h\\x03\\x00\\x80\\xd5\\x07\\x00\\x00\\x80\\x03\\x00\\x80\\xd6\\x07\\x00\\x00\\x98\\x03\\x00\\x80\\xd7\\x07\\x00\\x00\\xb0\\x03\\x00\\x80\\xd8\\x07\\x00\\x00\\xc8\\x03\\x00\\x80\\xd9\\x07\\x00\\x00\\xe0\\x03\\x00\\x80\\xda\\x07\\x00\\x00\\xf8\\x03\\x00\\x80\\xdb\\x07\\x00\\x00\\x10\\x04\\x00\\x80\\xdc\\x07\\x00\\x00(\\x04\\x00\\x80\\xdd\\x07\\x00\\x00@\\x04\\x00\\x80\\xde\\x07\\x00\\x00X\\x04\\x00\\x80\\xdf\\x07\\x00\\x00p\\x04\\x00\\x80" }, { "name": "Length", "value": "11042360" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9c0af", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x074f0000" }, { "name": "RegionSize", "value": "0x00b10000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c9be51", "parentcaller": "0x00c74008", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c74674", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNt" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-28 22:52:59,397", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c70883", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "P\\x01\\x00\\x00\\x00\\x00\\x00\\x00O\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 214 }, { "timestamp": "2026-05-28 22:52:59,413", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c70883", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "O\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-28 22:52:59,413", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Deleting box result...\r\n" }, { "name": "Length", "value": "45" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-28 22:52:59,413", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c74713", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 1, "id": 217 }, { "timestamp": "2026-05-28 22:52:59,413", "thread_id": "5012", "caller": "0x00c798b9", "parentcaller": "0x00c796c2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0070d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-28 22:52:59,413", "thread_id": "5012", "caller": "0x00ca6914", "parentcaller": "0x00c6b28b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-28 22:52:59,413", "thread_id": "5012", "caller": "0x00c6a5bd", "parentcaller": "0x00c6b152", "category": "misc", "api": "GetCursorPos", "status": false, "return": "0x00000000", "arguments": [ { "name": "x", "value": "0" }, { "name": "y", "value": "0" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x76dd6d60" }, { "name": "Parameter", "value": "0x00594888" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "5172" }, { "name": "ProcessId", "value": "6024" }, { "name": "Module", "value": "msvcrt.dll" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000280", "arguments": [ { "name": "StartRoutine", "value": "0x76dd6d60" }, { "name": "ModuleName", "value": "msvcrt.dll" }, { "name": "Parameter", "value": "0x00594888" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "5172" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000280" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5172" }, { "name": "ProcessId", "value": "6024" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5172", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5172", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5172", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "threading", "api": "NtSuspendThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000280" }, { "name": "SuspendCount", "value": "0" }, { "name": "ThreadId", "value": "5172" }, { "name": "ProcessId", "value": "6024" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6b35d", "parentcaller": "0x00c71901", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000280" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5172" }, { "name": "ProcessId", "value": "6024" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5172", "caller": "0x7798ab1a", "parentcaller": "0x6b505480", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6a818", "parentcaller": "0x00c71901", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-28 22:52:59,428", "thread_id": "5012", "caller": "0x00c6a818", "parentcaller": "0x00c71901", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-28 22:52:59,459", "thread_id": "5172", "caller": "0x00c6a715", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0070e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-28 22:52:59,459", "thread_id": "5172", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USP10" }, { "name": "DllBase", "value": "0x6b330000" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-28 22:52:59,459", "thread_id": "5172", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\msls31" }, { "name": "DllBase", "value": "0x6b2f0000" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\riched20" }, { "name": "DllBase", "value": "0x6b350000" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\riched32" }, { "name": "DllBase", "value": "0x6cd10000" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "RICHED32.DLL" }, { "name": "BaseAddress", "value": "0x6cd10000" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00c798b9", "parentcaller": "0x00c796c2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0070f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00cad19c", "parentcaller": "0x00ca5d24", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\Lang.ini" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00cad19c", "parentcaller": "0x00ca5d24", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\Lang.ini" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00cad19c", "parentcaller": "0x00ca5d24", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000278" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00cad19c", "parentcaller": "0x00ca5d24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xf6-\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xba\\xd8\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00cad19c", "parentcaller": "0x00ca5d24", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca68a2", "parentcaller": "0x00ca6e71", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00c6a79c", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00595000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c6b39a", "parentcaller": "0x00c71901", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "6024" }, { "name": "ThreadId", "value": "5172" }, { "name": "Message", "value": "33768" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x6b5c0000" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x6b5c0000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6b5de3e0" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b594000" }, { "name": "ModuleName", "value": "mfc42u.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b3c5", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x80\\x01\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b594000" }, { "name": "ModuleName", "value": "mfc42u.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x6b5c0000" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x6b5c0000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6b5de3e0" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x6b5c0000" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x6b5c0000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6b5de3e0" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x6b5c0000" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x6b5c0000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6b5de3e0" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b3c5", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x80\\x01\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x6b5c0000" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x6b5c0000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6b5de3e0" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b3c5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "|\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x747b0000" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x0010020f", "arguments": [ { "name": "HookIdentifier", "value": "5", "pretty_value": "WH_CBT" }, { "name": "ProcedureAddress", "value": "0x6b4ce960" }, { "name": "ModuleAddress", "value": "0x00000000" }, { "name": "ThreadId", "value": "5172" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00710000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00715000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSCTF.dll" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75bd0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000d4000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c94000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c94000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c94000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c94000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00e\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00T\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00D\\x00L\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x003\\xe7\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x00d\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x75bd0000" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\msctf" }, { "name": "BaseAddress", "value": "0x75bd0000" }, { "name": "InitRoutine", "value": "0x75c1dbc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\ThemeSection" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "SectionOffset", "value": "0x06f8e624" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Windows\\Theme4085422095" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\Theme149276106" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07030000" }, { "name": "SectionOffset", "value": "0x06f8ecb0" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x006d0000" }, { "name": "SectionOffset", "value": "0x06f8ecb0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af2470" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af0700" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b2c3b0" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000294" }, { "name": "MutexName", "value": "Local\\SM0:6024:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 1, "id": 317 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c6b3d0", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c9b07b", "parentcaller": "0x00c6b3d0", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9b0d2", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c9b07b", "parentcaller": "0x00c9b0d2", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\USER32.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c77b54", "parentcaller": "0x00c74524", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c77b9b", "parentcaller": "0x00c74524", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\mfc42u.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c77bc7", "parentcaller": "0x00c74524", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe8\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c66f6f", "parentcaller": "0x00c74524", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c78c1a", "parentcaller": "0x00c78a58", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00020008" }, { "name": "TokenHandle", "value": "0x0000029c" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c78c69", "parentcaller": "0x00c78a58", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c78cdc", "parentcaller": "0x00c78a58", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe6o\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c66f6f", "parentcaller": "0x00c78a58", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c78b38", "parentcaller": "0x00c75d30", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "MutexName", "value": "Global\\Microsoft.Windows.Websetup" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" }, { "name": "MutexName", "value": "Local\\SM0:6024:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 1, "id": 348 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002ac" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e90000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e9c000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x74e90000" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 366 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\xff9a\\x066\\xffe5\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00\\x00\\x006\\x00\\x00\\x00\\xff84\\x03\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptprimitives.dll" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0071a000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000026c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76ba0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0005f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x76ba0000" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-28 22:52:59,475", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "27" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "27" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "29" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "31" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "31" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "32" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "33" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "33" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002b8" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "]\\x8c\\xc15\\x90\\x9d\\x1bP\\x8b\\x19\\xce\\x9eO#\\x80\\xcf\\xbeh\\xfcW\\x1d4=\\xef\\xfe\\xf1\\xbb*\\xd1\\x82\\x93Gy\\xfe\\x8a\\x1f\\x97\\xfdZ\"\\xfe\\xee\\x1a\\xd1\\xe0\\xd8\\x19\r" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "36" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x76ba0000" }, { "name": "InitRoutine", "value": "0x76bd36c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "36" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76cb2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "37" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76cb2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "37" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c74b99", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0071d000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "38" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "38" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "39" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "39" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "40" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "40" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "41" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "41" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "42" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "42" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "43" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "43" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "44" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "44" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "45" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "45" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "46" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "46" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6f7a5", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xc0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xbe\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "47" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "47" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "48" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "48" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "49" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "49" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "50" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "50" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "51" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "51" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "52" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6f7a5", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xc0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xbe\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "52" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "53" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "53" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "54" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "54" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "55" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "55" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "56" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "56" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "57" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6f7a5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xbe\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "57" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "58" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "58" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "59" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "59" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Checking cleanup registry value...\r\n" }, { "name": "Length", "value": "57" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "64" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "64" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "65" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "65" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "66" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "66" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Index", "value": "67" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00721000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 523 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "ValueName", "value": "Disable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DataFilePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\Fonts\\staticcache.dat" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\staticcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" }, { "name": "Buffer", "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00" }, { "name": "Length", "value": "60" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c4" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b0" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x074f0000" }, { "name": "SectionOffset", "value": "0x06f8d730" }, { "name": "ViewSize", "value": "0x01260000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00727000" }, { "name": "RegionSize", "value": "0x00015000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0073c000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c78163", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6f7e4", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 539 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6f7e4", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf7\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Cleanup value missing... assuming no cleanup.\r\n" }, { "name": "Length", "value": "68" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-28 22:52:59,491", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6f89c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "@\\x02\\x00\\x00\\x00\\x00\\x00\\x00;\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 545 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6f89c", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ";\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Skipping cleanup.\r\n" }, { "name": "Length", "value": "40" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "TextShaping.dll" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\TextShaping.dll" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6fb18", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6fb18", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6fb18", "parentcaller": "0x00c71cd1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6fb18", "parentcaller": "0x00c71cd1", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76e60000" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6fb18", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6fb18", "parentcaller": "0x00c71cd1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b250000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00095000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c71d91", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "h\\x02\\x00\\x00\\x00\\x00\\x00\\x00c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\TextShaping" }, { "name": "DllBase", "value": "0x6b250000" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71d91", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "h\\x02\\x00\\x00\\x00\\x00\\x00\\x00c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71d91", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "c\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Preserve working path: [No]\r\n" }, { "name": "Length", "value": "50" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextShaping" }, { "name": "BaseAddress", "value": "0x6b250000" }, { "name": "InitRoutine", "value": "0x6b2df2f0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7784e000" }, { "name": "ModuleName", "value": "gdi32full.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7784e000" }, { "name": "ModuleName", "value": "gdi32full.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00725000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-28 22:52:59,506", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0071e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c71dc2", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x95\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 584 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0071e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71dc2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x95\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 587 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane2" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "SimSun-ExtB" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2" } ], "repeated": 1, "id": 590 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane7" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane12" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane13" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane15" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "Plane16" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 606 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "KeyInformation", "value": "i\\xffb0\\xfffc\\xffbe\\xffe3\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x18\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002c8" }, { "name": "ObjectAttributesName", "value": "Tahoma" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Tahoma" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c6fee9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~LS" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c71e15", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xd0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xcf\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 619 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71e15", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcf\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Cleaning MoSetup Volatile key...\r\n" }, { "name": "Length", "value": "55" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00ca0add", "parentcaller": "0x00c69ce2", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00c69eae", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00c69eae", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00c69eae", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-28 22:52:59,522", "thread_id": "5172", "caller": "0x00c69eae", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071a1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071a2000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00c40000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00c40000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071a4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 638 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00725000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49240" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49241" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 1, "id": 652 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "MutexName", "value": "Local\\MSCTF.Asm.MutexDefault1" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "Milliseconds", "value": "2000" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\CTF.AsmListCache.FMPDefault1" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04bf0000" }, { "name": "SectionOffset", "value": "0x06f8dd1c" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04bf0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 1, "id": 661 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 662 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 664 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "MutexName", "value": "CicLoadWinStaWinSta0" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c791e3", "parentcaller": "0x00c747ed", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 672 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "LaunchUserOOBE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c71e68", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71e68", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af2470" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af0700" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b2c3b0" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "MutexName", "value": "Local\\SM0:6024:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71e68", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x06\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 1, "id": 695 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Removing CorrelationVector registry value...\r\n" }, { "name": "Length", "value": "67" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "textinputframework.dll" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\TextInputFramework.dll" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fba0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4e000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "coreuicomponents.dll" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "coremessaging.dll" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\coreuicomponents.dll" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\coreuicomponents.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\CoreUIComponents.dll" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f6a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0027f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f8bb000" }, { "name": "ModuleName", "value": "coreuicomponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "coreuicomponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "coreuicomponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "coreuicomponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "ntmarta.dll" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "coremessaging.dll" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "wintypes.dll" } ], "repeated": 2, "id": 724 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\coremessaging.dll" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\coremessaging.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\CoreMessaging.dll" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0009b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f594000" }, { "name": "ModuleName", "value": "coremessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "coremessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "coremessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "coremessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c74713", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\ntmarta.dll" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f4e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00029000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f505000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\coremessaging.dll" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71ec6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "I\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\WinTypes.dll" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fac0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000dc000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb83000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" } ], "repeated": 1, "id": 766 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "coremessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "coreuicomponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00w\\x00s\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x00e\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00o\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\x00s\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\x00.\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc9\\x0f\\xcd\\x0f" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x6f4e0000" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\coremessaging" }, { "name": "DllBase", "value": "0x6f510000" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x6fac0000" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\coreuicomponents" }, { "name": "DllBase", "value": "0x6f6a0000" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c74713", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c71f1f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 781 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71f1f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x82\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Flushing MoSetup registry key...\r\n" }, { "name": "Length", "value": "55" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ntmarta" }, { "name": "BaseAddress", "value": "0x6f4e0000" }, { "name": "InitRoutine", "value": "0x6f4e7e90" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreMessaging" }, { "name": "BaseAddress", "value": "0x6f510000" }, { "name": "InitRoutine", "value": "0x6f570f60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WinTypes" }, { "name": "BaseAddress", "value": "0x6fac0000" }, { "name": "InitRoutine", "value": "0x6fb38ec0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00598000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0059a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04bf0000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04bf0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreUIComponents" }, { "name": "BaseAddress", "value": "0x6f6a0000" }, { "name": "InitRoutine", "value": "0x6f6feba0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextInputFramework" }, { "name": "BaseAddress", "value": "0x6fba0000" }, { "name": "InitRoutine", "value": "0x6fbe08c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 798 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "ValueName", "value": "EnableAnchorContext" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "USER32" }, { "name": "ModuleHandle", "value": "0x775d0000" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5172", "caller": "0x00c69f00", "parentcaller": "0x00ca08db", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 804 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c7a0ea", "parentcaller": "0x00c761fd", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-28 22:52:59,538", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c71f77", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 809 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c71f77", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb9\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Cleaning working dir...\r\n" }, { "name": "Length", "value": "46" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c71fdb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c70176", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 816 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c70176", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Attempting to preserve existing logs...\r\n" }, { "name": "Length", "value": "62" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c70180", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c70180", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Rollback" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00730000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6fc1f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00730000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00744000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6fc1f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6fc1f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "%\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Nothing to preserve.\r\n" }, { "name": "Length", "value": "43" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c71fdb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c7024c", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00P\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 835 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c7024c", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "P\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Working path still exists. Cleaning working path: [C:\\$Windows.~WS]...\r\n" }, { "name": "Length", "value": "93" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-28 22:52:59,553", "thread_id": "5012", "caller": "0x00c7ba53", "parentcaller": "0x00c6eada", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7deed", "parentcaller": "0x00c7ceea", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7df55", "parentcaller": "0x00c7ceea", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7deed", "parentcaller": "0x00c7cefc", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7df55", "parentcaller": "0x00c7cefc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a8e4", "parentcaller": "0x00c7cd15", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a8e4", "parentcaller": "0x00c7cd15", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a8e4", "parentcaller": "0x00c7cd15", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x006f8e20", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" }, { "name": "FirstCreateTimeLow", "value": "0xbb3a20f7" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef4" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a8e4", "parentcaller": "0x00c7cd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a8e4", "parentcaller": "0x00c7cd15", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 1, "id": 847 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a90e", "parentcaller": "0x00c7cd15", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00757000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00730000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a90e", "parentcaller": "0x00c7cd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a90e", "parentcaller": "0x00c7cd15", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00730000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab12", "parentcaller": "0x00c7cd2a", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab42", "parentcaller": "0x00c7cd2a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c245", "parentcaller": "0x00c7c438", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c538", "parentcaller": "0x00c7cd52", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x006f8e20", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\*" }, { "name": "FirstCreateTimeLow", "value": "0xbb3a20f7" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef4" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c6b0", "parentcaller": "0x00c7cd52", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000264" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c6b0", "parentcaller": "0x00c7cd52", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000264" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab12", "parentcaller": "0x00c6e796", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 872 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000320" }, { "name": "ObjectAttributesName", "value": "Segoe UI Light" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI Light" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca00af", "parentcaller": "0x00c9fd17", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x1e\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab42", "parentcaller": "0x00c6e796", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab12", "parentcaller": "0x00c6e8bf", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\r\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab42", "parentcaller": "0x00c6e8bf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab12", "parentcaller": "0x00c6e8e4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "USER32" }, { "name": "ModuleHandle", "value": "0x775d0000" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "GetSystemMetrics" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77604ef0" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "MonitorFromWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x776096f0" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "MonitorFromRect" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775f92f0" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "MonitorFromPoint" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77600be0" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca08db", "parentcaller": "0x00c6aeb1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "EnumDisplayMonitors" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77611a20" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a99c", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7a9ca", "parentcaller": "0x00c7ab23", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ab42", "parentcaller": "0x00c6e8e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c245", "parentcaller": "0x00c7ca5c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5172", "caller": "0x00ca0aae", "parentcaller": "0x00ca404b", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7cae4", "parentcaller": "0x00c7c6fd", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7cb3b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7cb3b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7cb3b", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7cb3b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7cb3b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7cb3b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7cb3b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7cb3b", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7cb3b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7cb3b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7cb47", "parentcaller": "0x00c7c6fd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c245", "parentcaller": "0x00c7c438", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c538", "parentcaller": "0x00c7cbc3", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00731338", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\*" }, { "name": "FirstCreateTimeLow", "value": "0xbb3a20f7" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef4" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c7fd", "parentcaller": "0x00c7cbc3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b516", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00110180", "pretty_value": "FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000320" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000320" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b5c0", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "18", "pretty_value": "FileAllInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b5d8", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01R6G\\xbb\\xf4\\xee\\xdc\\x01\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b5f8", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01R6G\\xbb\\xf4\\xee\\xdc\\x01\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01\\x00 \\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b45f", "parentcaller": "0x00c7c9d0", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75d30000" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b471", "parentcaller": "0x00c7c9d0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "FindFirstFileNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d534b0" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b482", "parentcaller": "0x00c7c9d0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "FindNextFileNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d53500" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b719", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources" }, { "name": "FileInformationClass", "value": "13", "pretty_value": "FileDispositionInformation" }, { "name": "FileInformation", "value": "\\x01" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b8bf", "parentcaller": "0x00c7c9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7c7fd", "parentcaller": "0x00c7cd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b516", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00110180", "pretty_value": "FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ddfb", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7de4a", "parentcaller": "0x00c7b564", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b5c0", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "18", "pretty_value": "FileAllInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b5d8", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01\\x03TG\\xbb\\xf4\\xee\\xdc\\x01\\x03TG\\xbb\\xf4\\xee\\xdc\\x01\\x03TG\\xbb\\xf4\\xee\\xdc\\x01\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b5f8", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\xf7 :\\xbb\\xf4\\xee\\xdc\\x01\\x03TG\\xbb\\xf4\\xee\\xdc\\x01\\x03TG\\xbb\\xf4\\xee\\xdc\\x01\\x03TG\\xbb\\xf4\\xee\\xdc\\x01\\x00 \\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b719", "parentcaller": "0x00c7c9d0", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "13", "pretty_value": "FileDispositionInformation" }, { "name": "FileInformation", "value": "\\x01" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7b8bf", "parentcaller": "0x00c7c9d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7deed", "parentcaller": "0x00c7cfc4", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7df55", "parentcaller": "0x00c7cfc4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7deed", "parentcaller": "0x00c7cfdc", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7df55", "parentcaller": "0x00c7cfdc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c72010", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xad\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 974 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c72010", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xad\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Creating path (with ACL): [C:\\$Windows.~WS]...\r\n" }, { "name": "Length", "value": "69" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c78c1a", "parentcaller": "0x00c75df2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00020008" }, { "name": "TokenHandle", "value": "0x00000324" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c78c69", "parentcaller": "0x00c75df2", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c78cdc", "parentcaller": "0x00c75df2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\x9ar\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c66f6f", "parentcaller": "0x00c75df2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c74c97", "parentcaller": "0x00c75f13", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000324" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c74c97", "parentcaller": "0x00c75f13", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c74c97", "parentcaller": "0x00c75f13", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000324" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c74c97", "parentcaller": "0x00c75f13", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76c02", "parentcaller": "0x00c7201a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c75fc5", "parentcaller": "0x00c7201a", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c77762", "parentcaller": "0x00c77721", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c77762", "parentcaller": "0x00c77721", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c77762", "parentcaller": "0x00c77721", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c77762", "parentcaller": "0x00c77721", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c72030", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00100100", "pretty_value": "FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c72030", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\$Windows.~WS" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82 \\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c72030", "parentcaller": "0x00c74024", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c7ba53", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c7206f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf2\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 998 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c7206f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf2\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Creating path: [C:\\$Windows.~WS\\Sources]...\r\n" }, { "name": "Length", "value": "66" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c72079", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c9b07b", "parentcaller": "0x00c72079", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b4ea", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x004\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1006 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b4ea", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Opening Box: [C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe]\r\n" }, { "name": "Length", "value": "98" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-28 22:52:59,569", "thread_id": "5012", "caller": "0x00c9b6b0", "parentcaller": "0x00c6b4f8", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00cac389", "parentcaller": "0x00c9bf66", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000324" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfe3", "parentcaller": "0x00c9b713", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000324" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1L\\x81\\xf6\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xeeE\\xec\\xa4\\xb4-\\xef\\xa5\\xa1F\\xec\\xa4\\xbd-\\xef\\xa5\\xa1F\\xeb\\xa4\\xaf-\\xef\\xa5\\xa1F\\xea\\xa4\\xb9-\\xef\\xa5\\xa1F\\xee\\xa4\\x98-\\xef\\xa5\\xb5-\\xee\\xa5\\xd4/\\xef\\xa5\\xa1F\\xe6\\xa4\\xe9-\\xef\\xa5\\xa1F\\x10\\xa5\\xb4-\\xef\\xa5\\xa1F\\xed\\xa4\\xb4-\\xef\\xa5Rich\\xb5-\\xef\\xa5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00\\xb1JJ\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r" }, { "name": "Length", "value": "131072" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00763000" }, { "name": "RegionSize", "value": "0x0007c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfe3", "parentcaller": "0x00c9b713", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000324" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc4\\x10\\x8b\\xcb\\xe8ui\\x00\\x00\\x85\\xf6t\\x07\\x8b\\xce\\xe83g\\x00\\x00\\x8bM\\xe4\\x85\\xc9t\\x05\\xe8'g\\x00\\x00\\x85\\xfft\\x07\\x8b\\xcf\\xe8\\x1cg\\x00\\x00j\\x00\\x8dM\\xd0\\xe8S\\x89\\x00\\x00\\x8dM\\xd8\\xe8\\xeec\\xff\\xff\\x8b\\xc3\\xe8\\x11\"\\x05\\x00\\xc3j\\x14\\xb8u\\G\\x00\\xe8'\"\\x05\\x00\\x8b\\xda3\\xc0\\x89E\\xe0\\x89E\\xe4\\x89E\\xe8\\x8b\\xf0\\x89E\\xfc\\x89u\\xf0\\xc6E\\xfc\\x01\\x85\\xc9u\t\\xb9W\\x00\\x07\\x80\\x8b\\xf9\\xebT\\x85\\xdbt\\xf3\\x8dU\\xe0\\xe8\\xdaJ\\x00\\x00\\x8b\\xf8\\x85\\xffx@\\x8dE\\xf0P\\x8dU\\xec\\x8dM\\xe0\\xe8QM\\x00\\x00\\x8b\\xf8\\x85\\xffy\\x0c\\x8b\\xcf\\xe8\\xc1h\\x00\\x00\\x8bu\\xf0\\xeb&\\x8bU\\xec\\x8bu\\xf0\\x83\\xfa\\x01u\\x03R\\xeb\\x02j\\x00SQ\\x8b\\xce\\xe8\\xc7\\xc4\\x02\\x00\\x8b\\xf8\\x85\\xffy\\x07\\x8b\\xcf\\xe8\\x96h\\x00\\x00\\x8b\\xcf\\xe8\\xa7h\\x00\\x00\\x85\\xf6t\\x10Vj\\x00\\xff\\x150\\xd3G\\x00P\\xff\\x15@\\xd3G\\x00j\\x00\\x8dM\\xe0\\xe8\\x93\\x88\\x00\\x00\\x8dM\\xe8\\xe8.c\\xff\\xff\\x8b\\xc7\\xe8" }, { "name": "Length", "value": "375296" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00b0e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0925d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfbb", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00738000" }, { "name": "RegionSize", "value": "0x000a7000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9bfe3", "parentcaller": "0x00c9b713", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000324" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x08\\x00\\xe86\\x00\\x80X\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x80\\x00\\x00\\x80\\x03\\x00\\x00\\x00 \\x01\\x00\\x80\\x05\\x00\\x00\\x00\\x00\\x02\\x00\\x80\\x06\\x00\\x00\\x008\\x02\\x00\\x80\n\\x00\\x00\\x00\\x88\\x02\\x00\\x80\\x0e\\x00\\x00\\x00\\xa0\\x02\\x00\\x80\\x10\\x00\\x00\\x00\\xc0\\x02\\x00\\x80\\x18\\x00\\x00\\x00\\xd8\\x02\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x03\\x00,N\\x00\\x00\\xf0\\x02\\x00\\x80-N\\x00\\x00\\x08\\x03\\x00\\x80.N\\x00\\x00 \\x03\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\xd2\\x07\\x00\\x008\\x03\\x00\\x80\\xd3\\x07\\x00\\x00P\\x03\\x00\\x80\\xd4\\x07\\x00\\x00h\\x03\\x00\\x80\\xd5\\x07\\x00\\x00\\x80\\x03\\x00\\x80\\xd6\\x07\\x00\\x00\\x98\\x03\\x00\\x80\\xd7\\x07\\x00\\x00\\xb0\\x03\\x00\\x80\\xd8\\x07\\x00\\x00\\xc8\\x03\\x00\\x80\\xd9\\x07\\x00\\x00\\xe0\\x03\\x00\\x80\\xda\\x07\\x00\\x00\\xf8\\x03\\x00\\x80\\xdb\\x07\\x00\\x00\\x10\\x04\\x00\\x80\\xdc\\x07\\x00\\x00(\\x04\\x00\\x80\\xdd\\x07\\x00\\x00@\\x04\\x00\\x80\\xde\\x07\\x00\\x00X\\x04\\x00\\x80\\xdf\\x07\\x00\\x00p\\x04\\x00\\x80" }, { "name": "Length", "value": "11042360" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c9c0af", "parentcaller": "0x00c9b713", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00b0e000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b52e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1023 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b52e", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x96\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-28 22:52:59,584", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Reading Box header...\r\n" }, { "name": "Length", "value": "44" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b607", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1029 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b607", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc2\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Opening Box container: [0]...\r\n" }, { "name": "Length", "value": "52" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9b85a", "parentcaller": "0x00c6b617", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000324" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000318" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00cac389", "parentcaller": "0x00c9c54a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "88\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9c5f5", "parentcaller": "0x00c9b891", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x02\\x00\\xc5\\xb0\\x91\\x84\\x06V\\x1br\\xe2M\\x91\\xb4V\\x96)v<\\xb3\\x01\\x00\\x00\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "Length", "value": "124" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b645", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf6\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1038 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b645", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Verifying Box container: [0]...\r\n" }, { "name": "Length", "value": "54" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9ba04", "parentcaller": "0x00c6b652", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00a06000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9ba04", "parentcaller": "0x00c6b652", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9ba04", "parentcaller": "0x00c6b652", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09155000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9b65a", "parentcaller": "0x00c9ba1a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ec" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\x07\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x01\\x01" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9b65a", "parentcaller": "0x00c9ba1a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x76ba0000" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9b65a", "parentcaller": "0x00c9ba1a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x76ba0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76bb5880" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00cac389", "parentcaller": "0x00c9ba45", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "88\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9ba9e", "parentcaller": "0x00c6b652", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x02\\x00\\xc5\\xb0\\x91\\x84\\x06V\\x1br\\xe2M\\x91\\xb4V\\x96)v<\\xb3\\x01\\x00\\x00\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d\\xa2x\\x00\\x00\\x00\\x00\\x00b\\x00o\\x00x\\x00t\\x00o\\x00o\\x00l\\x00_\\x00g\\x00e\\x00n\\x00e\\x00r\\x00a\\x00t\\x00e\\x00d\\x000\\x001\\x00.\\x00c\\x00a\\x00b\\x00\\x00\\x00MSCF\\x00\\x00\\x00\\x00\\x9d\\xa2x\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\x02\\x00\\x00\\x14\\x04\\x01\\x00@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00HQ\\xe0\\x04 DU.dll\\x00`\\x15\\x0e\\x00@\\xe3\\x01\\x00\\x00\\x00,Q\\x94\\x9a DiagTrack.dll\\x00\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a DiagTrackRunner.exe" }, { "name": "Length", "value": "7906073" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c9bb82", "parentcaller": "0x00c6b652", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00a06000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-28 22:52:59,600", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b680", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00,\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1053 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b680", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ",\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Reading Box container header: [0]...\r\n" }, { "name": "Length", "value": "59" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6b6bb", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00g\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1059 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6b6bb", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "g\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:52:59: Extracting Box container: [0]...\r\n" }, { "name": "Length", "value": "55" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9c6db", "parentcaller": "0x00c9bd23", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9c6db", "parentcaller": "0x00c9bd23", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9c6db", "parentcaller": "0x00c9bd23", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x0070abe0", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FirstCreateTimeLow", "value": "0x12fcbb2a" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef4" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9c6db", "parentcaller": "0x00c9bd23", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9c6db", "parentcaller": "0x00c9bd23", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cc73", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00cac389", "parentcaller": "0x00c9ccac", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb48\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cc73", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00cac389", "parentcaller": "0x00c9ccac", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb48\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "MSCF\\x00\\x00\\x00\\x00\\x9d\\xa2x\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "36" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd88\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1072 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe08\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 1073 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00HQ\\xe0\\x04 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf08\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1075 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "DU.dll\\x00`\\x15\\x0e\\x00@\\xe3\\x01\\x00\\x00\\x00,Q\\x94\\x9a DiagTrack.dll\\x00\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a DiagTrackRunner.exe\\x00@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02 Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89 setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02 setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf78\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1080 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd88\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x99\\x02\\x00\\x00\\x14\\x04\\x01\\x00" }, { "name": "Length", "value": "8" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "M;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c77aa7", "parentcaller": "0x00c9c7c9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00738000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c77aa7", "parentcaller": "0x00c9c7c9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00741000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x16\\xc9m\\xf3Q#\\x00\\x80" }, { "name": "Length", "value": "9049" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x003\\x05\\x13#wd}pwd}pwd}pc\\x0f~qud}pc\\x0fyqfd}pwd|p\\xc8d}pc\\x0f|qbd}pc\\x0fxq\\x7fd}pc\\x0f}qvd}pc\\x0ftqld}pc\\x0f\\x82pvd}pc\\x0f\\x7fqvd}pRichwd}p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x13Jc\\xef\\xef4\\x00\\x80" }, { "name": "Length", "value": "13559" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "Buffer", "value": "c$02\\x00\\x00\\x00\\x00 \\x00\\x00\\x006,=P\"\\x99>\\x0c\\x1df\\xa9\\xec\\xe8\\xcf\\x9b\\xd9c\\xc6B\\xb7L\\x0f\\xd7\\x1fO\\x8d#\\xd6\\xf0u\\xed\\xc4\\x00\\x00\\x00\\x00\\xb9T\\xa0\\x01\\x10\\xe8\\x97\\x06\\x00\\x00h\\xd0{\\x01\\x10\\xe8$\\xe3\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xb9\\x0c\\xa0\\x01\\x10\\xe8w\\x06\\x00\\x00h\\xe0{\\x01\\x10\\xe8\\x04\\xe3\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xb90\\xa0\\x01\\x10\\xe8W\\x06\\x00\\x00h\\xf0{\\x01\\x10\\xe8\\xe4\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcch\\x00|\\x01\\x10\\xe8\\xce\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcch0|\\x01\\x10\\xe8\\xbe\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcch`|\\x01\\x10\\xe8\\xae\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffVW\\xbe\\xd8\\x1b\\x00\\x10\\xbf\\x10\\x90\\x01\\x10\\xa5\\xa5\\xa5\\xa5\\xbe\\xe8\\x1b\\x00\\x10\\xbf$\\x90\\x01\\x10\\xa5\\xa5\\xa5\\xa5\\xbe\\xf8\\x1b\\x00\\x10\\xbf8\\x90\\x01\\x10\\xa5\\xa5\\xa5\\xa5\\xbe\\x08" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "3\\x87\\x85\\xae\\xb2?\\x00\\x80" }, { "name": "Length", "value": "16314" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "Buffer", "value": "\\x03\\xe8\\xfc\\x86\\xff\\xff\\x83\\xc4\\x10P\\xff\\x15P\\xb1\\x01\\x10\\xc6E\\xfc\\x00\\x8bE\\xe0\\x85\\xc0t\\x10\\x8b\\x08P\\x8bq\\x08\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x83M\\xfc\\xff\\x8bE\\xdc\\x85\\xc0\\x0f\\x84\\xa1\\x06\\x00\\x00\\x8b\\x08P\\x8bq\\x08\\xe9\\x8c\\x06\\x00\\x00\\x8b]\\xd0\\x83\\xc8\\xfff9E\\xf0u\\x0b3\\xc0@\\x89E\\xc83\\xc0\\x89E\\xbc\\xc6E\\xfc\\x00\\x8bE\\xe0\\x85\\xc0t\\x10\\x8b\\x08P\\x8bq\\x08\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x83\\xc8\\xff\\x89E\\xfc\\x8bE\\xdc\\x85\\xc0t\\x10\\x8b\\x08P\\x8bq\\x08\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x83e\\xcc\\x00\\x89}\\xfc\\x8dU\\xcc\\x8bC\\x10RP\\x8b\\x08\\x8bq$\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x8b\\xd8\\x85\\xdby7j\\x00j\\x00\\xff\\x158\\xb0\\x01\\x10P\\xff\\x15X\\xb1\\x01\\x10P\\xbf\\x0cv\\x00\\x10Wh(s\\x00\\x10h\\x8a\\x01\\x00\\x00j\\x00h8 \\x00\\x10h\\x00\\x00\\x05\\x00SWh\\xecv\\x00\\x10\\xebR\\x8bE\\xcc\\x8dU\\xc0RP\\x8b\\x08\\x8bq(\\x8b\\xce\\xff\\x15" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd8\\x807\\\\x10H\\x00\\x80" }, { "name": "Length", "value": "18456" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "Buffer", "value": "uffer\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0u\\xed\\xc4\\x00\\x00\\x00\\x00\\xde\\x8c\\x01\\x00\\x01\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x0f\\x00\\x00\\x00H\\x8c\\x01\\x00\\x84\\x8c\\x01\\x00\\xc0\\x8c\\x01\\x00\\xf0\\x91\\x00\\x00\\xd0\\x91\\x00\\x00P\\x91\\x00\\x00P\\x91\\x00\\x00\\x90\\x91\\x00\\x00p\\x91\\x00\\x00@\\x91\\x00\\x00@\\x91\\x00\\x00\\x90\\x91\\x00\\x00p\\x91\\x00\\x00\\xc0\\x94\\x00\\x00\\x10\\x94\\x00\\x00 \\x93\\x00\\x00\\x80\\x97\\x00\\x00@\\x95\\x00\\x00\\xe5\\x8c\\x01\\x00\\x16\\x8d\\x01\\x00E\\x8d\\x01\\x00p\\x8d\\x01\\x00\\x99\\x8d\\x01\\x00\\xbe\\x8d\\x01\\x00\\xe1\\x8d\\x01\\x00\n\\x8e\\x01\\x001\\x8e\\x01\\x00T\\x8e\\x01\\x00u\\x8e\\x01\\x00~\\x8e\\x01\\x00\\x89\\x8e\\x01\\x00\\x92\\x8e\\x01\\x00\\x9d\\x8e\\x01\\x00\\x00\\x00\\x01\\x00\\x02\\x00\\x03\\x00\\x04\\x00\\x05\\x00\\x06\\x00\\x07\\x00\\x08\\x00\t\\x00\n\\x00\\x0b\\x00\\x0c\\x00\r\\x00\\x0e\\x00du.dll\\x00??4ClientApplicationInfo@DU" }, { "name": "Length", "value": "25408" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DU.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00B7\\x16F\\x9d\\xd6\\x01\\x00B7\\x16F\\x9d\\xd6\\x01\\x00B7\\x16F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "`\\x15\\x0e\\x00@\\xe3\\x01\\x00\\x00\\x00,Q\\x94\\x9a " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x079\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1100 }, { "timestamp": "2026-05-28 22:52:59,616", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "DiagTrack.dll\\x00\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a DiagTrackRunner.exe\\x00@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02 Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89 setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02 setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.d" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x159\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`\\x15\\x0e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1105 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "`\\x15\\x0e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "`\\x15\\x0e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\xb7\\x83\\xc2&\\xd6\\xed\\x91&\\xd6\\xed\\x91&\\xd6\\xed\\x91\\x92J\\x1c\\x91*\\xd6\\xed\\x91&\\xd6\\xec\\x91\\xb2\\xd7\\xed\\x91\\x92J\\x02\\x91\\x07\\xd6\\xed\\x91\\x92J\\x1e\\x91(\\xd6\\xed\\x91\\x92J\\x1f\\x91(\\xd6\\xed\\x91\\x92J\\x03\\x91'\\xd6\\xed\\x91\\x92J\\x1a\\x91\\xb1\\xd6\\xed\\x91\\x92J\\x00\\x91'\\xd6\\xed\\x91\\x92J\\x1d\\x91'\\xd6\\xed\\x91Rich&\\xd6\\xed\\x91\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00" }, { "name": "Length", "value": "7360" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x90\\xf7 \\xda\\xb3\"\\x00\\x80" }, { "name": "Length", "value": "8891" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00I\\x00n\\x00v\\x00a\\x00l\\x00i\\x00d\\x00_\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00_\\x00_\\x00D\\x00E\\x00P\\x00R\\x00E\\x00C\\x00A\\x00T\\x00E\\x00D\\x00_\\x00I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00N\\x00o\\x00S\\x00u\\x00c\\x00h\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00_\\x000\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00N\\x00o\\x00t\\x00I\\x00m\\x00p\\x00l\\x00e\\x00m\\x00e\\x00n\\x00t\\x00e\\x00d\\x00_\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00C\\x00r\\x00e\\x00a\\x00t\\x00e\\x00S\\x00c\\x00r\\x00i\\x00p\\x00t\\x00F\\x00a\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0ei\\xa7\\xa4\\xab\\x1d\\x00\\x80" }, { "name": "Length", "value": "7603" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "U\\x00r\\x00l\\x00\\x00\\x00M\\x00a\\x00x\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00A\\x00t\\x00t\\x00e\\x00m\\x00p\\x00t\\x00s\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00i\\x00t\\x00i\\x00a\\x00l\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00s\\x00\\x00\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00M\\x00u\\x00l\\x00t\\x00F\\x00a\\x00c\\x00t\\x00o\\x00r\\x00\\x00\\x00S\\x00k\\x00i\\x00p\\x00U\\x00p\\x00l\\x00o\\x00a\\x00d\\x00O\\x00n\\x00N\\x00o\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00P\\x00e\\x00r\\x00c\\x00e\\x00n\\x00t\\x00a\\x00g\\x00e\\x00\\x00\\x00R\\x00a\\x00n\\x00d\\x00o\\x00m\\x00i\\x00z\\x00e\\x00d\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00P\\x00e\\x00r\\x00c\\x00e\\x00n\\x00t\\x00a\\x00g\\x00e\\x00\\x00\\x00A\\x00s\\x00i\\x00m\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ":)-\\x85g2\\x00\\x80" }, { "name": "Length", "value": "12911" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "CDEF\\x00\\x00\\x00\\x00%.17g\\x00\\x00\\x00true\\x00\\x00\\x00\\x00false\\x00\\x00\\x00null\\x00\\x00\\x00\\x00\"Custom#%u\"\\x00[\\x00E\\x00R\\x00R\\x00O\\x00R\\x00:\\x00E\\x00v\\x00e\\x00n\\x00t\\x00H\\x00e\\x00a\\x00d\\x00e\\x00r\\x00.\\x00F\\x00l\\x00a\\x00g\\x00s\\x00=\\x00%\\x00x\\x00]\\x00\\x00\\x00\\x00\\x00t\\x00a\\x00s\\x00k\\x00\\x00\\x00\\x00\\x00a\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00\\x00\\x00\\x00\\x00r\\x00e\\x00l\\x00a\\x00t\\x00e\\x00d\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00\\x00\\x00o\\x00p\\x00c\\x00o\\x00d\\x00e\\x00\\x00\\x00\\x00\\x00k\\x00e\\x00y\\x00w\\x00o\\x00r\\x00d\\x00\\x00\\x00[\\x00E\\x00R\\x00R\\x00O\\x00R\\x00:\\x00B\\x00a\\x00d\\x00S\\x00i\\x00d\\x00L\\x00e\\x00n\\x00g\\x00t\\x00h\\x00=\\x00%\\x00u\\x00]\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb77S\\xf3)D\\x00\\x80" }, { "name": "Length", "value": "17457" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x03\\x00\\x00\\x84\\xc0t\\x1c\\x83~\\x14\\x10r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6\\xffu\\x0c+\\xd8\\x8b\\xceSV\\xe8\\xd6\\x01\\x00\\x00\\xebCW\\x8b}\\x0c\\x8b\\xcej\\x00W\\xe8@\\x00\\x00\\x00\\x84\\xc0t.\\x83~\\x14\\x10r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6\\x85\\xfft\\x0bWSP\\xe8)%\t\\x00\\x83\\xc4\\x0c\\x83~\\x14\\x10\\x89~\\x10r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6\\xc6\\x048\\x00\\x8b\\xc6_^[]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8bu\\x08\\x83\\xfe\\xfewM9q\\x14s\\x0b\\xffq\\x10V\\xe8\\x01\\x02\\x00\\x00\\xeb0\\x80}\\x0c\\x00t\\x18\\x83\\xfe\\x10s\\x13\\x8bA\\x10;\\xf0s\\x02\\x8b\\xc6Pj\\x01\\xe8\\xda\\xfc\\xff\\xff\\xeb\\x12\\x85\\xf6u\\x0e!q\\x10\\x83y\\x14\\x10r\\x02\\x8b\t\\xc6\\x01\\x003\\xc0;\\xc6^\\x1b\\xc0\\xf7\\xd8]\\xc2\\x08\\x00\\xe8\\xc1\\xfe\\xff\\xff\\xcc\\xcc\\xcc\\xcc\\xcc\\xccj\\x10\\xb8e\\xd8\n\\x10\\xe8\\x0e$\t\\x00\\x8b\\xf1\\x89u\\xe8\\x8b}\\x08\\x83\\xcf\\x07\\x81\\xff\\xfe\\xff\\xff\\x7fv\\x05\\x8b}\\x08\\xeb)3\\xd2\\xc7E\\xec" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x91\\x8f\\xdbTlE\\x00\\x80" }, { "name": "Length", "value": "17780" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\xfe\\xff\\xffj\\x04_\\x89E\\xc49=P\\xb4\\x0c\\x10v2Vh\\x00\\x00\\x01\\x00\\x8b\\xcb\\xe8\\x02q\\xff\\xff\\x84\\xc0t!\\x8dE\\xc4\\x89u\\xec\\x89E\\xe8\\x89}\\xf0\\x89u\\xf4\\x8dE\\xc8\\xba\\xd8_\\x01\\x10Pj\\x03QQ\\xe8\\xd6o\\xff\\xff\\x8bM\\xfc_^3\\xcd[\\xe8\\x00\\xa0\\x08\\x00\\x8b\\xe5]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x83\\xe4\\xf8\\x83\\xec\\x10\\x83$$\\x00\\x8d\\x04$VW\\x8dT$\\x0c\\x89D$\\x0c\\x8dL$\\x10\\xe8m\\x0f\\x00\\x00\\xe8\\x13\\xf7\\xff\\xff\\x84\\xc0u\n\\xc7D$\\x08\\xb7\\x00\\x00\\x00\\xebs\\xb1\\x01\\xe8t\\xf9\\xff\\xff\\x85\\xc0xh\\xbf\\x90\\xc0\\x0c\\x10\\x8b\\xcf\\xe8\\xc1\\x87\\xff\\xff\\x89D$\\x08\\x85\\xc0y\rPh\\xa0W\\x00\\x10\\xba\\x90\\x02\\x00\\x00\\xeb?\\xa1\\xc0\\xbf\\x0c\\x10\\xbe\\xa0W\\x00\\x10\\x85\\xc0t\\x1bj\\xffP\\xff\\x15\\xd4\\xd2\\x0c\\x10\\x85\\xc0t\\x0e\\x8bM\\x04\\xba;\\x01\\x00\\x00V\\xe8\\xc9\\xdd\\xff\\xff\\x8b\\xcf\\xe8\\x02\\x93\\xff\\xff\\x89D$\\x08\\x85\\xc0y\\x0fPV\\xba\\x99\\x02\\x00\\x00\\x8bM" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "}\\x9c:\\x1e\\xc4B\\x00\\x80" }, { "name": "Length", "value": "17100" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x00\\x8b\\xcb\\xe8\\x99\\xfa\\xff\\xff\\xe9M\\x02\\x00\\x00;\\x8b\\xd4\\x01\\x00\\x00u@\\x8b\r$\\xc1\\x0c\\x10\\xe8\\x9c\\xbd\\x00\\x00\\x8b\\xcb\\xe8\\xc7\\xf9\\xff\\xff\\x8b58\\xc1\\x0c\\x10\\x8b\\xce\\x8b=(\\xc1\\x0c\\x10\\xe8\\xc8\\xe3\\xff\\xff\\x0f\\xb6\\xc0\\x8b\\xceP\\xe8\\x9c\\x86\\x00\\x00\\x0f\\xb6\\xc0\\x8b\\xcfP\\xe8)\\xce\\x00\\x00\\xe9\\x05\\x02\\x00\\x00\\x8b\\x83\\xd8\\x01\\x00\\x00\\x85\\xc0t\\x04;\\xc8t\\x0e\\x8b\\x93\\xdc\\x01\\x00\\x00\\x85\\xd2te;\\xcaua\\x85\\xc0t\\x08;\\xc8u\\x043\\xf6\\xeb\\x033\\xf6F\\x8b\r\\xd0\\xc0\\x0c\\x10V\\xe8\\xe8\\xd5\\x00\\x00\\x84\\xc0t\\x10\\xb1\\x03\\xe8\\xaf*\\xff\\xffj\\x00\\x8b\\xcb\\xe8\\x01\\xfa\\xff\\xffj\\x01j\\x01j\\x00\\x8b\\xcb\\xe8\\x9b3\\x00\\x00\\x85\\xf6u\\x08\\x8b\\x83H\\x01\\x00\\x00\\xeb\\x06\\x8b\\x83P\\x01\\x00\\x00\\x8b\r8\\xc1\\x0c\\x10j\\x01P\\xe8\\xcf\\xd3\\xff\\xff\\xe9\\x88\\x01\\x00\\x00\\x8b\\x83\\xe0\\x01\\x00\\x00\\x85\\xc0t\\x08;\\xc8\\x0f\\x84v\\x01\\x00\\x00\\x8b\\x83\\xe4\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84E\\x01\\x00\\x00;\\xc8\\x0f\\x85=\\x01\\x00\\x00j\\x01\\x8d\\x85X\\xff" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe8c}\\xa7\\xd5G\\x00\\x80" }, { "name": "Length", "value": "18397" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x0c\\xeb\\x023\\xf6\\x897\\x8b\\xc7_^[\\x8b\\xe5]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x8b\\xc13\\xc9\\xf7\\xe2V\\x8b\\xf0;\\xd1w\\x0er\\x05\\x83\\xfe\\xffw\\x07\\x8bE\\x08\\x890\\xeb\\x0b\\x8bE\\x08\\xb9\\x16\\x02\\x07\\x80\\x83\\x08\\xff\\x8b\\xc1^]\\xc2\\x04\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x83y\\x14\\x08r\\x02\\x8b\tj\\x00j\\x00Q\\xff\\x15\\\\xd4\\x0c\\x10\\x83\\xc4\\x0c\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x83y\\x14\\x08r\\x02\\x8b\tR\\x8b\\xd1\\xb9\\xa0[\\x00\\x10\\xe8\\xcc\\xd2\\xfe\\xff\\x85\\xc0x\\x04\\xb0\\x01]\\xc3=\\x02\\x00\\x07\\x80u\\x042\\xc0]\\xc3\\x8b\\xc8\\xe8\\x8c\\xe0\\xfe\\xff\\x8bM\\x04\\xba\\xe6\\x06\\x00\\x00Ph\\xa0S\\x00\\x10\\xe8\\x81\\xe0\\xfe\\xff\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffVW\\x8b93\\xf6\\x8dW\\x04\\x8b\\x02\\x8b\\xc8\\x0b\\xce\\xf0\\x0f\\xb1\nu\\xf6\\x8b\\xf0\\xff\\x15 \\xd3\\x0c\\x10;\\xf0t\\x07W\\xff\\x15\\xfc\\xd1\\x0c\\x10_^\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\xffu\\x0cj\\x00\\xffu\\x04QQ\\xffu\\x08\\xe8`\\xcd\\xfe\\xff]\\xc2" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x10\\xf1En\\x91E\\x00\\x80" }, { "name": "Length", "value": "17817" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\xff\\xff\\xff\\xe8\\xe7\\xa7\\xfe\\xff\\x8b\\xf0\\x85\\xf6\\x0f\\x88\\xc4\\x00\\x00\\x00j\\xffj\\x10\\x8d\\x85d\\xfe\\xff\\xffP\\x8d\\x8dp\\xff\\xff\\xff\\xe82=\\xfe\\xff\\x8d\\x95d\\xfe\\xff\\xff\\xc6E\\xfc\\x14\\x8d\\x8d\\x1c\\xfd\\xff\\xff\\xe8\\x08\\x17\\x00\\x00P\\x8d\\x85|\\xfe\\xff\\xff\\xc6E\\xfc\\x15P\\x8dKl\\xe8F\\x19\\x00\\x00P\\x83\\xc0\\x10PQ\\x8d\\x85\\x0c\\xfd\\xff\\xffP\\x8dKl\\xe8\\x13\\x9a\\xff\\xff\\xc6E\\xfc\\x14\\x8b\\x8d \\xfd\\xff\\xff\\x85\\xc9t\\x05\\xe812\\xfe\\xff3\\xc0\\xc6E\\xfc\\x11P@\\x8d\\x8dd\\xfe\\xff\\xffP\\xe8\\xb9\\xfe\\xfd\\xff\\x85\\xf6xE\\x8d\\x85@\\xff\\xff\\xffP\\x8d\\x8d\\xf0\\xfc\\xff\\xff\\xe8_;\\xfe\\xff\\x8d\\x85p\\xff\\xff\\xff\\xc6E\\xfc\\x16P\\x8dKd\\xe8n#\\x00\\x00\\x8d\\x8d\\xf0\\xfc\\xff\\xffQ\\x8b\\xc8\\xe8\\x8fZ\\xfe\\xff\\x8d\\x8d\\xf0\\xfc\\xff\\xff3\\xc0P@P\\xe8r\\xfe\\xfd\\xff\\xeb8\\x83\\xec\\x18\\x8d\\x85@\\xff\\xff\\xff\\x8b\\xcc\\x89\\xa5\\xb4\\xfd\\xff\\xffP\\xe8\\x15;\\xfe\\xff\\x83\\xec\\x18\\xc6E\\xfc\\x17\\x8d\\x85p\\xff\\xff\\xff\\x8b\\xccP\\xe8\\x00;" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "av]\\xca\\xb6C\\x00\\x80" }, { "name": "Length", "value": "17342" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\xff\\xbe\\x90\\x04\\x07\\x80\\xe9\\x1d\\x03\\x00\\x00\\x8aE\\x97\\x8d\\x8dt\\xff\\xff\\xff\\x88\\x85H\\xff\\xff\\xff\\x8bE\\x88\\x89\\x85L\\xff\\xff\\xff\\x8bE\\x90\\x89\\x85P\\xff\\xff\\xff\\x8dE\\x98P\\xe8\\x87\\x16\\x00\\x00\\x8d\\x8dH\\xff\\xff\\xffQ\\x8b\\xc8\\xe8|\\x17\\x00\\x00j\\x00j\\x01\\x8dM\\x98\\xc6E\\xfc\\x02\\xe8\\xf3~\\xfd\\xff\\x8b\\x8dt\\xff\\xff\\xff\\x8b?\\x89M\\x88\\xe9H\\xff\\xff\\xff\\x8b\\x01\\xbb4?\\x00\\x10\\x89\\x85d\\xff\\xff\\xff;\\xc1\\x0f\\x849\\x02\\x00\\x00\\x8dx\\x10W\\x8dM\\xc8\\xe8~\\xbb\\xfd\\xff\\x8dG\\x18\\xc6E\\xfc\\x04P\\x8dM\\xe0\\xe8\\x80\\x1b\\x00\\x00\\x83}\\xdc\\x08\\x8bE\\xc8s\\x03\\x8dE\\xc8j\\x00h\\x80\\x00\\x00\\x00j\\x03j\\x00j\\x05h\\x00\\x00\\x00\\x80P\\xff\\x15\\xc0\\xd1\\x0c\\x10\\x89\\x85T\\xff\\xff\\xff\\x89]\\x80\\x89E\\x84\\x83\\xf8\\xff\\xc6E\\xfc\\x06\\x0f\\x95\\xc1\\x84\\xc9\\x0f\\x94\\xc0\\x84\\xc0t+\\xe8\\xf4\\xf8\\xfe\\xff\\x8dM\\x80\\x89]\\x80\\x8b\\xf0\\xe8`M\\xfe\\xff\\x8dM\\xe0\\xe8\\xdd\\x96\\xfd\\xffj\\x00j\\x01\\x8dM\\xc8\\xe8H~\\xfd\\xff\\xe9%" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xee\\x14\\xcd\"c@\\x00\\x80" }, { "name": "Length", "value": "16491" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "D\\xc6E\\xfc.P\\x8d\\x85\\xec\\xfa\\xff\\xff\\x8b\\xceP\\x8d\\x85\\x1c\\xfb\\xff\\xffP\\xe8x\\xbf\\x05\\x003\\xdb\\x8d\\x8d\\x1c\\xfb\\xff\\xffj\\x00CS\\xe8\\x1a\\xff\\xfc\\xffj\\x00S\\x8d\\x8d\\xec\\xfa\\xff\\xff\\xc6E\\xfc*\\xe8\\x08\\xff\\xfc\\xffh\\xd0\\x9e\\x00\\x10\\x8d\\x8d\\x8c\\xfa\\xff\\xff\\xe8\\xca\\xfb\\xfc\\xffh0U\\x00\\x10\\x8d\\x8d\\xbc\\xfa\\xff\\xff\\xc6E\\xfc/\\xe8\\xb6\\xfb\\xfc\\xff\\x8dG\\\\xc6E\\xfc0P\\x8d\\x85\\x8c\\xfa\\xff\\xff\\x8b\\xceP\\x8d\\x85\\xbc\\xfa\\xff\\xffP\\xe8\\x14\\xbf\\x05\\x00j\\x00S\\x8d\\x8d\\xbc\\xfa\\xff\\xff\\xe8\\xb9\\xfe\\xfc\\xffj\\x00S\\x8d\\x8d\\x8c\\xfa\\xff\\xff\\xe8\\xab\\xfe\\xfc\\xff\\x83\\xa5\\xa4\\xfe\\xff\\xff\\x003\\xc0\\xc7\\x85\\xa8\\xfe\\xff\\xff\\x07\\x00\\x00\\x00f\\x89\\x85\\x94\\xfe\\xff\\xffh\\xf0\\x9e\\x00\\x10\\x8d\\x8d\\x14\\xfa\\xff\\xff\\xc6E\\xfc1\\xe8O\\xfb\\xfc\\xffh0U\\x00\\x10\\x8d\\x8dD\\xfa\\xff\\xff\\xc6E\\xfc2\\xe8;\\xfb\\xfc\\xff\\x8d\\x85\\x94\\xfe\\xff\\xff\\xc6E\\xfc3P\\x8d\\x85\\x14\\xfa\\xff\\xff\\x8b\\xceP\\x8d\\x85D\\xfa\\xff\\xffP\\xe8\\x96\\xbe\\x05\\x00;\\xc3\\x0f" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "w\\xad4\\xb0\\xddF\\x00\\x80" }, { "name": "Length", "value": "18149" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x8c$P\\x01\\x00\\x00\\xe8\\xda\\xba\\xff\\xff\\x8dL$\\x1f\\xc6\\x84$\\xd8\\x01\\x00\\x00\\x07Qj\\x00\\x8d\\x8c$\\x94\\x00\\x00\\x00Qj\\x01\\xff\\xb4$<\\x01\\x00\\x00\\x8d\\x8c$0\\x01\\x00\\x00QP\\xff\\xb4$\\x1c\\x01\\x00\\x00\\x8b\\xcb\\xe8\\x1c\\x06\\x00\\x00i\\xf0\\xe8\\x03\\x00\\x00\\x8d\\x8c$L\\x01\\x00\\x00j\\x00j\\x01\\xc6\\x84$\\xe0\\x01\\x00\\x00\\x06\\x89t$(\\xe8\\xe2~\\xfc\\xff\\x85\\xf6u?\\x8b\\x83\\x8c\\x16\\x00\\x00\\x83L$ \\xff\\x83\\xc0\\x08P\\xc6D$\\x1a\\x01\\xc6D$\\x18\\x00\\xff\\x15\\xac\\xd1\\x0c\\x10\\x8b\r,\\xc1\\x0c\\x10\\xe8Q\\xd1\\xfe\\xff\\x8b\r\\x04\\xc1\\x0c\\x10\\x8d\\x84$\\xfc\\x00\\x00\\x00P\\xe8\\x13\\xe1\\xff\\xff\\xeb\\x07\\xc6\\x05Q\\xc1\\x0c\\x10\\x00\\x80|$\\x1f\\x00t\\x14QQ\\x8b\r\\x04\\xc1\\x0c\\x10\\xe8\\xe6\\xe1\\xff\\xff\\xeb\\x05\\xc6D$\\x14\\x00\\x8d\\x8c$\\x1c\\x01\\x00\\x00\\xc6\\x84$\\xd8\\x01\\x00\\x00\\x02\\xe8\\xf2\\x96\\xfc\\xffj\\x00j\\x01\\x8d\\x8c$\\x0c\\x01\\x00\\x00\\xe8\\x98|\\xfc\\xff\\x80|$\\x13\\x00\\x0f\\x84\\x87\\x01\\x00\\x00\\x83|$<\\x01\\x0f\\x84|" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1eUN\\x1a\\xdfI\\x00\\x80" }, { "name": "Length", "value": "18919" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "t.;9u\\x1f\\xffu\\x14\\x8dE\\xe8QWj\\x01P\\x8b\\xcb\\xe8\\xc2\\x05\\x00\\x00\\x8b\\x08\\x8bE\\x08\\x89\\x08\\xc6@\\x04\\x01\\xebI\\x8dM\\xec\\xe8\\xa3i\\xfd\\xff\\x8bu\\xec\\xffu\\x10\\x8dF\\x10P\\xe8\\x9e\\xfc\\xff\\xff\\xffu\\x14\\x84\\xc0t\\x1bQW\\xffu\\xe8\\x8dE\\xec\\xeb\\xc3\\xffu\\x14\\xe88f\\xfd\\xffj\\x00j\\x00\\xe8\\xd4#\\x05\\x00\\xff\\x15\\x04\\xd5\\x0c\\x10\\x8bE\\x08Y\\x890\\xc6@\\x04\\x00\\xe8\\xca#\\x05\\x00\\xc2\\x10\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\xe8\\xf6q\\xfe\\xff\\x8b\\xf0\\x8dF\\x10f\\xc7F\\x0c\\x00\\x00\\x85\\xc0t\\x12\\x8bM\\x08\\xffu\\x0c\\x8a\t\\x88\\x08\\x8dH\\x04\\xe8\\x18I\\xfd\\xff\\x8b\\xc6^]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xccj\\x0c\\xb8\\xa1E\\x0b\\x10\\xe82$\\x05\\x00\\x8b\\xd9\\x83e\\xfc\\x00\\xb1\\x01\\x8b\\x13\\x8b\\xfa\\x88M\\xe8\\x8bB\\x04\\x80x\r\\x00u!\\x8bM\\x10\\x8a):h\\x10\\x8b\\xf8\\x0f\\x92\\xc1\\x88M\\xe8\\x84\\xc9t\\x04\\x8b\\x00\\xeb\\x03\\x8b@\\x08\\x80x\r\\x00t\\xe4\\x8b\\xf7\\x89u\\xec\\x84\\xc9t" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb2\\x0c\\x1f\\x8cUG\\x00\\x80" }, { "name": "Length", "value": "18269" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x10\\x89\\x9d(\\xfd\\xff\\xff\\x89\\x85\\x0c\\xfe\\xff\\xff\\x83x\\x14\\x08\\x8bH\\x10r\\x02\\x8b\\x00P\\x8d\\x04\tPh\\xf7\\x00\\x00\\x00\\x8d\\x85$\\xfd\\xff\\xffP\\x8d\\x85\\xb4\\xfc\\xff\\xffPS\\x8d\\x85,\\xfc\\xff\\xffP\\x8dO\\x08\\xe8R*\\x03\\x00\\x8b\\x85\\x0c\\xfe\\xff\\xff\\x83\\xc0\\x18\\x83\\xad \\xfe\\xff\\xff\\x01\\x89\\x85\\x0c\\xfe\\xff\\xffu\\xb5\\x8b\\xb54\\xfe\\xff\\xffh\\x10\\xa5\\x01\\x10j\\x02j\\x18\\x8dE\\xb8\\xc6E\\xfc\\x02P\\xe8\\xf1\\x9f\\x04\\x00\\x8b\\x07\\x8a^\\x01\\x8a>\\x8bp4\\x8b\\xce\\xff\\x15\\\\xd5\\x0c\\x10\\x8b\\xcf\\xff\\xd6\\xf6\\xd8\\x1a\\xc03\\xf6\\xfe\\xc0\\x02\\xc0\n\\xc3\\x02\\xc0\n\\xc7\\x8b\\x9d4\\xfe\\xff\\xff\\x88\\x85/\\xfe\\xff\\xff\\x8dSd\\x8b\\x02\\x8b\\xc8\\x0b\\xce\\xf0\\x0f\\xb1\nu\\xf6\\x8b\\xc8\\x0f\\xb6\\x85/\\xfe\\xff\\xff\\x99\\x8b\\xf0\\xc7\\x85\\xe4\\xfc\\xff\\xff$\\xba\\x00\\x10\\x8b\\xfa\\x0f\\xb6\\xc1\\x8b\\x8d\\x10\\xfe\\xff\\xff\\x0f\\xa4\\xf7\\x08\\x99\\xc1\\xe6\\x08\\x0b\\xfa\\x0b\\xf0\\xc7\\x85\\xe8\\xfc\\xff\\xff\\x05\\x00\\x00\\x00\\x0f\\xb6C\\x02\\x8dI\\x08\\x99\\x0f\\xa4\\xf7\\x08\\xc1\\xe6\\x08\\x0b\\xfa\\x0b\\xf0\\x89" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "l\\xd9\\xb9r\\x03;\\x00\\x80" }, { "name": "Length", "value": "15115" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "2\\xfb\\xff\\xe8b$\\x04\\x00\\xc2\\x08\\x00\\x8bE\\xa4\\x8bM\\xa0\\x83\\xc0\\x18P\\xe8\\x97\\x01\\x00\\x00\\xe84_\\xfb\\xff\\x8bM\\x04\\xba\\xd2\\x02\\x00\\x00Ph`\\xce\\x00\\x10\\xe8\\xd0\\x98\\xfb\\xff\\xb8\\xc3\\xa8\\x06\\x10\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffV\\x8b\\xf1\\xffv0\\xff\\x15\\xdc\\xd4\\x0c\\x10Y\\x8b\\xce^\\xe9m\\x19\\x00\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x83\\xe4\\xf8j\\xffh!_\\x0b\\x10d\\xa1\\x00\\x00\\x00\\x00P\\x83\\xec0\\xa1\\x00\\xb0\\x0c\\x103\\xc4\\x89D$(SVW\\xa1\\x00\\xb0\\x0c\\x103\\xc4P\\x8dD$@d\\xa3\\x00\\x00\\x00\\x00\\x89L$\\x14\\x8b}\\x08\\x8dD$$\\x8b\r\\xe0\\xc0\\x0c\\x10j\\x01\\xff7P\\xe8\"!\\xfc\\xff\\x8b\r\\xe0\\xc0\\x0c\\x10\\xdd\\x810\\x01\\x00\\x00\\xdcD$$\\xdc\\x1d\\xa0N\\x01\\x10\\xdf\\xe0\\xf6\\xc4Azh\\xff7\\xe8g2\\xfc\\xff\\x84\\xc0u]\\x8b?\\x8b\\x1d\\xe0\\xc0\\x0c\\x10\\x8b\\x07\\x8bpX\\x8b\\xce\\xff\\x15\\\\xd5\\x0c\\x10\\x8b\\xcf\\xff\\xd6P\\x8b\\xcb\\xe8O\\x84\\xfc\\xff\\x84\\xc0t8\\x8b\r\\xe0\\xc0\\x0c\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd7\\xf37\\x11\\x05K\\x00\\x80" }, { "name": "Length", "value": "19213" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\xff\\xe8\\x91#\\x00\\x00\\x8b\\x85\\x14\\xff\\xff\\xffj\\x08[9\\x9d(\\xff\\xff\\xffs\\x06\\x8d\\x85\\x14\\xff\\xff\\xff\\xff\\xb5$\\xff\\xff\\xff\\x8d\\x8dD\\xff\\xff\\xffP\\xe8\\x05\\xb7\\xfa\\xff\\x8bE\\x8c9]\\xa0s\\x03\\x8dE\\x8c\\xffu\\x9c\\x8d\\x8dD\\xff\\xff\\xffP\\xe8\\xeb\\xb6\\xfa\\xffj!\\x8d\\x8dD\\xff\\xff\\xff\\xe8\\xc4\\xdd\\xff\\xff\\x8b\\x85,\\xff\\xff\\xff9\\x9d@\\xff\\xff\\xffs\\x06\\x8d\\x85,\\xff\\xff\\xff\\xff\\xb5<\\xff\\xff\\xff\\x8d\\x8dD\\xff\\xff\\xffP\\xe8\\xb8\\xb6\\xfa\\xff\\x8bE\\xd49]\\xe8s\\x03\\x8dE\\xd4\\xffu\\xe4\\x8d\\x8d\\xc0\\xfe\\xff\\xffP\\xe8\\x9e\\xb6\\xfa\\xffj!\\x8d\\x8d\\xc0\\xfe\\xff\\xff\\xe8w\\xdd\\xff\\xff\\x8b\\x85h\\xff\\xff\\xff9\\x9d|\\xff\\xff\\xffs\\x06\\x8d\\x85h\\xff\\xff\\xff\\xff\\xb5x\\xff\\xff\\xff\\x8d\\x8d\\xc0\\xfe\\xff\\xffP\\xe8k\\xb6\\xfa\\xffj\\x00j\\x01\\x8dM\\xd4\\xe9\n\\x01\\x00\\x003\\xf6F\\x89p03\\xc0\\x83e\\xcc\\x00j\\x07Y\\x89M\\xd0f\\x89E\\xbc!E\\xe4\\x89M\\xe8f\\x89E\\xd4\\x83\\xec\\x18\\xc6E\\xfc\r\\x8b\\xccS\\xe8" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "zzv\\xe0\\x98:\\x00\\x80" }, { "name": "Length", "value": "15008" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x8b\\xfa\\xe8\\xf9\\xf8\\xf9\\xffPS\\x8b\\xcf\\xe8O\\xfc\\xf9\\xff\\x83\\xfe\\x01u\n\\xbeH\\xe1\\x00\\x10\\xe9\\x82\\x00\\x00\\x00\\x83\\xfe\\x02u\\x07\\xbeP\\xe1\\x00\\x10\\xebv\\x83\\xfe\\x03u\\x07\\xbeX\\xe1\\x00\\x10\\xebj\\x83\\xfe\\x04u\\x07\\xbe\\\\xe1\\x00\\x10\\xeb^\\x83\\xfe\\x05u\\x07\\xbe`\\xe1\\x00\\x10\\xebR\\x83\\xfe\\x06u\\x07\\xbeh\\xe1\\x00\\x10\\xebF\\x83\\xfe\\x07u\\x07\\xbe\\xfc\\xe1\\x00\\x10\\xeb:\\x83\\xfe\\x08u\\x07\\xbe\\x08\\xe2\\x00\\x10\\xeb.\\x83\\xfe\tu\\x07\\xbe\\x1c\\xe2\\x00\\x10\\xeb\"\\x83\\xfe\nu\\x07\\xbe(\\xe2\\x00\\x10\\xeb\\x16\\x83\\xfe\\x0bu\\x07\\xbe8\\xe2\\x00\\x10\\xeb\n\\x83\\xfe\\x0cu\\x19\\xbeH\\xe2\\x00\\x10\\x8b\\xce\\xe8X\\xf8\\xf9\\xffPV\\x8b\\xcf\\xe8\\xae\\xfb\\xf9\\xff3\\xc0\\xeb\\x17\\x8bM\\x04\\xba\\xdd\\x01\\x00\\x00h\\x90\\x04\\x00\\x00h\\xa0S\\x00\\x10\\xe8\\xc9M\\xfa\\xff_^[Y]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecSVW\\x8b\\xf1\\x8b\\xfaj\\x08[9^\\x14r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6hp\\xe1\\x00\\x10P\\xff\\x15\\xcc\\xd4\\x0c\\x10YY\\x85" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "6\\xc5&\\xd9\\xff;\\x00\\x80" }, { "name": "Length", "value": "15367" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x1e\\x8b\\x9d|\\xff\\xff\\xff\\x8b\\xcb\\xe8t7\\x02\\x00\\x8b\\xf0\\x85\\xf6\\x0f\\x89\\xf5\\xfe\\xff\\xff\\xba\\xe4\\x00\\x00\\x00\\xebV\\x8bu\\x88\\x85\\xf6tE\\x83}\\xe8\\x08\\x8bE\\xd4s\\x03\\x8dE\\xd4\\x8b\\x8d|\\xff\\xff\\xffPh\\x9c\\xd3\\x00\\x10h\\xa0\\x0f\\x00\\x00\\x8d\\x85p\\xff\\xff\\xffP\\xe8\\xb8'\\xfc\\xffQQ\\x8b\\xd4\\x8b\\x08h\\xbc\\x02\\x00\\x00V\\x89\n\\x8b@\\x04\\x89B\\x04\\xe8TF\\x02\\x00\\x83\\xc4\\x1c\\xbeJ\\x06\\x07\\x80\\xba\\xee\\x00\\x00\\x00\\x8bM\\x04Vh\\xb0\\xed\\x00\\x10\\xe8\\xa0\\xc4\\xf9\\xffWj\\x01\\x8dM\\xd4\\xe8\\xb8~\\xf9\\xff\\x8b\\xc6\\xe9\\xdc\\x00\\x00\\x00y\\x0c\\x81\\xfer\\x02\\x07\\x80t\\x043\\xc0\\xeb\\x02\\xb0\\x01\\x84\\xc0\\x0f\\x94\\xc0\\x84\\xc0t\\x19\\x85\\xf6y\\xdc\\xba\\xf2\\x00\\x00\\x00\\x8bM\\x04Vh\\xb0\\xed\\x00\\x10\\xe8^\\xc4\\xf9\\xff\\xeb\\xc7\\x8b\\x8dt\\xff\\xff\\xff\\x8bE\\x80\\x8b}\\x88\\x85\\xc9u)\\x85\\xc0u%\\xeb\\x19\\x8b\\xcb\\xe8\\x9e6\\x02\\x00\\x8b\\xf0\\x85\\xf6y\\x07\\xba\\xf6\\x00\\x00\\x00\\xeb\\xc6\\x8bE\\x80\\x8b\\xc8\\x8bU\\x84\\xc6\\x82\\x88\\x00\\x00\\x00\\x01" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x03f\\xf7\\xcc\\x1f<\\x00\\x80" }, { "name": "Length", "value": "15399" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x03\\xa8\\xfb\\xffQQ\\x8b\\xd4\\x8b\\x08h\\xbc\\x02\\x00\\x00W\\x89\n\\x8b@\\x04\\x89B\\x04\\xe8\\x9f\\xc6\\x01\\x00\\x83\\xc4\\x14\\xba\\xa2\\x00\\x00\\x00\\x8bM\\x04\\xbfJ\\x06\\x07\\x80WhH\\x11\\x01\\x10\\xe8\\xebD\\xf9\\xff\\xe9c\\xff\\xff\\xff\\x83\\xff\\x01v@\\x8b\\xbd@\\xff\\xff\\xff\\x85\\xfft/h\\xee\\x0f\\x00\\x00\\x8d\\x854\\xff\\xff\\xff\\x8b\\xcbP\\xe8\\xa8\\xa7\\xfb\\xffQQ\\x8b\\xd4\\x8b\\x08h\\xbc\\x02\\x00\\x00W\\x89\n\\x8b@\\x04\\x89B\\x04\\xe8D\\xc6\\x01\\x00\\x83\\xc4\\x14\\xba\\xab\\x00\\x00\\x00\\xeb\\xa33\\xc0\\xeb*\\xe8\\xc8^\\xf9\\xff\\x8bM\\x04\\xba\\xb0\\x00\\x00\\x00PhH\\x11\\x01\\x10\\x89\\x85@\\xff\\xff\\xff\\xe8\\x15_\\xf9\\xff\\xb8j\\xa9\\x08\\x10\\xc3\\x8b\\x85@\\xff\\xff\\xff\\xe8\\xb5#\\x02\\x00\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xccjD\\xb8$z\\x0b\\x10\\xe8\\xea#\\x02\\x00\\x8b\\xf1\\x8b}\\x08\\x8dM\\xcc3\\xdb\\x89]\\xb0\\xe8\\xe8.\\xf9\\xff\\x8dE\\xb4\\x89]\\xfcP\\x8b\\xce\\xe8\\xd4K\\xfc\\xff\\xc6E\\xfc\\x01\\x83x\\x14\\x08\\x8bH\\x10r\\x02\\x8b\\x00hP\\xed\\x00\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x08\\xc9\\x01\\xefKB\\x00\\x80" }, { "name": "Length", "value": "16979" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "L\\xa0\\x01\\x00\\x8b\\xe5]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xccjD\\xb8$z\\x0b\\x10\\xe8\\x9a\\xa4\\x01\\x00\\x8b\\xf1\\x8b}\\x08\\x8dM\\xcc\\x83e\\xb0\\x00\\xe8\\x99\\xaf\\xf8\\xff\\x83e\\xfc\\x00\\x8dE\\xb4P\\x8b\\xce\\xe8\\x84\\xcc\\xfb\\xff\\xc6E\\xfc\\x01\\x83x\\x14\\x08\\x8bH\\x10r\\x02\\x8b\\x00\\xbbP\\xed\\x00\\x10SQP\\x8dM\\xcc\\xe8\\xd9\\xb6\\xf8\\xff\\x8b\\xc8\\xe8>\\xb7\\xf8\\xffj\\x00j\\x01\\x8dM\\xb4\\xc6E\\xfc\\x00\\xe8\\xd4~\\xf8\\xffh\\xb8$\\x01\\x10\\x8dM\\xcc\\xe8!\\xb7\\xf8\\xffS\\x8dFXPh\\xe8$\\x01\\x10\\x8dM\\xcc\\xe8\\x0f\\xb7\\xf8\\xff\\x8b\\xc8\\xe8y\\xb6\\xf8\\xff\\x8b\\xc8\\xe8\\x01\\xb7\\xf8\\xffS\\x8dFpPh\\xfc$\\x01\\x10\\x8dM\\xcc\\xe8\\xef\\xb6\\xf8\\xff\\x8b\\xc8\\xe8Y\\xb6\\xf8\\xff\\x8b\\xc8\\xe8\\xe1\\xb6\\xf8\\xff\\x8dE\\xcc\\x8b\\xcfP\\xe8\\xba\\xbe\\xf8\\xffj\\x00j\\x01\\x8dM\\xcc\\xe8p~\\xf8\\xff\\x8b\\xc7\\xe8y\\xa3\\x01\\x00\\xc2\\x04\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\xa1\\xd8\\xc1\\x0c\\x10\\xb9\\xd8\\xc1\\x0c\\x10\\xffp\\x04\\xe8\\xbb\\x00\\x00\\x00\\xa1\\xd8\\xc1\\x0c\\x10\\x89@\\x04\\xa1" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x95\\xc5T\\x86\\xf5B\\x00\\x80" }, { "name": "Length", "value": "17149" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "]\\x0c\\x0f\\x8e\\x8b\\x00\\x00\\x00\\x8b\\x8f\\xb4\\x16\\x00\\x00\\x0f\\xb6\\x83\\x848\\x01\\x10\\x83\\xf9\r~T\\x0f\\xb7\\xb4\\x87v\n\\x00\\x00\\x8bW\\x14f\\x8b\\xc6f\\xd3\\xe0f\t\\x87\\xb0\\x16\\x00\\x00\\x8bO\\x08\\x8a\\x87\\xb0\\x16\\x00\\x00\\x88\\x04\n\\xffG\\x14\\x8bW\\x14\\x8bO\\x08\\x8a\\x87\\xb1\\x16\\x00\\x00\\x88\\x04\n\\xb1\\x10*\\x8f\\xb4\\x16\\x00\\x00\\xffG\\x14f\\xd3\\xee\\x83\\x87\\xb4\\x16\\x00\\x00\\xf3f\\x89\\xb7\\xb0\\x16\\x00\\x00\\xeb\\x1bf\\x8b\\x84\\x87v\n\\x00\\x00f\\xd3\\xe0f\t\\x87\\xb0\\x16\\x00\\x00\\x8dA\\x03\\x89\\x87\\xb4\\x16\\x00\\x00C;]\\x0c\\x0f\\x8cu\\xff\\xff\\xff\\x8bE\\xfc\\x8d\\x97\\x8c\\x00\\x00\\x00H\\x8b\\xcfP\\xe8\\x9f\\xf8\\xff\\xff\\x8bE\\x08\\x8d\\x97\\x80\t\\x00\\x00H\\x8b\\xcfP\\xe8\\x8d\\xf8\\xff\\xff_^[\\x8b\\xe5]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecSW\\x8b\\xf9\\x8b\\xda\\x8b\\x8f\\xb4\\x16\\x00\\x00\\x83\\xf9\r~Q\\x8bW\\x08V\\x8bu\\x0cf\\x8b\\xc6f\\xd3\\xe0f\t\\x87\\xb0\\x16\\x00\\x00\\x8bO\\x14\\x8a\\x87\\xb0\\x16\\x00\\x00\\x88\\x04\n\\xffG\\x14\\x8b" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc0YS1\\xdbG\\x00\\x80" }, { "name": "Length", "value": "18403" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "x\r\\x00t\\x04\\x8b\\xf9\\xeb\n\\x8bU\\x0c\\x8bz\\x08;\\xd3ut\\x80\\x7f\r\\x00\\x8bs\\x04u\\x03\\x89w\\x04\\x8bU\\xfc\\x8b\\x029X\\x04u\\x05\\x89x\\x04\\xeb\\x0b9\\x1eu\\x04\\x89>\\xeb\\x03\\x89~\\x08\\x8b\\x029\\x18u\\x1e\\x80\\x7f\r\\x00t\\x04\\x8b\\xc6\\xeb\\x10\\x8b\\x0f\\x8b\\xc7\\xeb\\x04\\x8b\\xc1\\x8b\\x08\\x80y\r\\x00t\\xf6\\x8b\n\\x89\\x01\\x8b\\x029X\\x08u\\x7f\\x80\\x7f\r\\x00t\\x04\\x8b\\xc6\\xeb\\x12\\x8bO\\x08\\x8b\\xc7\\xeb\\x05\\x8b\\xc1\\x8bH\\x08\\x80y\r\\x00t\\xf5\\x8b\n\\x89A\\x08\\xeb\\\\x89Q\\x04\\x8b\\x03\\x89\\x02;S\\x08u\\x04\\x8b\\xf2\\xeb\\x1a\\x80\\x7f\r\\x00\\x8br\\x04u\\x03\\x89w\\x04\\x89>\\x8bC\\x08\\x89B\\x08\\x8bC\\x08\\x89P\\x04\\x8bM\\xfc\\x8b\\x019X\\x04u\\x05\\x89P\\x04\\xeb\\x0e\\x8bC\\x049\\x18u\\x04\\x89\\x10\\xeb\\x03\\x89P\\x08\\x8bC\\x04\\x89B\\x04\\x8aJ\\x0c\\x8aC\\x0c\\x88B\\x0c\\x8bU\\xfc\\x88K\\x0c\\x80{\\x0c\\x01\\x0f\\x85\\x0b\\x01\\x00\\x00\\xe9\\xbf\\x00\\x00\\x00\\x80\\x7f\\x0c\\x01\\x0f\\x85\\xf8\\x00\\x00\\x00\\x8b\\x0e;\\xf9" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\x94\\xe2a\\xf8;\\x00\\x80" }, { "name": "Length", "value": "15360" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\xf1\\x83\\xea\\x01t8\\x83\\xea\\x01t,\\x83\\xea\\x01t\\x1d\\x83\\xea\\x01u.\\x8bE\\x08\\x0bE\\x0ct&\\xffu\\x0c\\xffu\\x08R\\xff6\\xe8\\x85+\\x00\\x00\\xeb\\x06\\x8b\\x06\\x0f\\xafE\\x08\\x89\\x06\\xeb\\x0c\\x8bE\\x08)\\x06\\xeb\\x05\\x8bE\\x08\\x01\\x06^]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8b\\xf1\\x83\\xea\\x01tM\\x83\\xea\\x01t;\\x83\\xea\\x01t\\x1f\\x83\\xea\\x01uI\\x8bE\\x08\\x0bE\\x0ctA\\xffu\\x0c\\xffu\\x08\\xffv\\x04\\xff6\\xe8\\x0f-\\x00\\x00\\xeb\\x10\\xffu\\x0c\\xffu\\x08\\xffv\\x04\\xff6\\xe8\\xcd+\\x00\\x00\\x89\\x06\\x89V\\x04\\xeb\\x18\\x8bE\\x08)\\x06\\x8bE\\x0c\\x19F\\x04\\xeb\\x0b\\x8bE\\x08\\x01\\x06\\x8bE\\x0c\\x11F\\x04^]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8b\\xf1\\x83\\xea\\x01tA\\x83\\xea\\x01t5\\x83\\xea\\x01t\"\\x83\\xea\\x01u7\\x8bE\\x08\\x0bE\\x0ct/\\xffu\\x0c\\x0f\\xbe\\x06\\xffu\\x08\\x99RP\\xe8\\xbf*\\x00\\x00\\x88\\x06\\xeb\\x1a\\x0f\\xbe\\x0e\\x0f\\xbeE\\x08\\x0f\\xaf\\xc8\\x88" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfdm&\\xef\\xbb3\\x00\\x80" }, { "name": "Length", "value": "13251" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x8d\\x84\\xfc\\xff\\xff\\xe9F|\\xf6\\xff\\x8d\\x8dt\\xfa\\xff\\xff\\xe9;|\\xf6\\xff\\x8d\\x8dT\\xfc\\xff\\xff\\xe90|\\xf6\\xff\\x8d\\x8d\\x04\\xfb\\xff\\xff\\xe9%|\\xf6\\xff\\x8d\\x8dT\\xff\\xff\\xff\\xe9\\x1a|\\xf6\\xff\\x8d\\x8d$\\xfc\\xff\\xff\\xe9\\x0f|\\xf6\\xff\\x8d\\x8d\\xfc\\xf9\\xff\\xff\\xe9\\x04|\\xf6\\xff\\x8d\\x8d\\xc4\\xfe\\xff\\xff\\xe9\\xf9{\\xf6\\xff\\x8d\\x8d\\xf4\\xfb\\xff\\xff\\xe9\\xee{\\xf6\\xff\\x8d\\x8d\\xd4\\xfa\\xff\\xff\\xe9\\xe3{\\xf6\\xff\\x8d\\x8d\\xf4\\xfe\\xff\\xff\\xe9\\xd8{\\xf6\\xff\\x8d\\x8d\\xc4\\xfb\\xff\\xff\\xe9\\xcd{\\xf6\\xff\\x8d\\x8d,\\xfa\\xff\\xff\\xe9\\xc2{\\xf6\\xff\\x8d\\x8d$\\xff\\xff\\xff\\xe9\\xb7{\\xf6\\xff\\x8d\\x8d\\x94\\xfb\\xff\\xff\\xe9\\xac{\\xf6\\xff\\x8d\\x8d\\xa4\\xfa\\xff\\xff\\xe9\\xa1{\\xf6\\xff\\x8d\\x8d<\\xff\\xff\\xff\\xe9\\x96{\\xf6\\xff\\x8d\\x8d,\\xfd\\xff\\xff\\xe9\\x8b{\\xf6\\xff\\x8d\\x8dD\\xfd\\xff\\xff\\xe9\\x80{\\xf6\\xff\\x8d\\x8d\\xac\\xfe\\xff\\xff\\xe9u{\\xf6\\xff\\x8d\\x8dd\\xfb\\xff\\xff\\xe9j{\\xf6\\xff\\x8d\\x8d\\xcc\\xf9\\xff\\xff\\xe9_{\\xf6\\xff\\x8d\\x8d\\x0c\\xff\\xff\\xff\\xe9T{\\xf6\\xff\\x8d\\x8d\\xfc\\xfc" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-28 22:52:59,631", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1b\\x97\\x94\\xe3s \\x00\\x80" }, { "name": "Length", "value": "8315" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xffK\\xda\n\\x10\\x00\\x00\\x00\\x00d\\xda\n\\x10\\x01\\x00\\x00\\x00o\\xda\n\\x10\"\\x05\\x93\\x19\\x01\\x00\\x00\\x00\\x10\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x9a\\xda\n\\x10\"\\x05\\x93\\x19\\x03\\x00\\x00\\x00<\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xc5\\xda\n\\x10\\x00\\x00\\x00\\x00\\xcd\\xda\n\\x10\\x01\\x00\\x00\\x00\\xd8\\xda\n\\x10\"\\x05\\x93\\x19\\x03\\x00\\x00\\x00x\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x06\\xdb\n\\x10\\x00\\x00\\x00\\x00\\x0e\\xdb\n\\x10\\x01\\x00\\x00\\x00\\x19\\xdb\n\\x10\"\\x05\\x93\\x19\\x01\\x00\\x00\\x00\\xb4\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xffG\\xdb\n\\x10\"\\x05\\x93\\x19" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8e\\xa1U\\x878 \\x00\\x80" }, { "name": "Length", "value": "8256" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x02\\x00\\x00\\x00\\xe0(\\x0c\\x10\\x01\\x00\\x00\\x00\\xf0(\\x0c\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04)\\x0c\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\xa8\\x05\\x10\"\\x05\\x93\\x19\\x02\\x00\\x00\\x008)\\x0c\\x10\\x01\\x00\\x00\\x00H)\\x0c\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\)\\x0c\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\xa9\\x05\\x10\"\\x05\\x93\\x19\\x02\\x00\\x00\\x00\\x90)\\x0c\\x10\\x01\\x00\\x00\\x00\\xa0)\\x0c\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb4)\\x0c\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa1$7B\\xa5\\x1f\\x00\\x80" }, { "name": "Length", "value": "8109" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x004?\\x00\\x10\\x00\\x00\\x00\\x000\\x8b\\x00\\x10\\x14\\x8b\\x00\\x10\\x04\\x8b\\x00\\x10\\xd4\\x8a\\x00\\x10\\xa0\\x8a\\x00\\x10h\\x8a\\x00\\x100\\x8a\\x00\\x10\\xf8\\x89\\x00\\x10\\xdc\\x89\\x00\\x10\\xbc\\x89\\x00\\x10\\x9c\\x89\\x00\\x10`\\x89\\x00\\x10$\\x89\\x00\\x10\\xec\\x88\\x00\\x10\\xdc\\x88\\x00\\x10\\xa8\\x88\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb0\\x10\\xbc\\xf0k?\\x00\\x80" }, { "name": "Length", "value": "16243" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "c\\x00e\\x00I\\x00d\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00H\\x00R\\x00E\\x00S\\x00U\\x00L\\x00T\\x00\\x00\\x00TEMP\\x14\\x03\\x00\\x00\\x06\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xfcH\\x00\\x00\\x01\\x00\\x00\\x00\\xbd\\x0c\n\\xaf8\\xb1/\\x8c\\xf3\\xd5'\\x82\\xebw\\xcd\\xda\\x0f\\x01\\x01\\x00\\x01\\xff\\xff\\xc0\\x01\\x00\\x00D\\x82\t\\x00E\\x00v\\x00e\\x00n\\x00t\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00\\x02A\\xff\\xff?\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00'\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\n\\x00S\\x00c\\x00e\\x00n\\x00a\\x00r\\x00i\\x00o\\x00I\\x00d\\x00\\x02\r\\x00\\x00\\x0f\\x04A\\xff\\xffO\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x007\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\\x12\\x00S\\x00c\\x00e\\x00n\\x00a\\x00r\\x00i\\x00o\\x00I\\x00n\\x00s\\x00t\\x00a\\x00n\\x00c\\x00e\\x00I\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x958\\x82\\x0fVV\\x00\\x80" }, { "name": "Length", "value": "22110" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "Buffer", "value": "33S3c3\\x903\\xfb374K4\\xc84\\xdd4\\x065W5h5~5\\xb15\\xc55,6V6g6z6\\xd56\\x13717\\x987\\xba7u8\\x878\\xa38\\xe98\\xf38\\x079$939A9_9o9\\x7f9\\x999\\xa69\\xbc9\\xe19!:0:?:T:{:\\x8a:\\x94:\\xa9:\\xd1:\\xe3:\\xf4:\";a;\\x0b<:<\t=j=\\xa4=\\xb3=\\xc1=\\xe0=\\x99>\\xa4>\\xde>\t?\\x14?A?\\x97?\\xad?\\xbf?\\xe2?\\x00\\x00\\x00\\xb0\\x06\\x00\\xdc\\x00\\x00\\x00\\x120\\x1c040D0n0\\xa40\\xcd0\\xef0\\x0c1\\x1e1(1@1R1r1\\x821\\x901\\xc61\\xf41\\x13282Z2j2\\x832\\x942\\xa12\\xc72\t3\\x163/3C3\\x883\\xa23\\xb93\\xd03\\x064\\x1a4A4Z4g4\\x854\\x964\\xb74\\x0b5\\x1a5O5\\xcd5\\xe85\\xf55\\x18676O6`6" }, { "name": "Length", "value": "30880" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\xccfyt\\x89\\xd6\\x01\\x00\\xccfyt\\x89\\xd6\\x01\\x00\\xccfyt\\x89\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "%9\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1169 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "DiagTrackRunner.exe\\x00@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02 Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89 setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02 setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dl" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "99\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc04\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1174 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\xc04\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\xc04\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\xd0\\xba\\xb5S\\xb1\\xd4\\xe6S\\xb1\\xd4\\xe6S\\xb1\\xd4\\xe6\\xe7-%\\xe6P\\xb1\\xd4\\xe6\\xe7-&\\xe6F\\xb1\\xd4\\xe6\\xe7-'\\xe6U\\xb1\\xd4\\xe6\\xe7-;\\xe6X\\xb1\\xd4\\xe6S\\xb1\\xd5\\xe6\\x1b\\xb1\\xd4\\xe6\\xe7-#\\xe6R\\xb1\\xd4\\xe6\\xe7-9\\xe6R\\xb1\\xd4\\xe6\\xe7-$\\xe6R\\xb1\\xd4\\xe6RichS\\xb1\\xd4\\xe6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x05\\x00Y\\xd12V\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r" }, { "name": "Length", "value": "1888" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x90p5\t\\xe25\\x00\\x80" }, { "name": "Length", "value": "13802" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00permission denied\\x00\\x00\\x00file exists\\x00no such device\\x00\\x00filename too long\\x00\\x00\\x00device or resource busy\\x00io error\\x00\\x00\\x00\\x00directory not empty\\x00invalid argument\\x00\\x00\\x00\\x00no space on device\\x00\\x00no such file or directory\\x00\\x00\\x00function not supported\\x00\\x00no lock available\\x00\\x00\\x00not enough m" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x95\\xb8\\x9e/\\xfe\"\\x00\\x80" }, { "name": "Length", "value": "8966" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "Buffer", "value": "\\x10\\x00S\\x00i\\x00n\\x00k\\x00S\\x00t\\x00a\\x00t\\x00e\\x00O\\x00r\\x00d\\x00i\\x00n\\x00a\\x00l\\x00\\x02\r\r\\x00\\x04\\x04A\\xff\\xffU\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00=\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\\x15\\x00P\\x00e\\x00r\\x00f\\x00T\\x00r\\x00a\\x00c\\x00k\\x00S\\x00c\\x00e\\x00n\\x00a\\x00r\\x00i\\x00o\\x00N\\x00a\\x00m\\x00e\\x00\\x02\r\\x0e\\x00\\x01\\x04A\\xff\\xffW\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00?\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\\x16\\x00P\\x00e\\x00r\\x00f\\x00T\\x00r\\x00a\\x00c\\x00k\\x00D\\x00u\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00F\\x00i\\x00e\\x00l\\x00d\\x00\\x02\r\\x0f\\x00\\x01\\x04A\\xff\\xffE\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00-\\x00\\x00\\x00\\x06K\\x95\\x04\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "a\\xa0\\xc9\\x91\\x00>\\x00\\x80" }, { "name": "Length", "value": "15880" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "Buffer", "value": "\\x9e\\xac\n\\xfb\\x13'@\\xad\\xe4\\xf9\\xe1\\xa9\\x7fF\\xbb\\x07`Ge`@N\\xb0B\\xecN\\xed\\xb3vy\\xd8\n4\tm\\x1c\\x801\\x1f\\xe2\\x0eT\\xdd\\xe5\\xa1\\xfb\\xe5G\\x10\\xadd\\x98\\xffP\\x16.|\\xbf\\x05!z\\xe2\\x95A'i\\xc3\\x93\\x8f\\x95\\xc9\\x8d\\xd8\\x9b!\\xae\r\\\\x9c\\xf0\\xa2\\xae\\x86h\\x83\\x0cj-\\xbbvk\\x00\\x1d\\x96\\xad\\xf2\\x16{\\xf6\\x16\\x83$\\xb9\\x88\\xcfj\\xa8G1/\\x9a\\xdc\\xe3q=\\xd7\\x00~bG\\xd1\\xce\\x88\\xc9\\xb8\\x18\\xfa\\x0er\\x8d\\xc1\\xa3=\\xaf\\x02@j\\xffi\\x9b\\x96\\xe2\\x10\\xa8\\x10\\xb47P\\x08\\xd6\\xc3=0\\x82\\x06\\x070\\x82\\x03\\xef\\xa0\\x03\\x02\\x01\\x02\\x02\na\\x16h4\\x00\\x00\\x00\\x00\\x00\\x1c0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x000_1\\x130\\x11\\x06\n\t\\x92&\\x89\\x93\\xf2,d\\x01\\x19\\x16\\x03com1\\x190\\x17\\x06\n\t\\x92&\\x89\\x93\\xf2,d\\x01\\x19\\x16\tmicrosoft1-0+\\x06\\x03U\\x04\\x03\\x13$Mic" }, { "name": "Length", "value": "11616" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\xf9\\x97zt\\x89\\xd6\\x01\\x00\\xf9\\x97zt\\x89\\xd6\\x01\\x00\\xf9\\x97zt\\x89\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "I9\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1188 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89 setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02 setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "T9\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\xa3\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1193 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "@\\xa3\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "@\\xa3\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x8fZ\\xc5,\\xee4\\x96,\\xee4\\x96,\\xee4\\x968\\x857\\x97.\\xee4\\x968\\x850\\x97\"\\xee4\\x96,\\xee5\\x96\\x8c\\xee4\\x968\\x855\\x97#\\xee4\\x968\\x851\\x97)\\xee4\\x968\\x854\\x97-\\xee4\\x968\\x85=\\x97%\\xee4\\x968\\x85\\xcb\\x96-\\xee4\\x968\\x856\\x97-\\xee4\\x96Rich,\\xee4\\x96\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00" }, { "name": "Length", "value": "21152" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xea\\x14\\x9f\\xfec>\\x00\\x80" }, { "name": "Length", "value": "15979" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "Buffer", "value": "\\xe0\\x01\\xc7E\\xfc\\xfe\\xff\\xff\\xff\\x8bM\\xf0d\\x89\r\\x00\\x00\\x00\\x00Y_^[\\x8b\\xe5]\\xc3\\x8bE\\xec\\x8b\\x003\\xc9\\x818\\x05\\x00\\x00\\xc0\\x0f\\x94\\xc1\\x8b\\xc1\\xc3\\x8be\\xe8\\xc7E\\xfc\\xfe\\xff\\xff\\xff3\\xc0\\x8bM\\xf0d\\x89\r\\x00\\x00\\x00\\x00Y_^[\\x8b\\xe5]\\xc3\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x8bM\\x08\\xb8MZ\\x00\\x00f9\\x01u\\x1f\\x8bA<\\x03\\xc1\\x818PE\\x00\\x00u\\x12\\xb9\\x0b\\x01\\x00\\x00f9H\\x18u\\x07\\xb8\\x01\\x00\\x00\\x00]\\xc33\\xc0]\\xc3\\x8b\\xffU\\x8b\\xec\\x83\\xec\\x14\\x83e\\xf4\\x00\\x83e\\xf8\\x00\\xa1Dp\\x00\\x10VW\\xbfN\\xe6@\\xbb\\xbe\\x00\\x00\\xff\\xff;\\xc7t\\x04\\x85\\xc6ud\\x8dE\\xf4P\\xff\\x15H\\x80\\x00\\x10\\x8bE\\xf83E\\xf4\\x89E\\xfc\\xff\\x15D\\x80\\x00\\x101E\\xfc\\xff\\x15\\x08\\x81\\x00\\x101E\\xfc\\xff\\x15 \\x80\\x00\\x103E\\xfc\\x8dM\\xfc3\\xc1\\x89E\\xfc\\x8dE\\xecP\\xff\\x15@\\x80\\x00\\x10\\x8bE\\xf03E\\xec3E\\xfc\\x8b\\xc8;\\xc7t\\x08\\x855D" }, { "name": "Length", "value": "20640" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Diager.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00{\\xfecC\\x9d\\xd6\\x01\\x00{\\xfecC\\x9d\\xd6\\x01\\x00{\\xfecC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "d9\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1203 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02 setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "v9\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-28 22:52:59,647", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1208 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "Buffer", "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi" }, { "name": "Length", "value": "10452" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x0b\\x18*Q\\x98\\xd6\\x01\\x00\\x0b\\x18*Q\\x98\\xd6\\x01\\x00\\x0b\\x18*Q\\x98\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x869\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1216 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 " }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x989\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\xe9m\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1221 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "H\\xe9m\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "H\\xe9m\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90& \\x94\\xd4GN\\xc7\\xd4GN\\xc7\\xd4GN\\xc7\\xdd?\\xdd\\xc7\\xd6GN\\xc7\\xc0,M\\xc6\\xd9GN\\xc7\\xc0,J\\xc6\\xc0GN\\xc7\\xd4GO\\xc7$BN\\xc7\\xc0,O\\xc6\\xe1GN\\xc7\\xc0,K\\xc6\\xdaGN\\xc7\\xc0,N\\xc6\\xd5GN\\xc7\\xc0,G\\xc6\\xfaEN\\xc7\\xc0,\\xb1\\xc7\\xd5GN\\xc7\\xc0,L\\xc6\\xd5GN\\xc7Rich\\xd4GN\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00\\x15\\x1d\\x87\\x8e\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "1676" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc5\\x15\\xd5\\xdf\\x00*\\x00\\x80" }, { "name": "Length", "value": "10760" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": " \\xc2V\\x10\\\\xab\\x02\\x10\\xd0\\x0f\\x1f\\x10\\xe8\\xab\\x02\\x10\\xe0\\xe2\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\xfc\\xab\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x10\\xac\\x02\\x10P\\x0e\\x1f\\x10\\x9c\\xac\\x02\\x10\\x10\\xd1\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\xb0\\xac\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\xc4\\xac\\x02\\x10\\xd0\\x0c\\x1f\\x10P\\xad\\x02\\x10\\x80\\xb7\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10d\\xad\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10x\\xad\\x02\\x10P\\x0b\\x1f\\x10\\x04\\xae\\x02\\x10P\\xa6\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\x18\\xae\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd6\\xb2^\\xe1\\x9f#\\x00\\x80" }, { "name": "Length", "value": "9127" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "`y\\x03\\x10\\x80R'\\x10pS'\\x10`S'\\x10ty\\x03\\x10\\x80\\xb8\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x88y\\x03\\x10`\\xa5\\x1f\\x10\\x10\\xa5\\x1f\\x10\\xb0\\xa6\\x1f\\x10\\xb0\\xa6\\x1f\\x10\\xa0\\xa3\\x1f\\x10`P'\\x10\\x00\\xa4\\x1f\\x10P\\xa7\\x1f\\x10\\xb0\\xa8\\x1f\\x10\\x00O'\\x10\\x90R'\\x10pW'\\x10\\x9cy\\x03\\x10`\\xa8\\x1f\\x10\\xc0\\xa6\\x1f\\x10\\xb0y\\x03\\x10\\xc0\\xa3\\x1f\\x10\\xc4y\\x03\\x10@U'\\x10\\xb0T'\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10PS'\\x10\\xd8y\\x03\\x10@\\xda\\x1b\\x10@\\xd7\\x1b\\x10p\\xda\\x1b\\x10\\x90\\xda\\x1b\\x10\\xc0\\xda\\x1b\\x10\\xf0\\xda\\x1b\\x10 \\xdb\\x1b\\x10 \\xdb\\x1b\\x10\\xb0A'\\x10\\xe0j\\x1b\\x10\\x00z\\x03\\x10\\x00P'\\x10\\xf0W'\\x10\\xa0O'\\x10\\x14z\\x03\\x10\\x80\\xb8\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "+\\xc8X\\x15\\x81\\x1b\\x00\\x80" }, { "name": "Length", "value": "7049" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "0>2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\x04\\x7f\\x04\\x10p<2\\x10\\x90\\x7f\\x04\\x10p;2\\x10\\xa4\\x7f\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x08\\x80\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x1c\\x80\\x04\\x10\\x10>2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\x80\\x80\\x04\\x10\\xd0>2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10D\\x80\\x04\\x10p:2\\x10\\xd0\\x80\\x04\\x10p92\\x10\\xa8\\x80\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10H\\x81\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x0c\\x81\\x04\\x10 >2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\xac\\x81\\x04\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xff9\\xc7\\x8fR-\\x00\\x80" }, { "name": "Length", "value": "11610" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10p\\x87\\x05\\x10@\\xbbV\\x10@\\xbbV\\x10@\\xbbV\\x10(\\x89\\x05\\x10\\xd0\\xa1B\\x10<\\x89\\x05\\x10`\\xb6\\x1f\\x10\\xf0\\x9fB\\x104\\x87\\x05\\x10\\xd0\\x8eB\\x10H\\x87\\x05\\x100\\x8fB\\x10\\x00\\x89\\x05\\x10`\\xb6\\x1f\\x10\\x90\\xa0B\\x10\\x14\\x89\\x05\\x10\\x90\\xbd\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10d\\x89\\x05\\x10\\x90\\xbd\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10x\\x89\\x05\\x10\\xa0\\xa0B\\x10\\xb4\\x89\\x05\\x100\\xa1B\\x10p\\xa0B\\x10\\xb0\\xa0B\\x10P\\x89\\x05\\x10\\x80\\xa9\\x1f\\x10\\xb0\\xa1B\\x10\\xc0\\xa1B\\x10\\xa0\\x89\\x05\\x100\\x8eB\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10h\\x8a\\x05\\x10 \\xa2B\\x10|\\x8a\\x05\\x10`\\xb6\\x1f\\x10\\x00\\xa2B\\x10@\\x8a\\x05\\x10`\\xb6\\x1f\\x10\\x00\\xa1B\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb0\\xa2*\\x7fT\\x19\\x00\\x80" }, { "name": "Length", "value": "6492" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00(a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00Da\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00`a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00|a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00\\x98a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00\\x08b\\x02\\x10\\x1c\\x05\\x03\\x10\\xeca\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10\\xd0a\\x02\\x10\\xeca\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10\\x00\\x05\\x03\\x10\\x1c\\x05\\x03\\x10\\xb4a\\x02\\x10\\x1c\\x05\\x03\\x10\\x00\\x05\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\x94b\\x02\\x10xb\\x02\\x10\\b\\x02\\x10$\\x85\\x02\\x10@b\\x02\\x10@b\\x02\\x10\\x9c\\x83\\x02\\x10$\\x85\\x02\\x10$b\\x02\\x10$\\x85\\x02\\x10\\x9c\\x83\\x02\\x10$\\x85\\x02\\x10\\x00\\x00\\x00\\x00\\xb0b\\x02\\x10\\x1c\\x05\\x03\\x10l\\x04\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xe8b\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "b\\x95\\x13!\\xa0\\x1a\\x00\\x80" }, { "name": "Length", "value": "6824" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xd4\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xf4\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00p\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x84\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x90\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x98\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xbc\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xa4\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd0\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe4\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00`\\x04\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x07\\x00\\x00\\x00@\\x04\\x02\\x10\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "P\\xd5.t\\xa1\\x1a\\x00\\x80" }, { "name": "Length", "value": "6825" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00p*\\x03\\x10\\x1c\\x05\\x03\\x10T*\\x03\\x10\\x00\\x00\\x00\\x00\\x8c*\\x03\\x10\\x00\\x00\\x00\\x00\\xa8*\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xc4*\\x03\\x10\\x00\\x00\\x00\\x00\\xfc*\\x03\\x10\\x1c\\x05\\x03\\x10\\xe0*\\x03\\x10\\x1c\\x05\\x03\\x10\\x18+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10P+\\x03\\x10\\x18+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10P+\\x03\\x10\\xc8\\x85\\x02\\x10\\x00\\x00\\x00\\x004+\\x03\\x10\\x1c\\x05\\x03\\x10\\x18+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10P+\\x03\\x10\\x00\\x00\\x00\\x00l+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10\\x00\\x00\\x00\\x00\\x88+\\x03\\x10\\x00\\x00\\x00\\x00\\xa4+\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xc0+\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xf8+\\x03\\x10\\x1c\\x05\\x03\\x10\\xdc+\\x03\\x10\\x1c\\x05\\x03\\x10\\x14,\\x03\\x10\\x1c\\x05\\x03\\x10L,\\x03\\x10L,\\x03\\x10\\x14,\\x03\\x10\\x1c\\x05\\x03\\x10L,\\x03\\x10L,\\x03\\x10\\xc8\\x85\\x02\\x10\\x00\\x00\\x00\\x000,\\x03\\x10\\x1c\\x05\\x03\\x10\\x14,\\x03\\x10\\x1c\\x05\\x03\\x10L,\\x03\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xba=\\xc5\\x88\\xad\\x1b\\x00\\x80" }, { "name": "Length", "value": "7093" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x04\\x00\\x00\\x00\\x08\\x00\\x00\\x00P\\x00\\x00\\x00\\x18\\xa1\\x03\\x10\\xd8D`\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00(\\xa1\\x03\\x10\\x98D`\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x18\\xa1\\x03\\x10\\x08E`\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x008\\xa1\\x03\\x10\\x8cE`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00H\\xa1\\x03\\x10\\xc0E`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00X\\xa1\\x03\\x10\\xf8E`\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00h\\xa1\\x03\\x10\\x80F`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00x\\xa1\\x03\\x10xG`\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x98\\xa1\\x03\\x10\\x00G`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x89\\x10\\xff\\x02\\xad\\x1a\\x00\\x80" }, { "name": "Length", "value": "6837" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\xe0\\xc6`\\x10\\x03\\x00\\x00\\x00\\x90\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd4\\x14\\x04\\x10\\xe0\\xc6`\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd4\\x14\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00$\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x14\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00d\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00,\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x80\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00x\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x8c\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xe8\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00\\xa8\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xf8\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x08\\x0b\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xdaV\\x03w.\\x1d\\x00\\x80" }, { "name": "Length", "value": "7478" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00@\\x00\\x00\\x00L\\x94\\x04\\x10,Fa\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00<\\x94\\x04\\x10XHa\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x1c\\x94\\x04\\x10PEa\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xec\\x93\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xac\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xbc\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb4\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc4\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x10\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x008\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfc\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00L\\x8e\\x04\\x10" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x08\\x02\\xfa\\xee\\x9d\\x1c\\x00\\x80" }, { "name": "Length", "value": "7333" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "@\\x00\\x00\\x00\\x10,\\x05\\x10\\xe0\\x1db\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xc0+\\x05\\x10@\\x1db\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xf0+\\x05\\x10\\xa0!b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00 ,\\x05\\x10\\x00!b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00P,\\x05\\x10` b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00,\\x05\\x10\\xc0\\x1fb\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x000,\\x05\\x10 $b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00`,\\x05\\x10\\x80#b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x90,\\x05\\x10\\xe0\"b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "N\\x9d\\x18\\xfaP\"\\x00\\x80" }, { "name": "Length", "value": "8792" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xb8\\x96\\x05\\x10\\xecdc\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xa8\\x96\\x05\\x10\\xd0cc\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x98\\x96\\x05\\x10\\x94ec\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x18\\x97\\x05\\x10(ec\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xf8\\x96\\x05\\x10\\xbcec\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xe8\\x96\\x05\\x10\\xb8dc\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd8\\x96\\x05\\x10\\xd8gc\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00h\\x97\\x05\\x10Lfc\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00(\\x97\\x05\\x10\\xf4ec\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9e\\x9b\\xce\\xc6\\x9a,\\x00\\x80" }, { "name": "Length", "value": "11426" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xed\\x8e\\x8c\\xb3\\\\x0e\\x00\\x80" }, { "name": "Length", "value": "3684" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa2\\xa1\\xd6\\xb3\\xec\\x08\\x00\\x80" }, { "name": "Length", "value": "2292" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\n\\xda#r\\x8d\\x14\\x00\\x80" }, { "name": "Length", "value": "5269" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf0\\xb0\\xbbs\\xbb\\x1d\\x00\\x80" }, { "name": "Length", "value": "7619" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbb\\xa1#\\x12'\\x10\\x00\\x80" }, { "name": "Length", "value": "4143" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x89\\xf6\\x82\\xa32\\x10\\x00\\x80" }, { "name": "Length", "value": "4154" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8c\\xdb\\xab\\xbf\\x8e\\x18\\x00\\x80" }, { "name": "Length", "value": "6294" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8b\\xca\\xb1\\xc1\\x1e\\x18\\x00\\x80" }, { "name": "Length", "value": "6182" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "%'J~$\\x18\\x00\\x80" }, { "name": "Length", "value": "6188" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "7\\xe0\\x9e\\xd3\\x80\\x14\\x00\\x80" }, { "name": "Length", "value": "5256" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "D\\xba\\x8f\\xd9-\\x04\\x00\\x80" }, { "name": "Length", "value": "1077" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "|\\x18\\xe1Q\\x97\\x1b\\x00\\x80" }, { "name": "Length", "value": "7071" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "Q;\\x124\\xd4\\x1a\\x00\\x80" }, { "name": "Length", "value": "6876" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-28 22:52:59,663", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa1G OJ\\x18\\x00\\x80" }, { "name": "Length", "value": "6226" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xec\\xb6kAE\\x18\\x00\\x80" }, { "name": "Length", "value": "6221" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x96I1\\xee_\\x16\\x00\\x80" }, { "name": "Length", "value": "5735" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "W\\x8aD\\x07D\\x1c\\x00\\x80" }, { "name": "Length", "value": "7244" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x96\\xb5\\x01\\xfat\\x18\\x00\\x80" }, { "name": "Length", "value": "6268" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "`\\xc2\\xba\\xb6\\x0b\\x1f\\x00\\x80" }, { "name": "Length", "value": "7955" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0c\\x93\\x12\\xc0Q\\x17\\x00\\x80" }, { "name": "Length", "value": "5977" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc4\\xffG\\xb3&\\x16\\x00\\x80" }, { "name": "Length", "value": "5678" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc5$qq\\x0f\\x08\\x00\\x80" }, { "name": "Length", "value": "2071" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x90\\xbd\\xf2\\x8cO\\x19\\x00\\x80" }, { "name": "Length", "value": "6487" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb2b\\xb7\\xb9$\\x1a\\x00\\x80" }, { "name": "Length", "value": "6700" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xdb6)|\\xaf\r\\x00\\x80" }, { "name": "Length", "value": "3511" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "]\\x98\\xb8\\x1e\\x1a\\x18\\x00\\x80" }, { "name": "Length", "value": "6178" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xdc\\xc2\\x95\\xf02\\x15\\x00\\x80" }, { "name": "Length", "value": "5434" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "B\\xdd)\\xec\\xa4 \\x00\\x80" }, { "name": "Length", "value": "8364" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe3z\\xb1\\x15C\\x1d\\x00\\x80" }, { "name": "Length", "value": "7499" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "E \\xba\\x95\\xc8#\\x00\\x80" }, { "name": "Length", "value": "9168" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8d\\xd1?\\xbb\\x8e\\x18\\x00\\x80" }, { "name": "Length", "value": "6294" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "/1\\xfc\\x1dJ&\\x00\\x80" }, { "name": "Length", "value": "9810" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd4\\xd3iX$\\x19\\x00\\x80" }, { "name": "Length", "value": "6444" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x11\\xd2?\\xa7q\\x0f\\x00\\x80" }, { "name": "Length", "value": "3961" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x898\\xff\\xb7N\\x17\\x00\\x80" }, { "name": "Length", "value": "5974" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-28 22:52:59,678", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "}\\x16r\\x1dM%\\x00\\x80" }, { "name": "Length", "value": "9557" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "&\\xf3\\x92\\xfe/\\x1f\\x00\\x80" }, { "name": "Length", "value": "2097469" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\xb6VlC\\x9d\\xd6\\x01\\x00\\xb6VlC\\x9d\\xd6\\x01\\x00\\xb6VlC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa89\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1291 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb29\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\xc1\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1296 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "@\\xc1\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "@\\xc1\\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xee\\x84nZg#\\x00\\x80" }, { "name": "Length", "value": "9071" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "s\\x15,t\\x1c!\\x00\\x80" }, { "name": "Length", "value": "8484" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe4?\\x03[\\x19\\x11\\x00\\x80" }, { "name": "Length", "value": "4385" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa0D\\xcdX=\\x10\\x00\\x80" }, { "name": "Length", "value": "4165" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcb\\xc2y\\x025\\x0c\\x00\\x80" }, { "name": "Length", "value": "3133" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "O\\xd9.\\xe0#,\\x00\\x80" }, { "name": "Length", "value": "11307" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xee\\x97S\\xd7L%\\x00\\x80" }, { "name": "Length", "value": "9556" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-28 22:52:59,756", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x10\\xd5\\xc2\\x1fG#\\x00\\x80" }, { "name": "Length", "value": "9039" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\xf0\\xea\\x92B7\\x00\\x80" }, { "name": "Length", "value": "14154" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbf\\x96K\\x86z:\\x00\\x80" }, { "name": "Length", "value": "14978" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x82K\\xc3c\\x92:\\x00\\x80" }, { "name": "Length", "value": "15002" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xdc\\xf5\\x8e\\x1c\\x15;\\x00\\x80" }, { "name": "Length", "value": "15133" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "R\\xd8\\xb5\\x84J8\\x00\\x80" }, { "name": "Length", "value": "14418" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcd\\xb3\\xf0bu4\\x00\\x80" }, { "name": "Length", "value": "13437" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa5Fp\\x19\\x8d3\\x00\\x80" }, { "name": "Length", "value": "13205" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbf\\x9f\\x80\\xd9)3\\x00\\x80" }, { "name": "Length", "value": "13105" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa7\\xc2i['*\\x00\\x80" }, { "name": "Length", "value": "10799" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcb\\xb22j\\xd01\\x00\\x80" }, { "name": "Length", "value": "12760" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\r\\xee(p\\xd9\"\\x00\\x80" }, { "name": "Length", "value": "8929" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbf \\xc7E\"\n\\x00\\x80" }, { "name": "Length", "value": "2602" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1d \\xcc\\xf8\\xad\\x0b\\x00\\x80" }, { "name": "Length", "value": "2997" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "D.\\xcbf\\x98\\x10\\x00\\x80" }, { "name": "Length", "value": "4256" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x11\\xc2\\x85\\xf5j\\x10\\x00\\x80" }, { "name": "Length", "value": "4210" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1c\\xfb\\xe3]\\xd6\\x18\\x00\\x80" }, { "name": "Length", "value": "6366" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf3\\xedK\\xb4\\x80V\\x00\\x80" }, { "name": "Length", "value": "22152" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc1\\x03\\x9e\\xe1\\x996\\x00\\x80" }, { "name": "Length", "value": "13985" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "Buffer", "value": "\\x10303X3t3\\x943\\xb43\\xd43\\xfc304X4\\x804\\xa44\\xd04\\x1c5`5\\xc85\\xf45 6\\x906\\xe06P7\\xa87\\x188d8\\x908\\xe09H:\\xb0: ;x;\\xe8;8<\\xa0<\\x08=\\x8c=\\xc8=P>\\xa0>\\xf8>\\x00\\x00\\x00\\xe0\\x0b\\x00H\\x00\\x00\\x00\\xf80`1\\xb81\\x102h2\\xfc384\\x904\\x886\\xc86 7\\xa87\\xf07@:\\x98:\\xf0;X<\\xe0< =@=p=\\xec= >\\xc8>\\xec>\\x0c?0?P?\\xa4?\\xd4?\\xf4?\\x00\\x00\\x00\\xf0\\x0b\\x00`\\x00\\x00\\x00 0@0l0\\x880\\xa80\\xdc0\\x141@1|1\\xb81\\xd41\\xf81@2\\x882\\xc42\\xf82<3h3\\x903\\xb83\\x044@4x4\\xcc4\\x105h5\\xa05\\xe05\\x0c606T6\\x806\\xc86\\x087H7\\x887\\xb07\\x1c8@8p8\\xb48\\xd48\\xf88 9\\x00\\x00\\x0c\\x00\\x0c\\x00\\x00\\x00" }, { "name": "Length", "value": "9212" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00=\\xeaoC\\x9d\\xd6\\x01\\x00=\\xeaoC\\x9d\\xd6\\x01\\x00=\\xeaoC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc29\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1330 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4 wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd39\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc8\\xcd\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1335 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\xc8\\xcd\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\xc8\\xcd\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbeH7\\x1d\\x943\\x00\\x80" }, { "name": "Length", "value": "13212" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "bZ\\x19DK5\\x00\\x80" }, { "name": "Length", "value": "13651" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa9\\xf9\\xab\\x113F\\x00\\x80" }, { "name": "Length", "value": "17979" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "&\\x07\\x00T=A\\x00\\x80" }, { "name": "Length", "value": "16709" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9cx\\xdd;3<\\x00\\x80" }, { "name": "Length", "value": "15419" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "e\\x84\\x87~.?\\x00\\x80" }, { "name": "Length", "value": "16182" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-28 22:52:59,772", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb4\\x19nN\np0R\\xa0\\x81\\x830\\x81\\x80\\xa4~0|1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dMicrosoft Time-Stamp PCA 20100\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x00\\x02\\x05\\x00\\xe3(\\xe3\\xcc0\"\\x18\\x0f20201008090308Z\\x18\\x0f20201009090308Z0w0=\\x06\n+\\x06\\x01\\x04\\x01\\x84Y\n\\x04\\x011/0-0\n\\x02\\x05\\x00\\xe3(\\xe3\\xcc\\x02\\x01\\x000\n" }, { "name": "Length", "value": "1276" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00S.\\xa8$\\x9d\\xd6\\x01\\x00S.\\xa8$\\x9d\\xd6\\x01\\x00S.\\xa8$\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xff9\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1370 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00H" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\n:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\xc5\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1375 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "H\\xc5\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "H\\xc5\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc2\\x19E\\xfa7>\\x00\\x80" }, { "name": "Length", "value": "15935" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "Buffer", "value": "\\xe4\\xa1\\xbc\\xa4\\x00\\x10\\x89E\\xe0\\x8dE\\xe0P\\x8dE\\xe4P\\xffu\\x08\\xe8\\xc0\\x04\\x00\\x00\\x83\\xc4\\x0c\\x8b\\xf0\\x89u\\xdc\\x8bM\\xe4\\x89\r\\xc0\\xa4\\x00\\x10\\x8bM\\xe0\\x89\r\\xbc\\xa4\\x00\\x10\\xc7E\\xfc\\xfe\\xff\\xff\\xff\\xe8\\x15\\x00\\x00\\x00\\x8b\\xc6\\x8bM\\xf0d\\x89\r\\x00\\x00\\x00\\x00Y_^[\\xc9\\xc3\\x8bu\\xdcj\\x08\\xe8x\\x04\\x00\\x00Y\\xc3\\x8b\\xffU\\x8b\\xec\\xffu\\x08\\xe8P\\xff\\xff\\xff\\xf7\\xd8Y\\x1b\\xc0\\xf7\\xd8H]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xff%\\xd4\\xb1\\x00\\x10\\x8b\\xffU\\x8b\\xec]\\xe9\\xff\\xfe\\xff\\xff\\xff%\\xb4\\xb1\\x00\\x10\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xff%\\xb0\\xb1\\x00\\x10\\xff%\\xac\\xb1\\x00\\x10\\xcc\\xcc\\xcc\\xcc\\xff%\\xa8\\xb1\\x00\\x10\\xff%\\xa4\\xb1\\x00\\x10\\xff%\\xa0\\xb1\\x00\\x10\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8b\\xf1\\xff\\x15|\\xb1\\x00\\x10\\xf6E\\x08\\x01t\\x07V\\xe8\\xef\\xf8\\xff\\xffY\\x8b\\xc6^]\\xc2\\x04\\x00\\xff%\\xcc\\xb1\\x00\\x10\\xff%\\x9c\\xb1\\x00\\x10\\xcc\\xcc\\x8b\\xffU\\x8b" }, { "name": "Length", "value": "19012" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1a:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1384 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00H" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "':\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd0q\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1389 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\xd0q\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\xd0q\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe3\\xd6\\xab8\\xb5'\\x00\\x80" }, { "name": "Length", "value": "10173" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe1\\x13\\xe6\\xc0\\xce#\\x00\\x80" }, { "name": "Length", "value": "9174" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc9\\x8a3\\x15<*\\x00\\x80" }, { "name": "Length", "value": "10820" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xea\\xdb\\x03\\xcc\\xa4<\\x00\\x80" }, { "name": "Length", "value": "15532" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "eI4\\x92\\xa3D\\x00\\x80" }, { "name": "Length", "value": "17579" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x16\\xa8\\xa7\\xa5IF\\x00\\x80" }, { "name": "Length", "value": "18001" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "qm\\xa4a\\xa5H\\x00\\x80" }, { "name": "Length", "value": "18605" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xaaB\\x1a\\xef\\xddG\\x00\\x80" }, { "name": "Length", "value": "18405" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "q&\\xbb\\x03CE\\x00\\x80" }, { "name": "Length", "value": "17739" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-28 22:52:59,788", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf0*Z\\xb4\\x9bF\\x00\\x80" }, { "name": "Length", "value": "18083" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "j\\xa2a\\x1awK\\x00\\x80" }, { "name": "Length", "value": "19327" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x87\\xceZ\\xa4\\x97H\\x00\\x80" }, { "name": "Length", "value": "18591" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\xb5R{\\x8a:\\x00\\x80" }, { "name": "Length", "value": "14994" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xac\"\\xa2\\x1c\\xdc<\\x00\\x80" }, { "name": "Length", "value": "15588" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xebd\\xd2\\xcagG\\x00\\x80" }, { "name": "Length", "value": "18287" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc7\\x90(\\x13\\x19F\\x00\\x80" }, { "name": "Length", "value": "17953" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "(\\xa2\\x9a\\xa6HG\\x00\\x80" }, { "name": "Length", "value": "18256" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xff\\xf1\\xa7\\x1d\\xb3E\\x00\\x80" }, { "name": "Length", "value": "17851" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa8\\xbe\\xf4fEB\\x00\\x80" }, { "name": "Length", "value": "16973" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe4\\xf0C\\xd7\\xb8D\\x00\\x80" }, { "name": "Length", "value": "17600" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe4\\xb7\\xbc\\xf65<\\x00\\x80" }, { "name": "Length", "value": "15421" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "_\\x18\\x11T\\xf4Q\\x00\\x80" }, { "name": "Length", "value": "20988" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa2\\x14\\x03\\xc0K@\\x00\\x80" }, { "name": "Length", "value": "16467" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "Buffer", "value": "\\x918L9\n:B:\\xb7:\\xfb;\\x85=\\xb8=\\xc3=\r>;>l>\\xec>6?\\xf0?\\x00\\x00\\x00\\x00\\x08\\x008\\x00\\x00\\x00\\xaa0\\x7f1\\x06202X2\\x982\\xc02H3\\x054\\xac5\\xd45\\x006\\x846\t7/8t8\\x998\\xda8\\xff8s9\\xcc9i:\\x7f2>8>\\xb2?\\x00\\x00\\x000\\x08\\x00<\\x00\\x00\\x00\\x110+0n0\\x870C3\\xb33#4\\x934\\x035s5\\xcc546\\x1b757\\xbc7\\xec7.8\\xb08\\xdd8<9\\xdc9\\xcc;" }, { "name": "Length", "value": "15380" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x97LrC\\x9d\\xd6\\x01\\x00\\x97LrC\\x9d\\xd6\\x01\\x00\\x97LrC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1420 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0\\xdf\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1425 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\xc0\\xdf\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\xc0\\xdf\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "|\\xeew\\x9b]$\\x00\\x80" }, { "name": "Length", "value": "9317" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf90\\x93\\x87\\xd6E\\x00\\x80" }, { "name": "Length", "value": "17886" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "f\\xb4\\xfc\\xd3gE\\x00\\x80" }, { "name": "Length", "value": "17775" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "D\\xde\\xfc\\x92\\xe4F\\x00\\x80" }, { "name": "Length", "value": "18156" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "H\\x00\\x9ar\\xd4I\\x00\\x80" }, { "name": "Length", "value": "18908" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0f\\x9dyQ\\x1bE\\x00\\x80" }, { "name": "Length", "value": "17699" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xef\\xa7\\xb6a^I\\x00\\x80" }, { "name": "Length", "value": "18790" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-28 22:52:59,803", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\t\\xddnC\\xdaD\\x00\\x80" }, { "name": "Length", "value": "17634" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9b^\\x08d\\xe9J\\x00\\x80" }, { "name": "Length", "value": "19185" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe8\\xf0P\\xcd\\xc2K\\x00\\x80" }, { "name": "Length", "value": "19402" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "m\\xbc\\xd1\\xe3pF\\x00\\x80" }, { "name": "Length", "value": "18040" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xff\\xb5\\x92\\xe7cH\\x00\\x80" }, { "name": "Length", "value": "18539" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "$\\[!\\x0bF\\x00\\x80" }, { "name": "Length", "value": "17939" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "M\\x7f\\xb2Z\\xffC\\x00\\x80" }, { "name": "Length", "value": "17415" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x97\\xee\\x90\\xc8\\x96P\\x00\\x80" }, { "name": "Length", "value": "20638" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x15U\\x82\\x7f\\xce6\\x00\\x80" }, { "name": "Length", "value": "14038" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "Buffer", "value": "\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20100\\x1e\\x17\r100706204017Z\\x17\r250706205017Z0~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft Code Signing PCA 20100\\x82" }, { "name": "Length", "value": "7124" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00;\rzE\\x9d\\xd6\\x01\\x00;\rzE\\x9d\\xd6\\x01\\x00;\rzE\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "S:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1449 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "_:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\x9f\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1454 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "H\\x9f\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "H\\x9f\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xca0U\\xe1\\xe9;\\x00\\x80" }, { "name": "Length", "value": "15345" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x7fZ\\xb9\\xc6\\xf4C\\x00\\x80" }, { "name": "Length", "value": "17404" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe3\\xab\\xf2\\x10@I\\x00\\x80" }, { "name": "Length", "value": "18760" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\n\\xb7\\xa9\\xa6VA\\x00\\x80" }, { "name": "Length", "value": "16734" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x06\\xe9\\x7f#\\xbb3\\x00\\x80" }, { "name": "Length", "value": "13251" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x12\\xfa\\xb9\\xa8>-\\x00\\x80" }, { "name": "Length", "value": "11590" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcc\\xffm\\xa0\\xf4<\\x00\\x80" }, { "name": "Length", "value": "15612" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "Buffer", "value": "@5V5\\x845\\x905\\xbe5\\xcd5\\xe95\\x8a6\\xa06-7\\xa17\\x088N8\\x898\\x978\\xf58a:\\x9d:\t;\\x14;\\xc9;\\x0f<\\x18<,<7\\x00\\x00\\x00@\\x01\\x00\\xac\\x00\\x00\\x00s0\\x890\\xc30\\xe90\\xfe0@1\\xf11\\x042#2/2R2f2\\x912\\xbb2\\xe22\\xe82-3O3\\xef3\n4!4\\x854\\x9c7\\xf37\\xea8\\x1c9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9\\x829" }, { "name": "Length", "value": "15132" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "o:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1469 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaa" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "w:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\x85\\x10\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1474 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "H\\x85\\x10\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "H\\x85\\x10\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd6\\x00\\xe9\\xe3\\xa8!\\x00\\x80" }, { "name": "Length", "value": "8624" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9a\\x93\\x07\\xb2R\\x13\\x00\\x80" }, { "name": "Length", "value": "4954" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x88\\xfb=\\x90H\\x16\\x00\\x80" }, { "name": "Length", "value": "5712" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb4<\\x1f\\xf4e\\x10\\x00\\x80" }, { "name": "Length", "value": "4205" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc7\\xeb\\xa2\\x94X\\x12\\x00\\x80" }, { "name": "Length", "value": "4704" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8e/f4\\xf3\\x0f\\x00\\x80" }, { "name": "Length", "value": "4091" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\ne\\xfa$\\x8e\\x1b\\x00\\x80" }, { "name": "Length", "value": "7062" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "MH\\xe9\\xaa)>\\x00\\x80" }, { "name": "Length", "value": "15921" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc8\\xd7\\x17\nx4\\x00\\x80" }, { "name": "Length", "value": "13440" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfb\\xfa\\xf1p\\xcb7\\x00\\x80" }, { "name": "Length", "value": "14291" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x17\\x1d\\xe7\rn4\\x00\\x80" }, { "name": "Length", "value": "13430" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x81\\xd4LL\\xc53\\x00\\x80" }, { "name": "Length", "value": "13261" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb4\\x8b\\x98\\xc2?B\\x00\\x80" }, { "name": "Length", "value": "16967" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb6\\xe4\\x0e\\xfc\\x94;\\x00\\x80" }, { "name": "Length", "value": "15260" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x82&\\x8a\\x01\\xdb4\\x00\\x80" }, { "name": "Length", "value": "13539" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "p\\xef\\xbc\\x8eN0\\x00\\x80" }, { "name": "Length", "value": "12374" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "Ox\\x87e\\x90O\\x00\\x80" }, { "name": "Length", "value": "20376" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0b\\x8en\\xcb\\xd24\\x00\\x80" }, { "name": "Length", "value": "13530" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "j&&\\xaa^+\\x00\\x80" }, { "name": "Length", "value": "11110" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe6\\xbem\\xe7\\xc62\\x00\\x80" }, { "name": "Length", "value": "13006" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9f\\xc3\\x1d?\\xec.\\x00\\x80" }, { "name": "Length", "value": "12020" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "O\\x156\\xc2\\x9b;\\x00\\x80" }, { "name": "Length", "value": "15267" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-28 22:52:59,819", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd6\\x7fl\\xfa&\\x1e\\x00\\x80" }, { "name": "Length", "value": "7726" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x01DC\\xaf\\xab+\\x00\\x80" }, { "name": "Length", "value": "11187" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x08)\\x02j\\xc0\t\\x00\\x80" }, { "name": "Length", "value": "2504" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "[\\xf6\\x85Rs\\x06\\x00\\x80" }, { "name": "Length", "value": "1659" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xee$\\xa1}\\x90\\x06\\x00\\x80" }, { "name": "Length", "value": "1688" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "O\"P\\xf04\\x07\\x00\\x80" }, { "name": "Length", "value": "1852" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x87q]\\xee\\x13\\x04\\x00\\x80" }, { "name": "Length", "value": "1051" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc8\\xf5\\xd8U\\xdd\\x05\\x00\\x80" }, { "name": "Length", "value": "1509" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "/\\xc4\\xcc\\xd5q*\\x00\\x80" }, { "name": "Length", "value": "10873" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x01\\x13\\x03\\xc1#a\\x00\\x80" }, { "name": "Length", "value": "24875" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa2\\x91\\xedb\\xa44\\x00\\x80" }, { "name": "Length", "value": "13484" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "Buffer", "value": "$9g9\\x949\\xbf9\\xf093:`:\\x8b:\\xbc:\\xdf:\n;-;b;\\x95;\\xb8;\\xe3;\\x0e<1*>]>\\x80>\\xa3>\\xce>\\xf9>$?G?b?\\x8d?\\xb8?\\xf3?\\x00\\x10\\x0b\\x00\\x90\\x00\\x00\\x00.0\\xbc0\\xdf0\\x021%1h1\\x951\\xb01\\xcb1\\xe61\t2\\x1b2L2w2\\xac2\\xe82\\x0b3>3\\xd63n4\\x994\\x1b5\\xb35\\xf85\\x1b6\\xc66\\xfb6d8\\x8f8\\xce8\\xf18\\x0c979R9m9\\xab9\\xfe9]:g:\\x88:\\xab:\\xd6:\\xf9:,;O;j;\\xd9;\\x1c<>_>\\x8c>\\xb7>\\xda>Y?\\x84?\\xbf?\\xf2?\\x00\\x00\\x00 \\x0b\\x00\\x9c\\x00\\x00\\x00\r0@0c0\\x860\\xa90\\xfd0(1S1~1\\xb91\\xf41'2" }, { "name": "Length", "value": "16484" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\wpx.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\xdb\\x19\\x0e#\\x9d\\xd6\\x01\\x00\\xdb\\x19\\x0e#\\x9d\\xd6\\x01\\x00\\xdb\\x19\\x0e#\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x87:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1515 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05 SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xae" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9b:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8\\x91\\xee\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1520 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "8\\x91\\xee\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "8\\x91\\xee\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "j\\xadt\\x86\\x07'\\x00\\x80" }, { "name": "Length", "value": "9999" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "^D\\xdc).\\x19\\x00\\x80" }, { "name": "Length", "value": "6454" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\0\\xd9IX\\x16\\x00\\x80" }, { "name": "Length", "value": "5728" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "T\\x82\\xf6\\xcd\\xa18\\x00\\x80" }, { "name": "Length", "value": "14505" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc4\\xa6\\xdcR\\xf7:\\x00\\x80" }, { "name": "Length", "value": "15103" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "y@\\xf5\\x9b\\x0fA\\x00\\x80" }, { "name": "Length", "value": "16663" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf4\\xfa\\x16\\x9e\\x99;\\x00\\x80" }, { "name": "Length", "value": "15265" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfe%\\xc3\\xcb~#\\x00\\x80" }, { "name": "Length", "value": "9094" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf7\\xe1\\x82k\\xe4;\\x00\\x80" }, { "name": "Length", "value": "15340" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x81\\xfe\\xb6\\xac\\xa4>\\x00\\x80" }, { "name": "Length", "value": "16044" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "3\\xcf%\\x1ev?\\x00\\x80" }, { "name": "Length", "value": "16254" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x00\\x1bL\\xc5w%\\x00\\x80" }, { "name": "Length", "value": "9599" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd9\\x7fO\\xf9\\xd6.\\x00\\x80" }, { "name": "Length", "value": "11998" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-28 22:52:59,834", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\J\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb9:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8'!\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1582 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "8'!\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "8'!\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "w\\x13\\x8c\\xd1\r:\\x00\\x80" }, { "name": "Length", "value": "14869" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x7f1B\\xd7\\xbd$\\x00\\x80" }, { "name": "Length", "value": "9413" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc9\\x98\\xcd\\xec\\xa5\\x10\\x00\\x80" }, { "name": "Length", "value": "4269" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd4I\\xa3dz\\x0e\\x00\\x80" }, { "name": "Length", "value": "3714" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ",\\xc6=\\xb9\\x08\\x10\\x00\\x80" }, { "name": "Length", "value": "4112" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfcy\\xda\\xa8\\xa6\\x0f\\x00\\x80" }, { "name": "Length", "value": "4014" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "j\\xbe\\xf4\\x10z\\x0b\\x00\\x80" }, { "name": "Length", "value": "2946" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "m`\\xcc \\xdc\\x03\\x00\\x80" }, { "name": "Length", "value": "996" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x038K8\\xf8\\x07\\x00\\x80" }, { "name": "Length", "value": "2048" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc9>\\xec\\x96\\xe9\\x1d\\x00\\x80" }, { "name": "Length", "value": "7665" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd65\\xe6\\x85\\x1d\\x1f\\x00\\x80" }, { "name": "Length", "value": "7973" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x99\\x95{\\xe9\\x92,\\x00\\x80" }, { "name": "Length", "value": "11418" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x11\\x8es\"q \\x00\\x80" }, { "name": "Length", "value": "8313" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x81q5\\x1c\\x1e \\x00\\x80" }, { "name": "Length", "value": "8230" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbc\\x8c\\x12L\\xe7\\x1e\\x00\\x80" }, { "name": "Length", "value": "7919" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfe\\xea\\xda \\x8e\\x1f\\x00\\x80" }, { "name": "Length", "value": "8086" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ".\\x1f\\xbb*\\x7f \\x00\\x80" }, { "name": "Length", "value": "8327" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x99\\xbe\\x84\\xdc\\xe0\\x1f\\x00\\x80" }, { "name": "Length", "value": "8168" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1bN\\xee\"\\xa8\\x1f\\x00\\x80" }, { "name": "Length", "value": "8112" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-28 22:52:59,959", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\"D\\x1d\\xb9|\\x1f\\x00\\x80" }, { "name": "Length", "value": "8068" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "#\\x1d6Qj \\x00\\x80" }, { "name": "Length", "value": "8306" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd5{f\\x87\\xfd\\x1f\\x00\\x80" }, { "name": "Length", "value": "8197" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa8E\\x80\\xc3\\x0c!\\x00\\x80" }, { "name": "Length", "value": "8468" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "u_u\\xa1\\xa5<\\x00\\x80" }, { "name": "Length", "value": "15533" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x05D\\xcb\\x8e]9\\x00\\x80" }, { "name": "Length", "value": "14693" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb8\\xb9O\\xff\\xd08\\x00\\x80" }, { "name": "Length", "value": "14552" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xffW\\xd6\\xbb\\xba:\\x00\\x80" }, { "name": "Length", "value": "15042" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xec\\x83\\xa8\\xce\\x94<\\x00\\x80" }, { "name": "Length", "value": "15516" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa2t\\x0b\\xbbJ@\\x00\\x80" }, { "name": "Length", "value": "16466" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xed\\xdd\\x98e\\x9f8\\x00\\x80" }, { "name": "Length", "value": "14503" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "*#Y\\xc5-8\\x00\\x80" }, { "name": "Length", "value": "14389" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ">\\xfc\\xf2\\x9aq7\\x00\\x80" }, { "name": "Length", "value": "14201" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x00fc\\xef\\x042\\x00\\x80" }, { "name": "Length", "value": "12812" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "@\\xc2U%\\xe4\\x17\\x00\\x80" }, { "name": "Length", "value": "6124" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "s\\xf6\\xda\\x0e\\xd5=\\x00\\x80" }, { "name": "Length", "value": "15837" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8f\\xba]\\x10\\xc73\\x00\\x80" }, { "name": "Length", "value": "13263" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa8\\x04}\\x84\\x93B\\x00\\x80" }, { "name": "Length", "value": "17051" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "VD\\x11\\x99\\xe8H\\x00\\x80" }, { "name": "Length", "value": "18672" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ",\\xa0e\\xd3\\x8fB\\x00\\x80" }, { "name": "Length", "value": "17047" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "1CE\\x06\\xb1D\\x00\\x80" }, { "name": "Length", "value": "17593" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "?1\\x7f\\xef\\x9fD\\x00\\x80" }, { "name": "Length", "value": "17575" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0f\\xaa\\xc0\\xee\\xceG\\x00\\x80" }, { "name": "Length", "value": "18390" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1c\\x05\\xb9F\\x1bE\\x00\\x80" }, { "name": "Length", "value": "17699" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc7P\\x15\\xdd{I\\x00\\x80" }, { "name": "Length", "value": "18819" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0b\\xda\\x8a\\xb2OH\\x00\\x80" }, { "name": "Length", "value": "18519" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xdfq\\xe1\\xf9\\xe4H\\x00\\x80" }, { "name": "Length", "value": "18668" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd4\\xa4*_\\x88L\\x00\\x80" }, { "name": "Length", "value": "19600" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "/\\xe3]bAE\\x00\\x80" }, { "name": "Length", "value": "17737" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-28 22:52:59,975", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "St:\\xee\\x05E\\x00\\x80" }, { "name": "Length", "value": "17677" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xael\\xf6`\\xd7F\\x00\\x80" }, { "name": "Length", "value": "164620" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1639 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd7:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8\\xab\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1644 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "8\\xab\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "8\\xab\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfbjZ\\x8f\\x9d%\\x00\\x80" }, { "name": "Length", "value": "9637" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": " \\x0c\\x1c\\x96\\x95\\x19\\x00\\x80" }, { "name": "Length", "value": "6557" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x11\\xc6\\x7f\\x13E)\\x00\\x80" }, { "name": "Length", "value": "10573" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "3~-\\x1c\\x1c!\\x00\\x80" }, { "name": "Length", "value": "8484" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x98I\\x1fOG:\\x00\\x80" }, { "name": "Length", "value": "14927" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "i\\xb6\\x9f\\xb1\\xbe9\\x00\\x80" }, { "name": "Length", "value": "14790" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "K\\xb1C_\\xb0>\\x00\\x80" }, { "name": "Length", "value": "16056" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x87\\xaf\\x86d]C\\x00\\x80" }, { "name": "Length", "value": "17253" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "!\\xd6hF\\xb1E\\x00\\x80" }, { "name": "Length", "value": "17849" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xee\\xc7\\xc6\\xaa\\xd0A\\x00\\x80" }, { "name": "Length", "value": "16856" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x16<\\xee\\x9aPH\\x00\\x80" }, { "name": "Length", "value": "18520" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0f\\x1b\\xaa>\\xdcG\\x00\\x80" }, { "name": "Length", "value": "18404" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf84'\\xf2\\x9dF\\x00\\x80" }, { "name": "Length", "value": "18085" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "C\\x18C\\xb5\\x18I\\x00\\x80" }, { "name": "Length", "value": "18720" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xdd\\xa8\\x1e\\xe2\\xf5K\\x00\\x80" }, { "name": "Length", "value": "19453" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8b\\xffO\\x1b\\xb1J\\x00\\x80" }, { "name": "Length", "value": "19129" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "-7\\xf7\\xe5+D\\x00\\x80" }, { "name": "Length", "value": "17459" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x04 D\\x94\\x17A\\x00\\x80" }, { "name": "Length", "value": "16671" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x81\\x8e\\xfe\\xef\\xc3,\\x00\\x80" }, { "name": "Length", "value": "11467" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa0^\\x90\\x9bKQ\\x00\\x80" }, { "name": "Length", "value": "20819" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "s\\xf871oY\\x00\\x80" }, { "name": "Length", "value": "22903" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "&\\x99\\xc7T\\x1e.\\x00\\x80" }, { "name": "Length", "value": "11814" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "Buffer", "value": "`0l0\\x8c0\\x940\\x9c0\\xa80\\xc80\\xd40\\xf40\\xfc0\\x041\\x0c1\\x141 1@1L1l1x1\\x981\\xa01\\xac1\\xcc1\\xd41\\xe01\\x002\\x082\\x102 2D2L2T2\\2d2l2t2|2\\x842\\x8c2\\x942\\x9c2\\xa42\\xac2\\xb42\\xbc2\\xc42\\xcc2\\xd42\\xdc2\\xe42\\xec2\\xf82\\x183 3,3L3X3x3\\x803\\x883\\x903\\x9c3\\xbc3\\xc83\\xe83\\xf03\\xfc3\\x1c4$4<4@4`4|4\\x804\\xa04\\xc04\\xe04\\x005\\x085\\x0c5(545T5`5\\x805\\x885\\xa85\\xc85\\xe85\\x046\\x086$6(6H6h6t6\\x946\\xb06\\xd06\\xdc6\\xfc6\\x047\\x1070787X7d7\\x847\\x907\\xb07\\xbc7\\xdc7\\xe87\\x088\\x108\\x188 8(80888D8d8\\x808\\xa08\\xc08\\xcc8\\xe88\\x089\\x149" }, { "name": "Length", "value": "9228" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\xc2\\xcd\\xaeF\\x9d\\xd6\\x01\\x00\\xc2\\xcd\\xaeF\\x9d\\xd6\\x01\\x00\\xc2\\xcd\\xaeF\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1674 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5," }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4:\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8g\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1679 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "8g\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "8g\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0f[\\xdf\\x96\\x13\\x11\\x00\\x80" }, { "name": "Length", "value": "4379" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xec\r$\\xf4\\x0e'\\x00\\x80" }, { "name": "Length", "value": "10006" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9a\\x04\\x8e\\xa18%\\x00\\x80" }, { "name": "Length", "value": "9536" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "*\\xcf~\\xd0\\xd4:\\x00\\x80" }, { "name": "Length", "value": "15068" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "r6f\\xd2\\x956\\x00\\x80" }, { "name": "Length", "value": "13981" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "*\\x9b\\xea\\xdfZ1\\x00\\x80" }, { "name": "Length", "value": "12642" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-28 22:52:59,991", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x12t\\x8c\\x04_9\\x00\\x80" }, { "name": "Length", "value": "14695" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "T\\xca]\\xed\\xd0@\\x00\\x80" }, { "name": "Length", "value": "16600" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcc\\xcf\\xbe\t\\xb7D\\x00\\x80" }, { "name": "Length", "value": "17599" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf1\\xd7r\\x8e\\x84A\\x00\\x80" }, { "name": "Length", "value": "16780" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x03\\x10\\xd8\\xd9\\xd1G\\x00\\x80" }, { "name": "Length", "value": "18393" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xb2WL\\x1c\\xadE\\x00\\x80" }, { "name": "Length", "value": "17845" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x87\\xd1\\xe7\\x9a\\xa6C\\x00\\x80" }, { "name": "Length", "value": "17326" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "eH\\x94\\xb0\\xdfF\\x00\\x80" }, { "name": "Length", "value": "18151" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\r'\\x1b\\x85\\x1dG\\x00\\x80" }, { "name": "Length", "value": "18213" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "}\\xeeH3\\x0bH\\x00\\x80" }, { "name": "Length", "value": "18451" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x14\\xdf\\xc9$;F\\x00\\x80" }, { "name": "Length", "value": "17987" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe046GrL\\x00\\x80" }, { "name": "Length", "value": "19578" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc1\\xd0\\x13\\xa1]K\\x00\\x80" }, { "name": "Length", "value": "19301" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x83\\xabb]U=\\x00\\x80" }, { "name": "Length", "value": "15709" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd7\\xa0\\x04W\\xda(\\x00\\x80" }, { "name": "Length", "value": "10466" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": " \\xb1\\xc6\\xcbYa\\x00\\x80" }, { "name": "Length", "value": "24929" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ";H\\xdc\\xfd6*\\x00\\x80" }, { "name": "Length", "value": "10814" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "Buffer", "value": "soft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dMicrosoft Time-Stamp PCA 20100\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xa9\\x1d\r\\xbcw\\x11\\x8a: \\xec\\xfc\\x13\\x97\\xf5\\xfa\\x7fi\\x94ktT\\x10\\xd5\\xa5\n\\x00\\x82\\x85\\xfb\\xed|hK,_\\xc5\\xc3\\xe5a\\xc2v\\xb7>f+[\\xf0\\x15S'\\x041\\x1fA\\x1b\\x1a\\x95\\x1d\\xce\t\\x13\\x8e|a0Y\\xb10D\\x0f\\xf1`\\x88\\x84TC\\x0c\\xd7M\\xb88\\x08\\xb3B\\xdd\\x93\\xac\\xd6s0W&\\x82\\xa3E\r\\xd0\\xea\\xf5G\\x81\\xcd\\xbf$`2X`F\\xf2XG\\x862\\x84\\x1etag\\x91_\\x81T\\xb1\\xcf\\x93L\\x92\\xc1\\xc4\\xa6]\\xd1a\\x13n(\\xc6\\x1a\\xf9\\x86\\x80\\xbb\\xdfa\\xfcF\\xc1'\\x1d$g\\x12r\\x1a!\\x8a\\xafKd\\x89Pb\\xb1]\\xfdw" }, { "name": "Length", "value": "2884" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\t\\xaaF\\x9d\\xd6\\x01\\x00\\x0e\t\\xaaF\\x9d\\xd6\\x01\\x00\\x0e\t\\xaaF\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1710 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,\\xfc\\xefC\\xa4\\xe3\\xcf|\\xfcx\\xf6\\xc3E\\xcf-\\xdb\\x1fkynYg\\x9fjJy#\\xd7k\\xc8" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0f;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8\\xc9\\x11\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1715 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "8\\xc9\\x11\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "8\\xc9\\x11\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xbd\\x83\\x1d\\x8a\\xea\\x0f\\x00\\x80" }, { "name": "Length", "value": "4082" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1e,\n\\xd3a\r\\x00\\x80" }, { "name": "Length", "value": "3433" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "b)\\xe8\\xc5\\\\x19\\x00\\x80" }, { "name": "Length", "value": "6500" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ".c\\x89\\x0e\\xc5\\x1f\\x00\\x80" }, { "name": "Length", "value": "8141" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xf0\\x97s\\x8f4.\\x00\\x80" }, { "name": "Length", "value": "11836" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x07U\\xca\\xed\\x8d9\\x00\\x80" }, { "name": "Length", "value": "14741" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "}ez\\x94\n1\\x00\\x80" }, { "name": "Length", "value": "12562" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "G\\x11\\xdc>l4\\x00\\x80" }, { "name": "Length", "value": "13428" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "(\\x03\\x9a\\x15\\x1f9\\x00\\x80" }, { "name": "Length", "value": "14631" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd3\nL\\xb9<2\\x00\\x80" }, { "name": "Length", "value": "12868" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xae\\x16\\x1a\\x9b\\x84>\\x00\\x80" }, { "name": "Length", "value": "16012" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xe4V\\xc2\\xb7Q;\\x00\\x80" }, { "name": "Length", "value": "15193" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8aH\\x00\\x80" }, { "name": "Length", "value": "15896" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xfc\\xddj\\xc3*?\\x00\\x80" }, { "name": "Length", "value": "16178" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd7)ji\\xe9E\\x00\\x80" }, { "name": "Length", "value": "17905" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ",m\\xc3v\\x08D\\x00\\x80" }, { "name": "Length", "value": "17424" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1aX\\xa6\\x86:G\\x00\\x80" }, { "name": "Length", "value": "18242" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "=\\xad\\xdb&\\x04E\\x00\\x80" }, { "name": "Length", "value": "17676" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "lO\\xd3rzF\\x00\\x80" }, { "name": "Length", "value": "18050" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-28 22:53:00,006", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\"\\xde\\xb1\\xac\\x84@\\x00\\x80" }, { "name": "Length", "value": "16524" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x07qB\\xe2\\xbfG\\x00\\x80" }, { "name": "Length", "value": "18375" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\n(\\xd0\\xc1\\xb2K\\x00\\x80" }, { "name": "Length", "value": "19386" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "P\\xd5\\xf9\\x80\\x11F\\x00\\x80" }, { "name": "Length", "value": "17945" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "r\\xcc\\x92F\\xa8B\\x00\\x80" }, { "name": "Length", "value": "17072" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xedn\\xaf\\x1cqF\\x00\\x80" }, { "name": "Length", "value": "18041" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa4\\xb0\\xf2\\x9a\\xb6H\\x00\\x80" }, { "name": "Length", "value": "18622" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcah\\x07*jD\\x00\\x80" }, { "name": "Length", "value": "17522" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "X\\x0ebG\\xd2J\\x00\\x80" }, { "name": "Length", "value": "19162" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "P\\x98R\\xferL\\x00\\x80" }, { "name": "Length", "value": "19578" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "^\\xd3/nu7\\x00\\x80" }, { "name": "Length", "value": "14205" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "b\\xc1u[\\xb0)\\x00\\x80" }, { "name": "Length", "value": "10680" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x0b\\xe2\\xb4x\\x89\\x1d\\x00\\x80" }, { "name": "Length", "value": "7569" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x96\\x19!\\x90\\x8a\\x16\\x00\\x80" }, { "name": "Length", "value": "5778" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "e\\x9d\\xc7S\\xd0Q\\x00\\x80" }, { "name": "Length", "value": "20952" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ")\\x03\\xfdq4O\\x00\\x80" }, { "name": "Length", "value": "20284" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "Buffer", "value": "t\\x00\\x00\\x00\\x000\\x0e0\\xc40\\xcf0\\xdd0\\xf30k1r1\\x801\\x961\\xe71\\xee1\\x032\\x1a2\\x882\\x932\\x9a2\\xac2\\xb32N3U3r5|5\\xa3526Q6X6\\xce6>8I8W8\\xd58\\xe08\\xee8s9\\xd89\\xee9\\x0b:!:\\x85:\\xa6:\\xb2:\\xbd:\\xdb<\\x15=:>A>3?P?W?\\x93?\\x9e?\\xac?\\x00\\x00\\x00\\xb0\n\\x00|\\x00\\x00\\x00 0o0z0\\x880R1n1y1\\x801\\xaa1\\x7f2\\x8a2\\x982\\xc03\\xcb3\\xd93j4\\xa84\\xb34\\xba4\n5S6\\xa96\\xad6\\xb16\\xb56\\xb96\\xbd6\\xc16\\xc56\\xc96\\xcd6\\xfc6\\x077\\x157\\x8d7\\xa47\\xaf7\\xbd7\\xb38\\xbe8\\xcc8\\x86:\\x8d:`;d;\\x89<\\x90<\\x9e<\\xbe<\\xee=\\xf8=\\x0c>5>u>\\xea>\\x04?\\x17?\\x8e?\\x00\\xc0\n\\x00\\x84\\x00\\x00\\x00\\xe80{1\\x8a3\\x943\\xa83\\xfe3" }, { "name": "Length", "value": "21628" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "8\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1f;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1758 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,\\xfc\\xefC\\xa4\\xe3\\xcf|\\xfcx\\xf6\\xc3E\\xcf-\\xdb\\x1fkynYg\\x9fjJy#\\xd7k\\xc8\\xfdRF\\xd6\\xf5\\x9c%u+\\x92Q\\xd0%U\\x97\\x12\\xedi\\xa9?\\x97Uj\\x8f;\\xee\\x98" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "+;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8\\x8f\r\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1763 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "8\\x8f\r\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "8\\x8f\r\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "OZth\\xecJ\\x00\\x80" }, { "name": "Length", "value": "19188" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x81\\x02$M\\x85g\\x00\\x80" }, { "name": "Length", "value": "26509" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ":\\xdc\\x96\\x97\\xe5>\\x00\\x80" }, { "name": "Length", "value": "16109" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa2\\xb7\\x84\\x0f\\xf67\\x00\\x80" }, { "name": "Length", "value": "14334" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ",\\xc3\\x9eq f\\x00\\x80" }, { "name": "Length", "value": "26152" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9cdX\\xe5\\x01f\\x00\\x80" }, { "name": "Length", "value": "26121" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "Fz\\x1f\\xcc6`\\x00\\x80" }, { "name": "Length", "value": "24638" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x839C\n\\xcd1\\x00\\x80" }, { "name": "Length", "value": "12757" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x8e\\xaa\\xf5eS+\\x00\\x80" }, { "name": "Length", "value": "11099" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x81\\x9b*\\x92\\x105\\x00\\x80" }, { "name": "Length", "value": "13592" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x85\\xd6|\\xeb4A\\x00\\x80" }, { "name": "Length", "value": "16700" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc7\\x0b\\xba\\xc3\\xef<\\x00\\x80" }, { "name": "Length", "value": "15607" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "k\\x92\\xff\\x1e?3\\x00\\x80" }, { "name": "Length", "value": "13127" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1f\\xe3\\xf0\\x88\\x882\\x00\\x80" }, { "name": "Length", "value": "12944" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x1e\\x83`\\xcdr(\\x00\\x80" }, { "name": "Length", "value": "10362" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd1\\x82\\xe1\\x98\\xc72\\x00\\x80" }, { "name": "Length", "value": "13007" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "x\\xa0\\xbe\\xb4\\xa5!\\x00\\x80" }, { "name": "Length", "value": "8621" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "(u\\xa7\\xa5\\x01.\\x00\\x80" }, { "name": "Length", "value": "11785" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa4\\xc0\\xd1\\xdb\\xd5#\\x00\\x80" }, { "name": "Length", "value": "9181" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-28 22:53:00,022", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "R\\x90\\xa3h\\x19'\\x00\\x80" }, { "name": "Length", "value": "10017" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xae\\xccF\\x9e\\xf7%\\x00\\x80" }, { "name": "Length", "value": "9727" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xd9\\xe0\\xe6!\\xa6*\\x00\\x80" }, { "name": "Length", "value": "10926" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": ">T\\x03\\xe1\\xd72\\x00\\x80" }, { "name": "Length", "value": "13023" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "!(\\xee\\xa0\\xbeS\\x00\\x80" }, { "name": "Length", "value": "21446" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\"\\xac\\x8aBIK\\x00\\x80" }, { "name": "Length", "value": "19281" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc6y\\xb4\\x91\\x84H\\x00\\x80" }, { "name": "Length", "value": "18572" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "Xc\\x99n\\xc6T\\x00\\x80" }, { "name": "Length", "value": "21710" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "Buffer", "value": "&:4:h:\\xa0:\\xa7:\\xc6:\\xd1:\\xdf:\\x17;\\x1e;=;H;V;\\x8e;\\x95;\\xb4;\\xbf;\\xcd;\t<\\x10<\\x1f<&1>F>K>a>h>\\xa3>\\xae>\\xbc>\\xf4>\\xfb>\n?\\x15?+?2?R?]?k?\\xa3?\\xaa?\\xd3?\\xde?\\xef?\\x00\\x00\\x00`\\x07\\x00\\x10\\x01\\x00\\x00'0.0W0b0p0\\xa80\\xaf0\\xce0\\xd90\\xe70!1(171B1X1_1f1\\x891\\x941\\xc91\\xe41\\xff1\\x17222M2h2\\x832\\x9e2\\xb92\\xd42\\xef2\n3%3@3[3r3\\x893\\xa03\\xb73\\xce3\\xe53!4W4a4\\x974\\xa14\\xd74\\xe14\\x175!5W5a5\\x975\\xa15\\xd75\\xe15\\x176!6[6\\x956" }, { "name": "Length", "value": "25524" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\"N&D\\x9d\\xd6\\x01\\x00\"N&D\\x9d\\xd6\\x01\\x00\"N&D\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4 " }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ";;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1798 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,\\xfc\\xefC\\xa4\\xe3\\xcf|\\xfcx\\xf6\\xc3E\\xcf-\\xdb\\x1fkynYg\\x9fjJy#\\xd7k\\xc8\\xfdRF\\xd6\\xf5\\x9c%u+\\x92Q\\xd0%U\\x97\\x12\\xedi\\xa9?\\x97Uj\\x8f;\\xee\\x98\\xb3l\\x1a\\x17\\x1cu\\xd2\\x1f\\x0cfw\\xe4\\x9d\\x949\\xe1\\x86\\x81\\x02\\x7f\\x0e\\x0f\\xf4\\xf0\\xba\\xed\\xf9g" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "M;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9b065", "parentcaller": "0x00c9cb60", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cb95", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cba7", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xe4\\x08\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1803 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "(\\xe4\\x08\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cbb2", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "(\\xe4\\x08\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cc07", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "}\\x9bPsT\\x0f\\x00\\x80" }, { "name": "Length", "value": "3932" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xee^^\\xcc\\xf2\r\\x00\\x80" }, { "name": "Length", "value": "3578" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x18\\xa6\\xe5\\xe6\\xfb\\x11\\x00\\x80" }, { "name": "Length", "value": "4611" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc5\\xae\\xd8\\xbb\\xed\\x0e\\x00\\x80" }, { "name": "Length", "value": "3829" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "c>fd\\xed\t\\x00\\x80" }, { "name": "Length", "value": "2549" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "`0\\xb7Q\\xd2\\x07\\x00\\x80" }, { "name": "Length", "value": "2010" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x827I\\xea~\t\\x00\\x80" }, { "name": "Length", "value": "2438" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xcdv\\x96tD\t\\x00\\x80" }, { "name": "Length", "value": "2380" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9c`T\\xf2@\t\\x00\\x80" }, { "name": "Length", "value": "2376" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xa1C\\x14\\xfc\\x91\n\\x00\\x80" }, { "name": "Length", "value": "2713" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "j\\xc2\\xe0\\xac\\x96\\x06\\x00\\x80" }, { "name": "Length", "value": "1694" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xeb\\xe3\\xe3\\xdd\\\\x0b\\x00\\x80" }, { "name": "Length", "value": "2916" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "h\\x03\\x16\\xdc\\xa8\\x0b\\x00\\x80" }, { "name": "Length", "value": "2992" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "#\\xf023\\x07\n\\x00\\x80" }, { "name": "Length", "value": "2575" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "RZ\\x85\\x016\\x11\\x00\\x80" }, { "name": "Length", "value": "4414" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\xc1\\xff_:,\\x17\\x00\\x80" }, { "name": "Length", "value": "5940" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x82\\x19\\xfa\\xc9N\\x02\\x00\\x80" }, { "name": "Length", "value": "598" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ccef", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "Buffer", "value": "\\x9b1\r\\xab\\xb3\\x01\\xdcG" }, { "name": "Length", "value": "443" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cd2f", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "Buffer", "value": "JZD5tc2Z0OnJtL2FsZ29yaXRobS9wa2V5LzIwMDk8L0FsZ29yaXRobUlkPg0KPFB1YmxpY0tleVZhbHVlPmJYTm1kRHB3YTJWNUx6SXdNRGt2WTNKNWNIUnZjSEp2Wm1sc1pTOW9iV0ZqTDNOb1lUSTFOZz09PC9QdWJsaWNLZXlWYWx1ZT4NCjwvUHVibGljS2V5Pg0KPFB1YmxpY0tleT4NCjxHcm91cElkPjM5ODg8L0dyb3VwSWQ+DQo8QWx" }, { "name": "Length", "value": "18396" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ca72", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000334" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x93L\\xc3#\\x9d\\xd6\\x01\\x00\\x93L\\xc3#\\x9d\\xd6\\x01\\x00\\x93L\\xc3#\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9ca7b", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cda0", "parentcaller": "0x00c9c7c9", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "M;\\xb0\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1828 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cddd", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cddd", "parentcaller": "0x00c9c7c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cc37", "parentcaller": "0x00c9c806", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00738000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9cc37", "parentcaller": "0x00c9c806", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00738000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c76bd1", "parentcaller": "0x00c6b6eb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\products.cab" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c6b71d", "parentcaller": "0x00c72263", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "6024" }, { "name": "ThreadId", "value": "5172" }, { "name": "Message", "value": "33769" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9beab", "parentcaller": "0x00c72263", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c9be51", "parentcaller": "0x00c72263", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c7ba53", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\DUDownload" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c7ba53", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\DUDownload\\Cab" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c7ba53", "parentcaller": "0x00c74024", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\DUDownload\\Setup" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1840 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000108" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c782de", "parentcaller": "0x00c747af", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c74713", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "ValueName", "value": "LaunchUserOOBE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c77dc6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c77dee", "parentcaller": "0x00c74772", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "ActionableCompat" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c77e2b", "parentcaller": "0x00c74772", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c7a0ea", "parentcaller": "0x00c761fd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c7623f", "parentcaller": "0x00c72768", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5012", "caller": "0x00c7a045", "parentcaller": "0x00c7830d", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-28 22:53:00,038", "thread_id": "5172", "caller": "0x00c6aefe", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76e60000" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c762a5", "parentcaller": "0x00c72768", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c727a8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1863 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c727a8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-28 22:53:00,256", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:00: Launching process: [C:\\$Windows.~WS\\Sources\\SetupHost.Exe] with command-line [/Download /Web ] in Session: [-1]\r\n" }, { "name": "Length", "value": "135" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c74713", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c7475a", "parentcaller": "0x00c7280d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c79c56", "parentcaller": "0x00c77dc6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c77dee", "parentcaller": "0x00c74772", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "SetupHostResult" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c77e2b", "parentcaller": "0x00c74772", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c7a0ea", "parentcaller": "0x00c761fd", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c7623f", "parentcaller": "0x00c72821", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c7a045", "parentcaller": "0x00c7830d", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c762a5", "parentcaller": "0x00c72821", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c6e00a", "parentcaller": "0x00c72865", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\NamedPipe\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c6e00a", "parentcaller": "0x00c72865", "category": "synchronization", "api": "NtCreateNamedPipeFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "NamedPipeHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x80100100" }, { "name": "PipeName", "value": "\\Device\\NamedPipe\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c6e00a", "parentcaller": "0x00c72865", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6e09b", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1881 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6e09b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "%\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-28 22:53:00,272", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:00: Launching: [C:\\$Windows.~WS\\Sources\\SetupHost.Exe] [/Download /Web ] from [C:\\$Windows.~WS\\Sources]!\r\n" }, { "name": "Length", "value": "124" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-28 22:53:00,303", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000330" }, { "name": "ThreadHandle", "value": "0x00000334" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" }, { "name": "CommandLine", "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web " }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "2088" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-28 22:53:00,303", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x75310000" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-28 22:53:00,303", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x75340000" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-28 22:53:00,303", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1887 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\apphelp" }, { "name": "DllBase", "value": "0x74cf0000" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\apphelp.dll" }, { "name": "BaseAddress", "value": "0x74cf0000" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6e0c4", "parentcaller": "0x00c72865", "category": "process", "api": "CreateProcessW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" }, { "name": "CommandLine", "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web " }, { "name": "CreationFlags", "value": "0x00000400" }, { "name": "ProcessId", "value": "2088" }, { "name": "ThreadId", "value": "4400" }, { "name": "ProcessHandle", "value": "0x00000330" }, { "name": "ThreadHandle", "value": "0x00000334" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6e10e", "parentcaller": "0x00c72865", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c76136", "parentcaller": "0x00c670ad", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c76161", "parentcaller": "0x00c670ad", "category": "system", "api": "GetSystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c76176", "parentcaller": "0x00c670ad", "category": "misc", "api": "SystemTimeToTzSpecificLocalTime", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c6715d", "parentcaller": "0x00c6e1d6", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa1\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1897 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c671aa", "parentcaller": "0x00c6e1d6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa1\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-28 22:53:00,538", "thread_id": "5012", "caller": "0x00c66ffa", "parentcaller": "0x00c67267", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:00: Waiting for process events...\r\n" }, { "name": "Length", "value": "52" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-28 22:53:00,584", "thread_id": "5012", "caller": "0x00c75491", "parentcaller": "0x00c6e1e7", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-28 22:53:29,553", "thread_id": "5900", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-28 22:53:29,553", "thread_id": "5900", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-28 22:53:29,553", "thread_id": "5900", "caller": "0x77999924", "parentcaller": "0x76c1c2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000320" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-28 22:53:29,553", "thread_id": "5900", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-28 22:53:29,569", "thread_id": "5916", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-28 22:53:29,569", "thread_id": "5916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-28 22:53:59,131", "thread_id": "1856", "caller": "0x77b2b6b6", "parentcaller": "0x77af607c", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1856" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-28 22:53:59,131", "thread_id": "1856", "caller": "0x77b2b6d9", "parentcaller": "0x77af607c", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-28 22:53:59,131", "thread_id": "5532", "caller": "0x77b2b6b6", "parentcaller": "0x77af607c", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5532" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-28 22:53:59,131", "thread_id": "5532", "caller": "0x77b2b6d9", "parentcaller": "0x77af607c", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-28 22:55:13,100", "thread_id": "5900", "caller": "0x77b2b6b6", "parentcaller": "0x77af607c", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5900" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-28 22:55:13,100", "thread_id": "5900", "caller": "0x7798ab1a", "parentcaller": "0x76c3d5f4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-28 22:55:13,100", "thread_id": "5900", "caller": "0x7798ab1a", "parentcaller": "0x76c3d676", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-28 22:55:13,100", "thread_id": "5900", "caller": "0x77b2b6d9", "parentcaller": "0x77af607c", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-28 22:55:13,100", "thread_id": "5916", "caller": "0x77b2b6b6", "parentcaller": "0x77af607c", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5916" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-28 22:55:13,100", "thread_id": "5916", "caller": "0x77b2b6d9", "parentcaller": "0x77af607c", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 1916 } ], "threads": [ "5012", "5932", "5956", "5936", "5948", "5172", "5900", "5916", "1856", "5532" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00c50000", "MainExeSize": "0x00b0a000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 2088, "process_name": "SetupHost.Exe", "parent_id": 6024, "module_path": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe", "first_seen": "2026-05-28 22:53:00,575", "calls": [ { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "4400", "caller": "0x6b477ac2", "parentcaller": "0x6b4789d4", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Compression" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "4400", "caller": "0x6b477ac2", "parentcaller": "0x6b4789d4", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cabinet" }, { "name": "BaseAddress", "value": "0x6b470000" }, { "name": "InitRoutine", "value": "0x6b477ec0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "4400", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "4400", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "64", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "64", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "2728", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "2728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "3004", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "3004", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "3036", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 22:53:00,622", "thread_id": "3036", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bcf03b", "parentcaller": "0x00bce857", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x00bcefe0" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce7ca", "parentcaller": "0x00bce88b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0091c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce7ca", "parentcaller": "0x00bce88b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02dc3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce7ca", "parentcaller": "0x00bce88b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02dc4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7d325", "parentcaller": "0x00b61655", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7d344", "parentcaller": "0x00b61655", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77aee100" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7d357", "parentcaller": "0x00b61655", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b19a30" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7d36a", "parentcaller": "0x00b61655", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b26b30" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7d37d", "parentcaller": "0x00b61655", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "EtwEventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b21320" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce568", "parentcaller": "0x00b61785", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce58f", "parentcaller": "0x00b61785", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" }, { "name": "FunctionName", "value": "EventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b21320" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce5a4", "parentcaller": "0x00b61785", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77aee100" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00bce5b9", "parentcaller": "0x00b61785", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75b50000" }, { "name": "FunctionName", "value": "EventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b19a30" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b73dd7", "parentcaller": "0x00b7424b", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x008f1d14", "arguments": [ { "name": "CommandLine", "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web " } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7424b", "parentcaller": "0x00bce926", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76497000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7424b", "parentcaller": "0x00bce926", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76497000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b73dde", "parentcaller": "0x00b7424b", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0090cee8", "arguments": [ { "name": "CommandLine", "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web " }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b706ef", "parentcaller": "0x00b73e09", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0091d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000c8" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x75d30000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d4eb20" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d497e0" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b8" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05c80000" }, { "name": "SectionOffset", "value": "0x005af31c" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b70754", "parentcaller": "0x00b73e09", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b73e27", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "CmdLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b73e27", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b73f5a", "parentcaller": "0x00b7424b", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x008f1d14", "arguments": [ { "name": "CommandLine", "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web " } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b73f61", "parentcaller": "0x00b7424b", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0090cf70", "arguments": [ { "name": "CommandLine", "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web " }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4400" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000224" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e90000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e9c000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e99000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore.dll" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x74e90000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x131a9a01", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x74e90000" }, { "name": "InitRoutine", "value": "0x74e947e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76ba0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0005f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76bfa000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\System32\\bcryptPrimitives.dll" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptPrimitives.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x76ba0000" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002d0" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002d0" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xf3\\x87t\\xffd\\xaf\\x00\\x00\\xd3W\\xd3$d\\xa3\\xfar\\xc0T\\xe9\\x1a?\\xb1\\xfd\\x89\\x00\\x82\\xf8\\x0e\\xf8\\xea\\x07\\xcf\\x9d3\\xed\\xb6\\x85\\x0f\\x9e\\x8feC\\xe9Rl%|\\xc8" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x76ba0000" }, { "name": "InitRoutine", "value": "0x76bd36c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76cb2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76cb2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f8f5", "parentcaller": "0x00b742f3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0091e000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af2470" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af0700" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00922000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 122 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002dc" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 22:53:00,637", "thread_id": "4400", "caller": "0x00b6f932", "parentcaller": "0x00b742f3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xf1Z\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xcc\\xf1Z\\x00\\x00\\x00\\x00\\x00\\x80\\xf1Z\\x00\\xa3\\x86\n\n\n\n\\x00@\\x00\\xa80\\x8f\\x00\\x16\\x00\\x18\\x00\\xd00\\x8f\\x00\\xcc\\xab\\x0c\\x00\\xff\\xff\\x00\\x00@\\\\xbew@\\\\xbew\\xdfY_\\xf9" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fbaa0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xb0\\xbc\\x8f\\x00\\x18@\\x8f\\x00\\xb8\\xbc\\x8f\\x00 @\\x8f\\x00\\xc0\\xbc\\x8f\\x00(@\\x8f\\x00\\x00\\x00\\xfcj\\xc0\\xd5\\xfdj\\x00P(\\x00@\\x00B\\x00\\xd0\\xbb\\x8f\\x00\\x18\\x00\\x1a\\x00\\xf8\\xbb\\x8f\\x00\\xcc\\xab\\x08\\x00\\xff\\xff\\x00\\x00<\\xb8\\x90\\x00P\\\\xbew\r\\xe17f" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fbcb0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xf0\\xbe\\x8f\\x00\\xa0\\xba\\x8f\\x00\\xf8\\xbe\\x8f\\x00\\xa8\\xba\\x8f\\x00\\xa0`\\x8f\\x00\\xb0\\xba\\x8f\\x00\\x00\\x00\\xd7v\\xc0Z\\xdav\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\x98\\xbd\\x8f\\x00\\x14\\x00\\x16\\x00\\xc0\\xbd\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd8[\\xbew\\xd8[\\xbew/V'~" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fbef0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x90`\\x8f\\x00\\xb0\\xbc\\x8f\\x00\\x98`\\x8f\\x00\\xb8\\xbc\\x8f\\x00\\xc0\\xd3\\x8f\\x00pb\\x8f\\x00\\x00\\x00]w`\\xcf`w\\x00\\xc0\\x19\\x00<\\x00>\\x00\\xf0^\\x8f\\x00\\x14\\x00\\x16\\x00\\x18_\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00L\\xaf\\x90\\x00\\x80[\\xbew\\xf0\\xb9\\x94\\x0c" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f6090" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "`b\\x8f\\x00\\xf0\\xbe\\x8f\\x00hb\\x8f\\x00\\xf8\\xbe\\x8f\\x00\\xb0\\xc2\\x8f\\x00\\xc0\\xbc\\x8f\\x00\\x00\\x00\\xd5v\\x00\\x00\\x00\\x00\\x00\\x80\\x01\\x00<\\x00>\\x00xa\\x8f\\x00\\x14\\x00\\x16\\x00\\xa0a\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x04e\\x8f\\x00\\x00\\\\xbew\\xd19\\x17p" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f6260" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc8d\\x8f\\x00\\x90`\\x8f\\x00\\xd0d\\x8f\\x00\\x98`\\x8f\\x00\\x00\\xbf\\x8f\\x00\\xd8d\\x8f\\x00\\x00\\x00\\xb1v\\xd0u\\xb1v\\x00@\\x02\\x00:\\x00<\\x00Hc\\x8f\\x00\\x12\\x00\\x14\\x00pc\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x88[\\xbew\\x88[\\xbew$\\xf3\\x19\\x07" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f64c8" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "x\\xc0\\x8f\\x00`b\\x8f\\x00\\x80\\xc0\\x8f\\x00hb\\x8f\\x00pb\\x8f\\x00\\x88\\xc0\\x8f\\x00\\x00\\x00xw\\xa0:~w\\x00\\x80\\x0e\\x00B\\x00D\\x00\\xb0e\\x8f\\x00\\x1a\\x00\\x1c\\x00\\xd8e\\x8f\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xb4\\xc0\\x8f\\x00\\xcc`\\x8f\\x00g\\x10$\\x04" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fc078" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xc2\\x8f\\x00\\xc8d\\x8f\\x00\\xa8\\xc2\\x8f\\x00\\xd0d\\x8f\\x00\\xd8d\\x8f\\x00\\xb0\\xc2\\x8f\\x00\\x00\\x00\\xf4v\\x00x\\xf5v\\x00\\xb0\\x07\\x00B\\x00D\\x00(\\xc1\\x8f\\x00\\x1a\\x00\\x1c\\x00P\\xc1\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xcc\\xcf\\x8f\\x00\\x04e\\x8f\\x00RDR\\xfd" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fc2a0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xe0\\xc6\\x8f\\x00x\\xc0\\x8f\\x00\\xe8\\xc6\\x8f\\x00\\x80\\xc0\\x8f\\x00\\x88\\xc0\\x8f\\x00\\xa0`\\x8f\\x00\\x00\\x00\\x9fv0\\xba\\xa1v\\x00\\x00\\x12\\x00@\\x00B\\x00\\x88\\xc3\\x8f\\x00\\x18\\x00\\x1a\\x00\\xb0\\xc3\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x008\\\\xbew8\\\\xbew\\xa2\\xd3cg" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fc6e0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x90\\xcf\\x8f\\x00\\xa0\\xc2\\x8f\\x00\\x98\\xcf\\x8f\\x00\\xa8\\xc2\\x8f\\x00\\xa0\\xcf\\x8f\\x00\\xc0\\xd3\\x8f\\x00\\x00\\x00\\xf4u\\xa0\\xbf\\x0bv\\x00p[\\x00>\\x00@\\x00\\xc8\\xc7\\x8f\\x00\\x16\\x00\\x18\\x00\\xf0\\xc7\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff<\\xd3\\x8f\\x00\\xa8[\\xbew\\xf8\\xbc\\xed\\xac" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcf90" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x80\\xcd\\x8f\\x00\\xe0\\xc6\\x8f\\x00\\x88\\xcd\\x8f\\x00\\xe8\\xc6\\x8f\\x00`\\xd2\\x8f\\x00\\xf0\\xc6\\x8f\\x00\\x00\\x00Pv\\x90xQv\\x00P\\x04\\x00>\\x00@\\x00\\xf8\\xdd\\x8f\\x00\\x16\\x00\\x18\\x00 \\xde\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x00\\\\xbew\\xb4\\xc0\\x8f\\x00NV\\xc3\\x03" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcd80" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xd1\\x8f\\x00\\x90\\xcf\\x8f\\x00\\xa8\\xd1\\x8f\\x00\\x98\\xcf\\x8f\\x00\\x10\\xd3\\x8f\\x00\\xb0\\xd1\\x8f\\x00\\x00\\x00\\xe6v `\\xe9v\\x00`\t\\x00@\\x00B\\x00\\x88\\xdf\\x8f\\x00\\x18\\x00\\x1a\\x00\\xb0\\xdf\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xfc\\xd5\\x8f\\x00\\xe8[\\xbewU\\x89C\\x99" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd1a0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "P\\xd2\\x8f\\x00\\x80\\xcd\\x8f\\x00X\\xd2\\x8f\\x00\\x88\\xcd\\x8f\\x00\\x90\\xcd\\x8f\\x00`\\xd2\\x8f\\x00\\x00\\x003w\\x10\\xb8Fw\\x00\\x00(\\x00>\\x00@\\x00\\x08\\xe1\\x8f\\x00\\x16\\x00\\x18\\x000\\xe1\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xc0[\\xbew\\xc0[\\xbew\\x83p\\x1a\\xa1" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd250" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "0\\xce\\x8f\\x00\\xa0\\xd1\\x8f\\x008\\xce\\x8f\\x00\\xa8\\xd1\\x8f\\x00\\xb0\\xd1\\x8f\\x00\\xa0\\xcf\\x8f\\x00\\x00\\x00\\xc0v\\x80\\xd3\\xc3v\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\xc0\\xe2\\x8f\\x00\\x14\\x00\\x16\\x00\\xe8\\xe2\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x0c\\xcd\\x8f\\x00\\x98[\\xbew\\xb5ly\\xae" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fce30" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "p\\xd6\\x8f\\x00P\\xd2\\x8f\\x00x\\xd6\\x8f\\x00X\\xd2\\x8f\\x00\\xf0\\xce\\x8f\\x00P\\xd0\\x8f\\x00\\x00\\x00Uv\\x90\\xf7Wv\\x00\\x80C\\x00@\\x00B\\x00\\xa0\\xe4\\x8f\\x00\\x18\\x00\\x1a\\x00\\xc8\\xe4\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x18\\\\xbew\\x18\\\\xbewe\\x94\\x9c\\xfa" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd670" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "@\\xd0\\x8f\\x000\\xce\\x8f\\x00H\\xd0\\x8f\\x008\\xce\\x8f\\x00P\\xd0\\x8f\\x00\\x10\\xd3\\x8f\\x00\\x00\\x00\\xf0v\\x10\\xcc\\xf0v\\x00\\xb0\\x03\\x00@\\x00B\\x00p\\xea\\x8f\\x00\\x18\\x00\\x1a\\x00\\x98\\xea\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00,\\xd1\\x8f\\x00\\x1c-\\x8f\\x00\\x13\\xc0\\x9eE" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd040" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x00\\xd3\\x8f\\x00p\\xd6\\x8f\\x00\\x08\\xd3\\x8f\\x00x\\xd6\\x8f\\x00@\\xce\\x8f\\x00\\x80\\xd6\\x8f\\x00\\x00\\x00[w\\xe0\\x93[w\\x00\\x90\\x01\\x00<\\x00>\\x00\\xd0\\xeb\\x8f\\x00\\x14\\x00\\x16\\x00\\xf8\\xeb\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x90[\\xbew\\x90[\\xbewp\\xa4\\xcbw" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd300" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xe0\\xce\\x8f\\x00@\\xd0\\x8f\\x00\\xe8\\xce\\x8f\\x00H\\xd0\\x8f\\x00\\x80\\xd6\\x8f\\x00\\x90\\xcd\\x8f\\x00\\x00\\x00\\x90p@5\\x90p\\x00\\x90\\x01\\x006\\x008\\x00x\\xee\\x8f\\x00\\x0e\\x00\\x10\\x00\\xa0\\xee\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00l\\xb3\\x90\\x00\\x1c\\xc7\\x8f\\x00EI\\xdeg" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcee0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc0\\xd5\\x8f\\x00\\x00\\xd3\\x8f\\x00\\xc8\\xd5\\x8f\\x00\\x08\\xd3\\x8f\\x00\\x80\\xcb\\x8f\\x00@\\xce\\x8f\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x006\\x008\\x00\\x18\\xef\\x8f\\x00\\x0e\\x00\\x10\\x00@\\xef\\x8f\\x00\\xcc*\\x08\\x00\\xff\\xff\\x00\\x00\\x0c\\xbd\\x90\\x00\\xb0[\\xbew-\\x94'\\xa8" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd5c0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "p\\xcb\\x8f\\x00\\xe0\\xce\\x8f\\x00x\\xcb\\x8f\\x00\\xe8\\xce\\x8f\\x00\\x00\\xd1\\x8f\\x00\\x80\\xcb\\x8f\\x00\\x00\\x00\\xf4j\\xe0\\x9e\\xf5j\\x00\\xd0\\x07\\x00@\\x00B\\x00\\xa8\\xef\\x8f\\x00\\x18\\x00\\x1a\\x00\\xd0\\xef\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xe8[\\xbew\\xbc\\xcd\\x8f\\x00\\xd0,\\x13\\xb9" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcb70" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xf0\\xd0\\x8f\\x00\\xc0\\xd5\\x8f\\x00\\xf8\\xd0\\x8f\\x00\\xc8\\xd5\\x8f\\x00\\xd0\\xd5\\x8f\\x00\\xf0\\xce\\x8f\\x00\\x00\\x00\\xccv\\x80$\\xd0v\\x00p\\x08\\x00<\\x00>\\x00\\xf0\\xf3\\x8f\\x00\\x14\\x00\\x16\\x00\\x18\\xf4\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd0[\\xbew\\xd0[\\xbew\\xa1\\xe8\\xef\\xc5" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd0f0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xb0\\xd3\\x8f\\x00p\\xcb\\x8f\\x00\\xb8\\xd3\\x8f\\x00x\\xcb\\x8f\\x00\\xe0\\xcc\\x8f\\x00\\xd0\\xd5\\x8f\\x00\\x00\\x00\\xf3j\\xd0]\\xf3j\\x00\\x00\\x01\\x00<\\x00>\\x00(\\xf8\\x8f\\x00\\x14\\x00\\x16\\x00P\\xf8\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xc8[\\xbew\\xac\\xd6\\x8f\\x005s\\xbc\\xd2" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd3b0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xd0\\xcc\\x8f\\x00\\xf0\\xd0\\x8f\\x00\\xd8\\xcc\\x8f\\x00\\xf8\\xd0\\x8f\\x00\\xf0\\xc6\\x8f\\x00\\x00\\xbf\\x8f\\x00\\x00\\x00\\xe3v\\x10D\\xe3v\\x00P\\x02\\x00:\\x00<\\x00\\xa8\\xf3\\x8f\\x00\\x12\\x00\\x14\\x00\\xd0\\xf3\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x0c\\xd8\\x8f\\x00p\\\\xbew\\x8f6\\x80\\x93" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fccd0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xd0\\xd7\\x8f\\x00\\xb0\\xd3\\x8f\\x00\\xd8\\xd7\\x8f\\x00\\xb8\\xd3\\x8f\\x00\\xe0\\xd7\\x8f\\x00\\x00\\xd1\\x8f\\x00\\x00\\x00\\xfcv\\xf0X\\x01w\\x00\\xf0\\x0f\\x00>\\x00@\\x00\\x98\\xf7\\x8f\\x00\\x16\\x00\\x18\\x00\\xc0\\xf7\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\x98[\\xbew\\x8c\\xd2\\x8f\\x00\\xfcN\\xe3\\x96" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd7d0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x80\\xd8\\x8f\\x00\\xd0\\xcc\\x8f\\x00\\x88\\xd8\\x8f\\x00\\xd8\\xcc\\x8f\\x00@\\xd9\\x8f\\x00\\xe0\\xcc\\x8f\\x00\\x00\\x00\\xcbu@K\\xcbu\\x000\\x06\\x00<\\x00>\\x00\\x80\\xf4\\x8f\\x00\\x14\\x00\\x16\\x00\\xa8\\xf4\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xec\\xb8\\x90\\x00\\xec\\xd3\\x8f\\x00\\x1c\\x9c&\\x03" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd880" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "0\\xd9\\x8f\\x00\\xd0\\xd7\\x8f\\x008\\xd9\\x8f\\x00\\xd8\\xd7\\x8f\\x00 \\xca\\x8f\\x00@\\xd9\\x8f\\x00\\x00\\x00\\xb5uP$\\xb6u\\x00\\xc0\\x07\\x00@\\x00B\\x00`\\xa8\\x90\\x00\\x18\\x00\\x1a\\x00\\x88\\xa8\\x90\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00`\\\\xbew`\\\\xbew\\xc8Z\\xae\\xae" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd930" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x10\\xca\\x8f\\x00\\x80\\xd8\\x8f\\x00\\x18\\xca\\x8f\\x00\\x88\\xd8\\x8f\\x00\\x90\\xd8\\x8f\\x00\\xe0\\xd7\\x8f\\x00\\x00\\x00\\xa5up\r\\xa7u\\x00`\\x07\\x00>\\x00@\\x00 \\xf1\\x8f\\x00\\x16\\x00\\x18\\x00H\\xf1\\x8f\\x00\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xf8[\\xbew\\xf8[\\xbew%\\x9c\\xbe\\xd4" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fca10" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc0\\xca\\x8f\\x000\\xd9\\x8f\\x00\\xc8\\xca\\x8f\\x008\\xd9\\x8f\\x00P\\xb5\\x90\\x00\\x90\\xd8\\x8f\\x00\\x00\\x00$w\\xe0\\xc9&w\\x000\\x0e\\x00:\\x00<\\x00`\\xf3\\x8f\\x00\\x12\\x00\\x14\\x00\\x88\\xf3\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\xbc\\xbd\\x90\\x00h\\\\xbew\\xd0\\xef\\xb5H" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcac0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "`\\xb9\\x90\\x00\\x10\\xca\\x8f\\x00h\\xb9\\x90\\x00\\x18\\xca\\x8f\\x00\\x10\\xb8\\x90\\x00 \\xba\\x90\\x00\\x00\\x00\nu\\x00\\x18\nu\\x00\\x80\\x00\\x00>\\x00@\\x00\\xe0\\xf7\\x8f\\x00\\x16\\x00\\x18\\x00\\x08\\xf8\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\x9c\\xb9\\x90\\x00\\xf0[\\xbew\\x0c\\xf7\\x87*" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b960" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x10\\xba\\x90\\x00\\xc0\\xca\\x8f\\x00\\x18\\xba\\x90\\x00\\xc8\\xca\\x8f\\x00@\\xb3\\x90\\x00\\x10\\xb8\\x90\\x00\\x00\\x00Gk\\xc0~Gk\\x00\\x00\\x02\\x00>\\x00@\\x00p\\xf8\\x8f\\x00\\x16\\x00\\x18\\x00\\x98\\xf8\\x8f\\x00\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xdc\\xc1\\x90\\x00\\xfc\\xca\\x8f\\x00\\xe0\\x15`>" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090ba10" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x00\\xb8\\x90\\x00`\\xb9\\x90\\x00\\x08\\xb8\\x90\\x00h\\xb9\\x90\\x00\\xd0\\xca\\x8f\\x00\\x90\\xbd\\x90\\x00\\x00\\x00\tup,\tu\\x00\\xf0\\x00\\x00@\\x00B\\x000\\xdb\\x90\\x00\\x18\\x00\\x1a\\x00X\\xdb\\x90\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00H\\\\xbewH\\\\xbew\\x1fX\\x01\\x88" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b800" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "@\\xb5\\x90\\x00\\x10\\xba\\x90\\x00H\\xb5\\x90\\x00\\x18\\xba\\x90\\x00p\\xb9\\x90\\x00\\xd0\\xca\\x8f\\x00\\x00\\x00xrp\\xf1|r\\x00\\xa0\\x0c\\x00>\\x00@\\x008\\xf4\\x8f\\x00\\x16\\x00\\x18\\x00`\\xf4\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00P\\\\xbew\\xdc\\xba\\x8f\\x00\\x18\\x1f>\\xba" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b540" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x80\\xbd\\x90\\x00\\x00\\xb8\\x90\\x00\\x88\\xbd\\x90\\x00\\x08\\xb8\\x90\\x00\\x90\\xbd\\x90\\x00 \\xca\\x8f\\x00\\x00\\x00\\xcet`*\\xcet\\x00\\xa0\\x00\\x00B\\x00D\\x00\\x00\\xd9\\x90\\x00\\x1a\\x00\\x1c\\x00(\\xd9\\x90\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00(\\\\xbew(\\\\xbewh\\xbd\\x90\\xa7" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090bd80" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "0\\xb3\\x90\\x00@\\xb5\\x90\\x008\\xb3\\x90\\x00H\\xb5\\x90\\x00 \\xba\\x90\\x00P\\xb5\\x90\\x00\\x00\\x00\\xd9t\\xd0\\xcc\\xd9t\\x00\\x10\\x02\\x00>\\x00@\\x00P\\xf8\\x90\\x00\\x16\\x00\\x18\\x00x\\xf8\\x90\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00h\\\\xbewL\\xca\\x8f\\x00\\xacF\\x9d~" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b330" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xc1\\x90\\x00\\x80\\xbd\\x90\\x00\\xa8\\xc1\\x90\\x00\\x88\\xbd\\x90\\x00\\xb0\\xc1\\x90\\x00p\\xb9\\x90\\x00\\x00\\x00\\xe9t\\xe0G\\xe9t\\x00\\xf0\\x00\\x00L\\x00N\\x00\\xe8\\xdc\\x91\\x00$\\x00&\\x00\\x10\\xdd\\x91\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xa8[\\xbew<\\xd3\\x8f\\x00\\xc5\\xea\\xab6" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090c1a0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x10\\xaf\\x90\\x000\\xb3\\x90\\x00\\x18\\xaf\\x90\\x008\\xb3\\x90\\x00 \\xaf\\x90\\x00@\\xb3\\x90\\x00\\x00\\x00\\xbav\\xc06\\xbdv\\x00\\xf0\\x05\\x00P\\x00R\\x00H;\\x91\\x00(\\x00*\\x00p;\\x91\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xf0[\\xbew\\x9c\\xb9\\x90\\x00\\x1e\\x8a\\xca\\xed" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090af10" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xb0\\xb8\\x90\\x00\\xa0\\xc1\\x90\\x00\\xb8\\xb8\\x90\\x00\\xa8\\xc1\\x90\\x00\\xc0\\xb8\\x90\\x00\\xb0\\xc1\\x90\\x00\\x00\\x00\\xdajp\\x8b\\xddj\\x00\\x80\\x18\\x00>\\x00@\\x00\\xd0\\xea\\x90\\x00\\x16\\x00\\x18\\x00\\xf8\\xea\\x90\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xfc\\xba\\x90\\x00,\\xbf\\x8f\\x00\\xa1\\x07]\\xdc" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b8b0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc0\\xba\\x90\\x00\\x10\\xaf\\x90\\x00\\xc8\\xba\\x90\\x00\\x18\\xaf\\x90\\x00\\xe0\\xbc\\x90\\x00 \\xaf\\x90\\x00\\x00\\x00\\xd7j\\xf0\\x17\\xd9j\\x00\\xb0\\x02\\x00>\\x00@\\x00\\x08\\xef\\x90\\x00\\x16\\x00\\x18\\x000\\xef\\x90\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00p\\\\xbew\\x0c\\xd8\\x8f\\x00\n\\x16\\xd0!" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090bac0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xd0\\xbc\\x90\\x00\\xb0\\xb8\\x90\\x00\\xd8\\xbc\\x90\\x00\\xb8\\xb8\\x90\\x00\\x9c]\\xbew\\xe0\\xbc\\x90\\x00\\x00\\x00\\xbak\\x00\"\\xbak\\x00\\xf0\\x01\\x006\\x008\\x00\\xe0L\\x92\\x00\\x0e\\x00\\x10\\x00\\x08M\\x92\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x80[\\xbewL\\xaf\\x90\\x00v\\x9aYa" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090bcd0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x8c]\\xbew\\xc0\\xba\\x90\\x00\\x94]\\xbew\\xc8\\xba\\x90\\x00\\xd0\\xba\\x90\\x00\\xc0\\xb8\\x90\\x00\\x00\\x00\\xb8kpy\\xb8k\\x00\\xc0\\x01\\x008\\x00:\\x00\\xe0\\xef\\x90\\x00\\x10\\x00\\x12\\x00\\x08\\xf0\\x90\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xb0[\\xbew\\x1c\\xcf\\x8f\\x00\\x81T\\xe4<" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0072500c" }, { "name": "Size", "value": "0x00000004" }, { "name": "Buffer", "value": "\\x80]\\xbew" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be5d94" }, { "name": "Size", "value": "0x00000004" }, { "name": "Buffer", "value": "\\xe8,\\x8f\\x00" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f2ce0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xf8+\\x8f\\x00\\x8c]\\xbew\\x00,\\x8f\\x00\\x94]\\xbew\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb4\\x00P\\xea\\xbc\\x00\\x00\\xe0\n\\x00J\\x00L\\x00\\xc8\\x1c\\x8f\\x00\\x1a\\x00\\x1c\\x00\\xf8\\x1c\\x8f\\x00\\xcc\\xaa\\x00\\x00\\xff\\xff\\xff\\xff\\xac\\xd6\\x8f\\x00\\xc8[\\xbew\\xac\n\\e" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f2bf8" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x001\\x8f\\x00\\xe0,\\x8f\\x00\\x081\\x8f\\x00\\xe8,\\x8f\\x00\\x804\\x8f\\x00\\x9c]\\xbew\\x00\\x00\\xacw\\x00\\x00\\x00\\x00\\x00@\\x1a\\x00:\\x00<\\x00\\x08+\\x8f\\x00\\x12\\x00\\x14\\x00 \\x84\\xacw\\xc4\\xaa\\x00\\x00\\xff\\xff\\x00\\x00 \\\\xbew \\\\xbew\\xd5\\xe7\\xb9:" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f3100" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "p4\\x8f\\x00\\xf8+\\x8f\\x00x4\\x8f\\x00\\x00,\\x8f\\x00(@\\x8f\\x00\\x804\\x8f\\x00\\x00\\x00\\xd3u\\xe0\\xf8\\xd4u\\x00\\x00\\x0f\\x00@\\x00B\\x00\\xe81\\x8f\\x00\\x18\\x00\\x1a\\x00\\x102\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x10\\\\xbew\\x10\\\\xbew\\xcf(`\\xf5" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f3470" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x18@\\x8f\\x00\\x001\\x8f\\x00 @\\x8f\\x00\\x081\\x8f\\x00\\x101\\x8f\\x00\\x08,\\x8f\\x00\\x00\\x00\\x87w\\xb0\\xf7\\x98w\\x00\\xa0#\\x00D\\x00F\\x00X5\\x8f\\x00\\x1c\\x00\\x1e\\x00\\x805\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xa0[\\xbew\\xa0[\\xbew\\xbfl\\x19O" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f4018" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xba\\x8f\\x00p4\\x8f\\x00\\xa8\\xba\\x8f\\x00x4\\x8f\\x00\\xb0\\xba\\x8f\\x00\\x101\\x8f\\x00\\x00\\x00\\xcft\\xe0\\x88\\xd2t\\x00\\xf0\t\\x00>\\x00@\\x00\\xa80\\x8f\\x00\\x16\\x00\\x18\\x00\\xd00\\x8f\\x00\\xcc\\xab\\x0c\\x00\\xff\\xff\\x00\\x00@\\\\xbew@\\\\xbew\\xdfY_\\xf9" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fbaa0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xb0\\xbc\\x8f\\x00\\x18@\\x8f\\x00\\xb8\\xbc\\x8f\\x00 @\\x8f\\x00\\xc0\\xbc\\x8f\\x00(@\\x8f\\x00\\x00\\x00\\xfcj\\xc0\\xd5\\xfdj\\x00P(\\x00@\\x00B\\x00\\xd0\\xbb\\x8f\\x00\\x18\\x00\\x1a\\x00\\xf8\\xbb\\x8f\\x00\\xcc\\xab\\x08\\x00\\xff\\xff\\x00\\x00<\\xb8\\x90\\x00P\\\\xbew\r\\xe17f" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fbcb0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xf0\\xbe\\x8f\\x00\\xa0\\xba\\x8f\\x00\\xf8\\xbe\\x8f\\x00\\xa8\\xba\\x8f\\x00\\xa0`\\x8f\\x00\\xb0\\xba\\x8f\\x00\\x00\\x00\\xd7v\\xc0Z\\xdav\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\x98\\xbd\\x8f\\x00\\x14\\x00\\x16\\x00\\xc0\\xbd\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd8[\\xbew\\xd8[\\xbew/V'~" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fbef0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x90`\\x8f\\x00\\xb0\\xbc\\x8f\\x00\\x98`\\x8f\\x00\\xb8\\xbc\\x8f\\x00\\xc0\\xd3\\x8f\\x00pb\\x8f\\x00\\x00\\x00]w`\\xcf`w\\x00\\xc0\\x19\\x00<\\x00>\\x00\\xf0^\\x8f\\x00\\x14\\x00\\x16\\x00\\x18_\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00L\\xaf\\x90\\x00\\x80[\\xbew\\xf0\\xb9\\x94\\x0c" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f6090" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "`b\\x8f\\x00\\xf0\\xbe\\x8f\\x00hb\\x8f\\x00\\xf8\\xbe\\x8f\\x00\\xb0\\xc2\\x8f\\x00\\xc0\\xbc\\x8f\\x00\\x00\\x00\\xd5v\\x00\\x00\\x00\\x00\\x00\\x80\\x01\\x00<\\x00>\\x00xa\\x8f\\x00\\x14\\x00\\x16\\x00\\xa0a\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x04e\\x8f\\x00\\x00\\\\xbew\\xd19\\x17p" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f6260" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc8d\\x8f\\x00\\x90`\\x8f\\x00\\xd0d\\x8f\\x00\\x98`\\x8f\\x00\\x00\\xbf\\x8f\\x00\\xd8d\\x8f\\x00\\x00\\x00\\xb1v\\xd0u\\xb1v\\x00@\\x02\\x00:\\x00<\\x00Hc\\x8f\\x00\\x12\\x00\\x14\\x00pc\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x88[\\xbew\\x88[\\xbew$\\xf3\\x19\\x07" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f64c8" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "x\\xc0\\x8f\\x00`b\\x8f\\x00\\x80\\xc0\\x8f\\x00hb\\x8f\\x00pb\\x8f\\x00\\x88\\xc0\\x8f\\x00\\x00\\x00xw\\xa0:~w\\x00\\x80\\x0e\\x00B\\x00D\\x00\\xb0e\\x8f\\x00\\x1a\\x00\\x1c\\x00\\xd8e\\x8f\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xb4\\xc0\\x8f\\x00\\xcc`\\x8f\\x00g\\x10$\\x04" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fc078" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xc2\\x8f\\x00\\xc8d\\x8f\\x00\\xa8\\xc2\\x8f\\x00\\xd0d\\x8f\\x00\\xd8d\\x8f\\x00\\xb0\\xc2\\x8f\\x00\\x00\\x00\\xf4v\\x00x\\xf5v\\x00\\xb0\\x07\\x00B\\x00D\\x00(\\xc1\\x8f\\x00\\x1a\\x00\\x1c\\x00P\\xc1\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xcc\\xcf\\x8f\\x00\\x04e\\x8f\\x00RDR\\xfd" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fc2a0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xe0\\xc6\\x8f\\x00x\\xc0\\x8f\\x00\\xe8\\xc6\\x8f\\x00\\x80\\xc0\\x8f\\x00\\x88\\xc0\\x8f\\x00\\xa0`\\x8f\\x00\\x00\\x00\\x9fv0\\xba\\xa1v\\x00\\x00\\x12\\x00@\\x00B\\x00\\x88\\xc3\\x8f\\x00\\x18\\x00\\x1a\\x00\\xb0\\xc3\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x008\\\\xbew8\\\\xbew\\xa2\\xd3cg" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fc6e0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x90\\xcf\\x8f\\x00\\xa0\\xc2\\x8f\\x00\\x98\\xcf\\x8f\\x00\\xa8\\xc2\\x8f\\x00\\xa0\\xcf\\x8f\\x00\\xc0\\xd3\\x8f\\x00\\x00\\x00\\xf4u\\xa0\\xbf\\x0bv\\x00p[\\x00>\\x00@\\x00\\xc8\\xc7\\x8f\\x00\\x16\\x00\\x18\\x00\\xf0\\xc7\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff<\\xd3\\x8f\\x00\\xa8[\\xbew\\xf8\\xbc\\xed\\xac" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcf90" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x80\\xcd\\x8f\\x00\\xe0\\xc6\\x8f\\x00\\x88\\xcd\\x8f\\x00\\xe8\\xc6\\x8f\\x00`\\xd2\\x8f\\x00\\xf0\\xc6\\x8f\\x00\\x00\\x00Pv\\x90xQv\\x00P\\x04\\x00>\\x00@\\x00\\xf8\\xdd\\x8f\\x00\\x16\\x00\\x18\\x00 \\xde\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x00\\\\xbew\\xb4\\xc0\\x8f\\x00NV\\xc3\\x03" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcd80" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xd1\\x8f\\x00\\x90\\xcf\\x8f\\x00\\xa8\\xd1\\x8f\\x00\\x98\\xcf\\x8f\\x00\\x10\\xd3\\x8f\\x00\\xb0\\xd1\\x8f\\x00\\x00\\x00\\xe6v `\\xe9v\\x00`\t\\x00@\\x00B\\x00\\x88\\xdf\\x8f\\x00\\x18\\x00\\x1a\\x00\\xb0\\xdf\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xfc\\xd5\\x8f\\x00\\xe8[\\xbewU\\x89C\\x99" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd1a0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "P\\xd2\\x8f\\x00\\x80\\xcd\\x8f\\x00X\\xd2\\x8f\\x00\\x88\\xcd\\x8f\\x00\\x90\\xcd\\x8f\\x00`\\xd2\\x8f\\x00\\x00\\x003w\\x10\\xb8Fw\\x00\\x00(\\x00>\\x00@\\x00\\x08\\xe1\\x8f\\x00\\x16\\x00\\x18\\x000\\xe1\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xc0[\\xbew\\xc0[\\xbew\\x83p\\x1a\\xa1" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd250" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "0\\xce\\x8f\\x00\\xa0\\xd1\\x8f\\x008\\xce\\x8f\\x00\\xa8\\xd1\\x8f\\x00\\xb0\\xd1\\x8f\\x00\\xa0\\xcf\\x8f\\x00\\x00\\x00\\xc0v\\x80\\xd3\\xc3v\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\xc0\\xe2\\x8f\\x00\\x14\\x00\\x16\\x00\\xe8\\xe2\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x0c\\xcd\\x8f\\x00\\x98[\\xbew\\xb5ly\\xae" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fce30" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "p\\xd6\\x8f\\x00P\\xd2\\x8f\\x00x\\xd6\\x8f\\x00X\\xd2\\x8f\\x00\\xf0\\xce\\x8f\\x00P\\xd0\\x8f\\x00\\x00\\x00Uv\\x90\\xf7Wv\\x00\\x80C\\x00@\\x00B\\x00\\xa0\\xe4\\x8f\\x00\\x18\\x00\\x1a\\x00\\xc8\\xe4\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x18\\\\xbew\\x18\\\\xbewe\\x94\\x9c\\xfa" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd670" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "@\\xd0\\x8f\\x000\\xce\\x8f\\x00H\\xd0\\x8f\\x008\\xce\\x8f\\x00P\\xd0\\x8f\\x00\\x10\\xd3\\x8f\\x00\\x00\\x00\\xf0v\\x10\\xcc\\xf0v\\x00\\xb0\\x03\\x00@\\x00B\\x00p\\xea\\x8f\\x00\\x18\\x00\\x1a\\x00\\x98\\xea\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00,\\xd1\\x8f\\x00\\x1c-\\x8f\\x00\\x13\\xc0\\x9eE" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd040" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x00\\xd3\\x8f\\x00p\\xd6\\x8f\\x00\\x08\\xd3\\x8f\\x00x\\xd6\\x8f\\x00@\\xce\\x8f\\x00\\x80\\xd6\\x8f\\x00\\x00\\x00[w\\xe0\\x93[w\\x00\\x90\\x01\\x00<\\x00>\\x00\\xd0\\xeb\\x8f\\x00\\x14\\x00\\x16\\x00\\xf8\\xeb\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x90[\\xbew\\x90[\\xbewp\\xa4\\xcbw" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd300" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xe0\\xce\\x8f\\x00@\\xd0\\x8f\\x00\\xe8\\xce\\x8f\\x00H\\xd0\\x8f\\x00\\x80\\xd6\\x8f\\x00\\x90\\xcd\\x8f\\x00\\x00\\x00\\x90p@5\\x90p\\x00\\x90\\x01\\x006\\x008\\x00x\\xee\\x8f\\x00\\x0e\\x00\\x10\\x00\\xa0\\xee\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00l\\xb3\\x90\\x00\\x1c\\xc7\\x8f\\x00EI\\xdeg" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcee0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc0\\xd5\\x8f\\x00\\x00\\xd3\\x8f\\x00\\xc8\\xd5\\x8f\\x00\\x08\\xd3\\x8f\\x00\\x80\\xcb\\x8f\\x00@\\xce\\x8f\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x006\\x008\\x00\\x18\\xef\\x8f\\x00\\x0e\\x00\\x10\\x00@\\xef\\x8f\\x00\\xcc*\\x08\\x00\\xff\\xff\\x00\\x00\\x0c\\xbd\\x90\\x00\\xb0[\\xbew-\\x94'\\xa8" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd5c0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "p\\xcb\\x8f\\x00\\xe0\\xce\\x8f\\x00x\\xcb\\x8f\\x00\\xe8\\xce\\x8f\\x00\\x00\\xd1\\x8f\\x00\\x80\\xcb\\x8f\\x00\\x00\\x00\\xf4j\\xe0\\x9e\\xf5j\\x00\\xd0\\x07\\x00@\\x00B\\x00\\xa8\\xef\\x8f\\x00\\x18\\x00\\x1a\\x00\\xd0\\xef\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xe8[\\xbew\\xbc\\xcd\\x8f\\x00\\xd0,\\x13\\xb9" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcb70" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xf0\\xd0\\x8f\\x00\\xc0\\xd5\\x8f\\x00\\xf8\\xd0\\x8f\\x00\\xc8\\xd5\\x8f\\x00\\xd0\\xd5\\x8f\\x00\\xf0\\xce\\x8f\\x00\\x00\\x00\\xccv\\x80$\\xd0v\\x00p\\x08\\x00<\\x00>\\x00\\xf0\\xf3\\x8f\\x00\\x14\\x00\\x16\\x00\\x18\\xf4\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd0[\\xbew\\xd0[\\xbew\\xa1\\xe8\\xef\\xc5" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd0f0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xb0\\xd3\\x8f\\x00p\\xcb\\x8f\\x00\\xb8\\xd3\\x8f\\x00x\\xcb\\x8f\\x00\\xe0\\xcc\\x8f\\x00\\xd0\\xd5\\x8f\\x00\\x00\\x00\\xf3j\\xd0]\\xf3j\\x00\\x00\\x01\\x00<\\x00>\\x00(\\xf8\\x8f\\x00\\x14\\x00\\x16\\x00P\\xf8\\x8f\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xc8[\\xbew\\xac\\xd6\\x8f\\x005s\\xbc\\xd2" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd3b0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xd0\\xcc\\x8f\\x00\\xf0\\xd0\\x8f\\x00\\xd8\\xcc\\x8f\\x00\\xf8\\xd0\\x8f\\x00\\xf0\\xc6\\x8f\\x00\\x00\\xbf\\x8f\\x00\\x00\\x00\\xe3v\\x10D\\xe3v\\x00P\\x02\\x00:\\x00<\\x00\\xa8\\xf3\\x8f\\x00\\x12\\x00\\x14\\x00\\xd0\\xf3\\x8f\\x00\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x0c\\xd8\\x8f\\x00p\\\\xbew\\x8f6\\x80\\x93" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fccd0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xd0\\xd7\\x8f\\x00\\xb0\\xd3\\x8f\\x00\\xd8\\xd7\\x8f\\x00\\xb8\\xd3\\x8f\\x00\\xe0\\xd7\\x8f\\x00\\x00\\xd1\\x8f\\x00\\x00\\x00\\xfcv\\xf0X\\x01w\\x00\\xf0\\x0f\\x00>\\x00@\\x00\\x98\\xf7\\x8f\\x00\\x16\\x00\\x18\\x00\\xc0\\xf7\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\x98[\\xbew\\x8c\\xd2\\x8f\\x00\\xfcN\\xe3\\x96" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd7d0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x80\\xd8\\x8f\\x00\\xd0\\xcc\\x8f\\x00\\x88\\xd8\\x8f\\x00\\xd8\\xcc\\x8f\\x00@\\xd9\\x8f\\x00\\xe0\\xcc\\x8f\\x00\\x00\\x00\\xcbu@K\\xcbu\\x000\\x06\\x00<\\x00>\\x00\\x80\\xf4\\x8f\\x00\\x14\\x00\\x16\\x00\\xa8\\xf4\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xec\\xb8\\x90\\x00\\xec\\xd3\\x8f\\x00\\x1c\\x9c&\\x03" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd880" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "0\\xd9\\x8f\\x00\\xd0\\xd7\\x8f\\x008\\xd9\\x8f\\x00\\xd8\\xd7\\x8f\\x00 \\xca\\x8f\\x00@\\xd9\\x8f\\x00\\x00\\x00\\xb5uP$\\xb6u\\x00\\xc0\\x07\\x00@\\x00B\\x00`\\xa8\\x90\\x00\\x18\\x00\\x1a\\x00\\x88\\xa8\\x90\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00`\\\\xbew`\\\\xbew\\xc8Z\\xae\\xae" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fd930" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x10\\xca\\x8f\\x00\\x80\\xd8\\x8f\\x00\\x18\\xca\\x8f\\x00\\x88\\xd8\\x8f\\x00\\x90\\xd8\\x8f\\x00\\xe0\\xd7\\x8f\\x00\\x00\\x00\\xa5up\r\\xa7u\\x00`\\x07\\x00>\\x00@\\x00 \\xf1\\x8f\\x00\\x16\\x00\\x18\\x00H\\xf1\\x8f\\x00\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xf8[\\xbew\\xf8[\\xbew%\\x9c\\xbe\\xd4" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fca10" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc0\\xca\\x8f\\x000\\xd9\\x8f\\x00\\xc8\\xca\\x8f\\x008\\xd9\\x8f\\x00P\\xb5\\x90\\x00\\x90\\xd8\\x8f\\x00\\x00\\x00$w\\xe0\\xc9&w\\x000\\x0e\\x00:\\x00<\\x00`\\xf3\\x8f\\x00\\x12\\x00\\x14\\x00\\x88\\xf3\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\xbc\\xbd\\x90\\x00h\\\\xbew\\xd0\\xef\\xb5H" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008fcac0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "`\\xb9\\x90\\x00\\x10\\xca\\x8f\\x00h\\xb9\\x90\\x00\\x18\\xca\\x8f\\x00\\x10\\xb8\\x90\\x00 \\xba\\x90\\x00\\x00\\x00\nu\\x00\\x18\nu\\x00\\x80\\x00\\x00>\\x00@\\x00\\xe0\\xf7\\x8f\\x00\\x16\\x00\\x18\\x00\\x08\\xf8\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\x9c\\xb9\\x90\\x00\\xf0[\\xbew\\x0c\\xf7\\x87*" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b960" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x10\\xba\\x90\\x00\\xc0\\xca\\x8f\\x00\\x18\\xba\\x90\\x00\\xc8\\xca\\x8f\\x00@\\xb3\\x90\\x00\\x10\\xb8\\x90\\x00\\x00\\x00Gk\\xc0~Gk\\x00\\x00\\x02\\x00>\\x00@\\x00p\\xf8\\x8f\\x00\\x16\\x00\\x18\\x00\\x98\\xf8\\x8f\\x00\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xdc\\xc1\\x90\\x00\\xfc\\xca\\x8f\\x00\\xe0\\x15`>" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090ba10" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x00\\xb8\\x90\\x00`\\xb9\\x90\\x00\\x08\\xb8\\x90\\x00h\\xb9\\x90\\x00\\xd0\\xca\\x8f\\x00\\x90\\xbd\\x90\\x00\\x00\\x00\tup,\tu\\x00\\xf0\\x00\\x00@\\x00B\\x000\\xdb\\x90\\x00\\x18\\x00\\x1a\\x00X\\xdb\\x90\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00H\\\\xbewH\\\\xbew\\x1fX\\x01\\x88" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b800" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "@\\xb5\\x90\\x00\\x10\\xba\\x90\\x00H\\xb5\\x90\\x00\\x18\\xba\\x90\\x00p\\xb9\\x90\\x00\\xd0\\xca\\x8f\\x00\\x00\\x00xrp\\xf1|r\\x00\\xa0\\x0c\\x00>\\x00@\\x008\\xf4\\x8f\\x00\\x16\\x00\\x18\\x00`\\xf4\\x8f\\x00\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00P\\\\xbew\\xdc\\xba\\x8f\\x00\\x18\\x1f>\\xba" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b540" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x80\\xbd\\x90\\x00\\x00\\xb8\\x90\\x00\\x88\\xbd\\x90\\x00\\x08\\xb8\\x90\\x00\\x90\\xbd\\x90\\x00 \\xca\\x8f\\x00\\x00\\x00\\xcet`*\\xcet\\x00\\xa0\\x00\\x00B\\x00D\\x00\\x00\\xd9\\x90\\x00\\x1a\\x00\\x1c\\x00(\\xd9\\x90\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00(\\\\xbew(\\\\xbewh\\xbd\\x90\\xa7" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090bd80" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "0\\xb3\\x90\\x00@\\xb5\\x90\\x008\\xb3\\x90\\x00H\\xb5\\x90\\x00 \\xba\\x90\\x00P\\xb5\\x90\\x00\\x00\\x00\\xd9t\\xd0\\xcc\\xd9t\\x00\\x10\\x02\\x00>\\x00@\\x00P\\xf8\\x90\\x00\\x16\\x00\\x18\\x00x\\xf8\\x90\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00h\\\\xbewL\\xca\\x8f\\x00\\xacF\\x9d~" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b330" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xa0\\xc1\\x90\\x00\\x80\\xbd\\x90\\x00\\xa8\\xc1\\x90\\x00\\x88\\xbd\\x90\\x00\\xb0\\xc1\\x90\\x00p\\xb9\\x90\\x00\\x00\\x00\\xe9t\\xe0G\\xe9t\\x00\\xf0\\x00\\x00L\\x00N\\x00\\xe8\\xdc\\x91\\x00$\\x00&\\x00\\x10\\xdd\\x91\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xa8[\\xbew<\\xd3\\x8f\\x00\\xc5\\xea\\xab6" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090c1a0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x10\\xaf\\x90\\x000\\xb3\\x90\\x00\\x18\\xaf\\x90\\x008\\xb3\\x90\\x00 \\xaf\\x90\\x00@\\xb3\\x90\\x00\\x00\\x00\\xbav\\xc06\\xbdv\\x00\\xf0\\x05\\x00P\\x00R\\x00H;\\x91\\x00(\\x00*\\x00p;\\x91\\x00\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xf0[\\xbew\\x9c\\xb9\\x90\\x00\\x1e\\x8a\\xca\\xed" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090af10" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xb0\\xb8\\x90\\x00\\xa0\\xc1\\x90\\x00\\xb8\\xb8\\x90\\x00\\xa8\\xc1\\x90\\x00\\xc0\\xb8\\x90\\x00\\xb0\\xc1\\x90\\x00\\x00\\x00\\xdajp\\x8b\\xddj\\x00\\x80\\x18\\x00>\\x00@\\x00\\xd0\\xea\\x90\\x00\\x16\\x00\\x18\\x00\\xf8\\xea\\x90\\x00\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xfc\\xba\\x90\\x00,\\xbf\\x8f\\x00\\xa1\\x07]\\xdc" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090b8b0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xc0\\xba\\x90\\x00\\x10\\xaf\\x90\\x00\\xc8\\xba\\x90\\x00\\x18\\xaf\\x90\\x00\\xe0\\xbc\\x90\\x00 \\xaf\\x90\\x00\\x00\\x00\\xd7j\\xf0\\x17\\xd9j\\x00\\xb0\\x02\\x00>\\x00@\\x00\\x08\\xef\\x90\\x00\\x16\\x00\\x18\\x000\\xef\\x90\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00p\\\\xbew\\x0c\\xd8\\x8f\\x00\n\\x16\\xd0!" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090bac0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xd0\\xbc\\x90\\x00\\xb0\\xb8\\x90\\x00\\xd8\\xbc\\x90\\x00\\xb8\\xb8\\x90\\x00\\x9c]\\xbew\\xe0\\xbc\\x90\\x00\\x00\\x00\\xbak\\x00\"\\xbak\\x00\\xf0\\x01\\x006\\x008\\x00\\xe0L\\x92\\x00\\x0e\\x00\\x10\\x00\\x08M\\x92\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x80[\\xbewL\\xaf\\x90\\x00v\\x9aYa" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0090bcd0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\x8c]\\xbew\\xc0\\xba\\x90\\x00\\x94]\\xbew\\xc8\\xba\\x90\\x00\\xd0\\xba\\x90\\x00\\xc0\\xb8\\x90\\x00\\x00\\x00\\xb8kpy\\xb8k\\x00\\xc0\\x01\\x008\\x00:\\x00\\xe0\\xef\\x90\\x00\\x10\\x00\\x12\\x00\\x08\\xf0\\x90\\x00\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xb0[\\xbew\\x1c\\xcf\\x8f\\x00\\x81T\\xe4<" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0072500c" }, { "name": "Size", "value": "0x00000004" }, { "name": "Buffer", "value": "\\x80]\\xbew" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be5d94" }, { "name": "Size", "value": "0x00000004" }, { "name": "Buffer", "value": "\\xe8,\\x8f\\x00" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-28 22:53:00,965", "thread_id": "4400", "caller": "0x00bbd86c", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x008f2ce0" }, { "name": "Size", "value": "0x00000048" }, { "name": "Buffer", "value": "\\xf8+\\x8f\\x00\\x8c]\\xbew\\x00,\\x8f\\x00\\x94]\\xbew\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb4\\x00P\\xea\\xbc\\x00\\x00\\xe0\n\\x00J\\x00L\\x00\\xc8\\x1c\\x8f\\x00\\x1a\\x00\\x1c\\x00\\xf8\\x1c\\x8f\\x00\\xcc\\xaa\\x00\\x00\\xff\\xff\\xff\\xff\\xac\\xd6\\x8f\\x00\\xc8[\\xbew\\xac\n\\e" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-28 22:53:01,028", "thread_id": "4400", "caller": "0x00bbd8ee", "parentcaller": "0x00bbd74d", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 100, "id": 722 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000310" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\SLC" }, { "name": "DllBase", "value": "0x6bba0000" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sppc" }, { "name": "DllBase", "value": "0x6bb80000" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6bb80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bbda0a", "parentcaller": "0x00bbd74d", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6bba0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc6478", "parentcaller": "0x00bc4115", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd9\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG Host OS License State [ Not-Genuine ]\r\n" }, { "name": "Length", "value": "95" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc6478", "parentcaller": "0x00bc4115", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x008\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG Host OS Architecture [ x64 ]\r\n" }, { "name": "Length", "value": "87" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc6478", "parentcaller": "0x00bc4115", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [ { "name": "Status", "value": "Log limit reached" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8f\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8f\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG Host OS Language Id [ 1033 ]\r\n" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG User UI Language Id [ 1033 ]\r\n" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "?\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG Host OS Edition [ Professional ]\r\n" }, { "name": "Length", "value": "96" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9f\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG Host OS Version [ 10.0.19045 ]\r\n" }, { "name": "Length", "value": "94" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00b7c6f6", "parentcaller": "0x00b7b5a2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x00000304" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00b7b5cc", "parentcaller": "0x00b6cae1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "BuildLabEx" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00b7b5cc", "parentcaller": "0x00b6cae1", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "BuildLabEx" }, { "name": "Data", "value": "19041.1.amd64fre.vb_release.191206-1406" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00b7b66a", "parentcaller": "0x00b6cae1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfd\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG Host OS Build String [ 19041.1.amd64fre.vb_release.191206-1406 ]\r\n" }, { "name": "Length", "value": "123" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00x\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "x\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG SetupHost::InitializeComponents\r\n" }, { "name": "Length", "value": "83" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xcb\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcb\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll]...\r\n" }, { "name": "Length", "value": "167" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-28 22:53:01,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-28 22:53:01,840", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MFC42u" }, { "name": "DllBase", "value": "0x6b490000" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-28 22:53:01,840", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\\COMCTL32" }, { "name": "DllBase", "value": "0x72970000" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\COMDLG32" }, { "name": "DllBase", "value": "0x75e20000" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WMsgAPI" }, { "name": "DllBase", "value": "0x69e70000" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\$Windows.~WS\\Sources\\WDSCORE" }, { "name": "DllBase", "value": "0x69e30000" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UxTheme" }, { "name": "DllBase", "value": "0x747b0000" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr" }, { "name": "DllBase", "value": "0x69e80000" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "MSVCRT.DLL" }, { "name": "BaseAddress", "value": "0x76d70000" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "4400" }, { "name": "Module", "value": "KERNEL32.DLL" }, { "name": "Return Address", "value": "0x75d5274c" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "BaseAddress", "value": "0x69e80000" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x69e80000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b7897a", "parentcaller": "0x00b6cd31", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MediaSetupUIMgr.dll" }, { "name": "ModuleHandle", "value": "0x69e80000" }, { "name": "FunctionName", "value": "CreateSetupObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x69ebf4a0" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00r\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "r\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG SetupHost: Loading complete.\r\n" }, { "name": "Length", "value": "80" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-28 22:53:01,856", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "misc", "api": "GetCursorPos", "status": false, "return": "0x00000000", "arguments": [ { "name": "x", "value": "0" }, { "name": "y", "value": "0" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000034c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x76dd6d60" }, { "name": "Parameter", "value": "0x02dc3298" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "2320" }, { "name": "ProcessId", "value": "2088" }, { "name": "Module", "value": "msvcrt.dll" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "threading", "api": "CreateThread", "status": true, "return": "0x0000034c", "arguments": [ { "name": "StartRoutine", "value": "0x76dd6d60" }, { "name": "ModuleName", "value": "msvcrt.dll" }, { "name": "Parameter", "value": "0x02dc3298" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "2320" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000034c" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "2320" }, { "name": "ProcessId", "value": "2088" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "threading", "api": "NtSuspendThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000034c" }, { "name": "SuspendCount", "value": "0" }, { "name": "ThreadId", "value": "2320" }, { "name": "ProcessId", "value": "2088" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc2\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc2\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG CInstallUI::Initialize\r\n" }, { "name": "Length", "value": "74" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000340" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000344" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000034c" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "2320" }, { "name": "ProcessId", "value": "2088" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00b6bcc6", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Info MOUPG SetupHost: Loading ID: [3d3ad714-f8d8-4c84-ad5f-10938c2f3339] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\r\n" }, { "name": "Length", "value": "161" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USP10" }, { "name": "DllBase", "value": "0x6b330000" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msls31" }, { "name": "DllBase", "value": "0x6b2f0000" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\RICHED20" }, { "name": "DllBase", "value": "0x6b350000" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\RICHED32" }, { "name": "DllBase", "value": "0x6cd10000" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "RICHED32.DLL" }, { "name": "BaseAddress", "value": "0x6cd10000" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x69eb8835", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "MediaSetupUIMgr.dll" }, { "name": "ModuleHandle", "value": "0x69e80000" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x75d4069b", "parentcaller": "0x75d404d5", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\$Windows.~WS\\Sources\\Lang.ini" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x75d4076e", "parentcaller": "0x75d404d5", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Lang.ini" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x75d40c12", "parentcaller": "0x75d40ba2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000030c" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x75d40c2c", "parentcaller": "0x75d40ba2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00!9\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x75d40c37", "parentcaller": "0x75d40ba2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc0c12", "parentcaller": "0x00bc0cdd", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00942000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc0501", "parentcaller": "0x00bc057d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\Panther" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Panther" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" }, { "name": "Buffer", "value": "\\xfeff" }, { "name": "Length", "value": "3" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:01, Error MOUPG CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]\r\n" }, { "name": "Length", "value": "125" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002fc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002fc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-28 22:53:01,872", "thread_id": "2320", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002fc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" }, { "name": "Buffer", "value": "\n\n\n\n\r\n" }, { "name": "Length", "value": "79" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-28 22:53:06,809", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00Z\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-28 22:53:06,809", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "Z\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info SP Try to merge diagnostics data from default new system data file\r\n" }, { "name": "Length", "value": "115" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xcd\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcd\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info SP Skip merge diagnostics data since C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat is not exist\r\n" }, { "name": "Length", "value": "150" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00c\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "c\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info SP Finish merge diagnostics data\r\n" }, { "name": "Length", "value": "81" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xb4\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb4\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info SP Start uploading diagnostics data for setup platform\r\n" }, { "name": "Length", "value": "103" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x1b\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1b\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info SP Not opted-in to SQM. Diagnostics data will NOT be uploaded\r\n" }, { "name": "Length", "value": "110" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info Key CollectTrace is not available.\r\n" }, { "name": "Length", "value": "86" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 1, "id": 2323 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xdf\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdf\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000454" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info SP Closing Panther Logging\r\n" }, { "name": "Length", "value": "75" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000046c" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\"\\x9a\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" }, { "name": "MutexName", "value": "Global\\WdsSetupLogInit" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x69e4d580" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x69844640" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00974000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009ac000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044c" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" }, { "name": "Buffer", "value": "\n\n" }, { "name": "Length", "value": "18" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000460" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x8b\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000460" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8b\\x13\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-28 22:53:06,825", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000460" }, { "name": "HandleName", "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" }, { "name": "Buffer", "value": "\n\n" }, { "name": "Length", "value": "18" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06170000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a4" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 1, "id": 2357 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a0" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00958000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0096e000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00966000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0095d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00958000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039c" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-28 22:53:06,840", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform" }, { "name": "DllBase", "value": "0x69520000" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\$Windows.~WS\\Sources\\unbcl" }, { "name": "DllBase", "value": "0x69450000" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69450000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x75f20000" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VirtDisk" }, { "name": "DllBase", "value": "0x69440000" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\FLTLIB" }, { "name": "DllBase", "value": "0x70260000" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70260000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69440000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\XmlLite" }, { "name": "DllBase", "value": "0x72850000" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72850000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b6be98", "parentcaller": "0x00b69129", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69520000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00'\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "'\\x0f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG SetupHost: Automation information not found. Releasing automation object.\r\n" }, { "name": "Length", "value": "125" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2401 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa4\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa4\\x0f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG SetupHost: Attempting to initialize OneSettings values\r\n" }, { "name": "Length", "value": "106" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcae93", "parentcaller": "0x00bcb1ce", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcae93", "parentcaller": "0x00bcb1ce", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77ac0000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaea5", "parentcaller": "0x00bcb1ce", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b34170" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaec6", "parentcaller": "0x00bcb1ce", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfo" }, { "name": "Type", "value": "0x00000000" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcad43", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2412 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcad43", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcad43", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2414 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcad43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaaa9", "parentcaller": "0x00bcad6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaaa9", "parentcaller": "0x00bcad6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77ac0000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaab9", "parentcaller": "0x00bcad6d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b262c0" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaffb", "parentcaller": "0x00bcad6d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcb043", "parentcaller": "0x00bcad6d", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcb19e", "parentcaller": "0x00bcad6d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab08", "parentcaller": "0x00bcadcd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x74ee0000" } ], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab08", "parentcaller": "0x00bcadcd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x69b80000" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab08", "parentcaller": "0x00bcadcd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x69b80000" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab08", "parentcaller": "0x00bcadcd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x69b80000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab1d", "parentcaller": "0x00bcadcd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x69b80000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x69b924c0" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab2c", "parentcaller": "0x00bcadcd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x69b80000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x69b946d0" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69bfb000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2428 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69bfb000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2430 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69bfb000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69bfb000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2440 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfo" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfoLegacyMapping" }, { "name": "Type", "value": "0x00000003" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "Value" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044c" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2452 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044c" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2456 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2458 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcab70", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044c" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x69b80000" } ], "repeated": 0, "id": 2466 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x74ee0000" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74ee0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2470 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcacc4", "parentcaller": "0x00bcadcd", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69b80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaaa9", "parentcaller": "0x00bcadf9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaaa9", "parentcaller": "0x00bcadf9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77ac0000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaab9", "parentcaller": "0x00bcadf9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b262c0" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaffb", "parentcaller": "0x00bcadf9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcb043", "parentcaller": "0x00bcadf9", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcb19e", "parentcaller": "0x00bcadf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaaa9", "parentcaller": "0x00bcb28b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaaa9", "parentcaller": "0x00bcb28b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77ac0000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2481 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaab9", "parentcaller": "0x00bcb28b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b262c0" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcacfa", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2483 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcacfa", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcacfa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bcaa84", "parentcaller": "0x00bcacfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bca5b1", "parentcaller": "0x00bc88bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bca5b1", "parentcaller": "0x00bc88bb", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77ac0000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bca5cd", "parentcaller": "0x00bc88bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlGetPersistedStateLocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b25dd0" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b436", "parentcaller": "0x00b7afc4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "TestMode" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b4d4", "parentcaller": "0x00b7afc4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2495 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0e\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: OS [windows]\r\n" }, { "name": "Length", "value": "77" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 2499 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7cc27", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "BuildLabEx" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx" } ], "repeated": 0, "id": 2500 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7cc27", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "BuildLabEx" }, { "name": "Data", "value": "19041.1.amd64fre.vb_release.191206-1406" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7cc27", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7e4e2", "parentcaller": "0x00b7c239", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b436", "parentcaller": "0x00b7c2e3", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "UBR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b436", "parentcaller": "0x00b7c2e3", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "UBR" }, { "name": "Data", "value": "3803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b4d4", "parentcaller": "0x00b7c2e3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00[\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "[\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: OsVer [10.0.19041.3803.amd64fre.vb_release.191206-1406]\r\n" }, { "name": "Length", "value": "120" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd3\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd3\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: ScenarioId [7]\r\n" }, { "name": "Length", "value": "79" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7a92e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "EditionId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7a92e", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "EditionId" }, { "name": "Data", "value": "Professional" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7a92e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\"\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: EditionId [Professional]\r\n" }, { "name": "Length", "value": "89" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7a992", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "InstallationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7a992", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "InstallationType" }, { "name": "Data", "value": "Client" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7a992", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00{\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "{\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: InstallationType [Client]\r\n" }, { "name": "Length", "value": "90" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7aa10", "parentcaller": "0x00b78103", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7aa54", "parentcaller": "0x00b78103", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfo" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7aa54", "parentcaller": "0x00b78103", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfoLegacyMapping" }, { "name": "Type", "value": "0x00000003" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd5\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd5\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: Sku [48]\r\n" }, { "name": "Length", "value": "73" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7aaf6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "MachineId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7aaf6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "MachineId" }, { "name": "Data", "value": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7aaf6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x12\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: DeviceId [{088B0758-31C5-47D8-9C4B-32E98EB1AB80}]\r\n" }, { "name": "Length", "value": "114" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7ab57", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "Ring" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7ab57", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bbe91a", "parentcaller": "0x00bbe880", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bbe91a", "parentcaller": "0x00bbe880", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" } ], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bbe91a", "parentcaller": "0x00bbe880", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bbe95b", "parentcaller": "0x00bbe880", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bbe95b", "parentcaller": "0x00bbe880", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bbe95b", "parentcaller": "0x00bbe880", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\x12\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info CONX Target OS version: 10.0.19041.572\r\n" }, { "name": "Length", "value": "85" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7ac35", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "OneSettingsVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7ac35", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe5\\x12\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: AppVer [10.0.19041.572]\r\n" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7e36d", "parentcaller": "0x00bbe816", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7f4b6", "parentcaller": "0x00b7f56b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7f4b6", "parentcaller": "0x00b7f56b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7f4b6", "parentcaller": "0x00b7f56b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7f4e6", "parentcaller": "0x00b7f56b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7f4e6", "parentcaller": "0x00b7f56b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7f4e6", "parentcaller": "0x00b7f56b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7d114", "parentcaller": "0x00b7b1f4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup" }, { "name": "Handle", "value": "0x0000038c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b21c", "parentcaller": "0x00b7ad71", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "ValueName", "value": "OneSettingsBranch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00b7b2ba", "parentcaller": "0x00b7ad71", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00=\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "=\\x13\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:06, Info MOUPG OneSettings: Branch [vb_release_svc_prod1]\r\n" }, { "name": "Length", "value": "94" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bca670", "parentcaller": "0x00bc8a14", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "MutexName", "value": "Global\\OneSettingQueryMutex+WSD+Setup360" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bca682", "parentcaller": "0x00bc8a14", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bca682", "parentcaller": "0x00bc8a14", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" }, { "name": "Milliseconds", "value": "60000" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc9d47", "parentcaller": "0x00bc8a1b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2602 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc9d47", "parentcaller": "0x00bc8a1b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ea0", "parentcaller": "0x00bc8a82", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "winhttp.dll" }, { "name": "BaseAddress", "value": "0x72780000" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ea0", "parentcaller": "0x00bc8a82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper" }, { "name": "DllBase", "value": "0x6e670000" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ea0", "parentcaller": "0x00bc8a82", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll" }, { "name": "BaseAddress", "value": "0x6e670000" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ea0", "parentcaller": "0x00bc8a82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper" }, { "name": "DllBase", "value": "0x6e670000" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "6216", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00000010", "pretty_value": "KEY_NOTIFY" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "TenantRestrictions\\Payload" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2609 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ea0", "parentcaller": "0x00bc8a82", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "winhttp.dll" }, { "name": "BaseAddress", "value": "0x72780000" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "6216", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ea0", "parentcaller": "0x00bc8a82", "category": "network", "api": "WinHttpOpen", "status": true, "return": "0x009a2d38", "arguments": [ { "name": "UserAgent", "value": "OneSettingsQuery" }, { "name": "ProxyName", "value": "" }, { "name": "ProxyBypass", "value": "" }, { "name": "AccessType", "value": "0x00000000" }, { "name": "Flags", "value": "0x00000000" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8ec9", "parentcaller": "0x00bc8a82", "category": "network", "api": "WinHttpConnect", "status": true, "return": "0x009a2b58", "arguments": [ { "name": "SessionHandle", "value": "0x009a2d38" }, { "name": "ServerName", "value": "settings-win.data.microsoft.com" }, { "name": "ServerPort", "value": "443" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f69", "parentcaller": "0x00bc905c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x02000000" }, { "name": "TokenHandle", "value": "0x00000480" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f69", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7509c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f69", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7509c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f69", "parentcaller": "0x00bc905c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "WINSTA.dll" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\WINSTA.dll" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\winsta.dll" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\winsta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000480" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\winsta.dll" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000484" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00047000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e82000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e80000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e80000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e80000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e80000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\WINSTA.dll" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\winsta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-28 22:53:06,856", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x74e40000" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\winsta" }, { "name": "BaseAddress", "value": "0x74e40000" }, { "name": "InitRoutine", "value": "0x74e59300" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7509c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7509c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e82000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e82000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77ac0000" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlGetSuiteMask" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af06d0" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e82000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74e82000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "EventName", "value": "Global\\TermSrvReadyEvent" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2648 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2649 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2651 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2653 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f7f", "parentcaller": "0x00bc905c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2655 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8fce", "parentcaller": "0x00bc905c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x02000000" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8fce", "parentcaller": "0x00bc905c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8fce", "parentcaller": "0x00bc905c", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x02000000" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8fce", "parentcaller": "0x00bc905c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc90aa", "parentcaller": "0x00bc8ee3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x74370000" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc90aa", "parentcaller": "0x00bc8ee3", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc90aa", "parentcaller": "0x00bc8ee3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x75d20000" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc90aa", "parentcaller": "0x00bc8ee3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6" }, { "name": "DllBase", "value": "0x6be40000" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc90aa", "parentcaller": "0x00bc8ee3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc" }, { "name": "DllBase", "value": "0x74350000" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc90aa", "parentcaller": "0x00bc8ee3", "category": "network", "api": "WinHttpGetIEProxyConfigForCurrentUser", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc915e", "parentcaller": "0x00bc8ee3", "category": "network", "api": "WinHttpGetProxyForUrl", "status": false, "return": "0x00000000", "arguments": [ { "name": "SessionHandle", "value": "0x009a2d38" }, { "name": "Url", "value": "settings-win.data.microsoft.com" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00020008" }, { "name": "TokenHandle", "value": "0x000004a0" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xedZ\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2670 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "ValueName", "value": "WinHttpSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc92bd", "parentcaller": "0x00bc8ee3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc8f15", "parentcaller": "0x00bc8a82", "category": "network", "api": "WinHttpOpenRequest", "status": true, "return": "0x00994018", "arguments": [ { "name": "InternetHandle", "value": "0x009a2b58" }, { "name": "Verb", "value": "GET" }, { "name": "ObjectName", "value": "settings/v2.0/WSD/Setup360?os=windows&osver=10.0.19041.3803.amd64fre.vb_release.191206-1406&scenarioId=7&platformEdition=Professional&platformInstallationType=Client&sku=48&deviceId={088B0758-31C5-47D8-9C4B-32E98EB1AB80}&appver=10.0.19041.572&appBuildLab=vb_release_svc_prod1" }, { "name": "Version", "value": "" }, { "name": "Referrer", "value": "" }, { "name": "Flags", "value": "0x00800000" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bca266", "parentcaller": "0x00bc9453", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2675 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bca266", "parentcaller": "0x00bc9453", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc9500", "parentcaller": "0x00bc8a90", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\webio" }, { "name": "DllBase", "value": "0x69b90000" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc9500", "parentcaller": "0x00bc8a90", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mswsock" }, { "name": "DllBase", "value": "0x6e610000" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc9500", "parentcaller": "0x00bc8a90", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mswsock.dll" }, { "name": "BaseAddress", "value": "0x6e610000" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "4400", "caller": "0x00bc9500", "parentcaller": "0x00bc8a90", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINNSI" }, { "name": "DllBase", "value": "0x6e5b0000" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x727bed9e", "parentcaller": "0x727a3e84", "category": "services", "api": "OpenSCManagerW", "status": true, "return": "0x00991438", "arguments": [ { "name": "MachineName", "value": "" }, { "name": "DatabaseName", "value": "" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "SC_MANAGER_CONNECT" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x727bedb9", "parentcaller": "0x727a3e84", "category": "services", "api": "OpenServiceW", "status": true, "return": "0x00991348", "arguments": [ { "name": "ServiceControlManager", "value": "0x00991438" }, { "name": "ServiceName", "value": "WinHttpAutoProxySvc" }, { "name": "DesiredAccess", "value": "0x00000094", "pretty_value": "SERVICE_QUERY_STATUS|SERVICE_START|SERVICE_INTERROGATE" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798b088", "parentcaller": "0x75a66ff4", "category": "threading", "api": "NtOpenThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000052c" }, { "name": "DesiredAccess", "value": "0x00100010", "pretty_value": "THREAD_SET_CONTEXT|0x00100000" }, { "name": "ProcessId", "value": "2088" }, { "name": "ThreadId", "value": "18446744073525264400" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x77999924", "parentcaller": "0x76c1c2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000538" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x75a668c8", "parentcaller": "0x77b1f0fa", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "2088" }, { "name": "ThreadId", "value": "6216" }, { "name": "ThreadHandle", "value": "0x0000052c" }, { "name": "ApcRoutine", "value": "0x75a72550" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ac59", "parentcaller": "0x75a67f8c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ac59", "parentcaller": "0x75a67f8c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779a906b", "parentcaller": "0x75a67fa8", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x75a72570", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052c" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727becf3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x76c20f20", "parentcaller": "0x76c1e30f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ac59", "parentcaller": "0x7279cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052c" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000530" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727e5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727e50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x7798a206", "parentcaller": "0x75cbab4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mswsock.dll" }, { "name": "BaseAddress", "value": "0x6e610000" } ], "repeated": 1, "id": 2709 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x7798a206", "parentcaller": "0x75cb5580", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DNSAPI" }, { "name": "DllBase", "value": "0x703a0000" } ], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x7798a206", "parentcaller": "0x75cb5580", "category": "network", "api": "GetAddrInfoExW", "status": false, "return": "0x000003e5", "arguments": [ { "name": "Name", "value": "settings-win.data.microsoft.com" }, { "name": "ServiceName", "value": "" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x7798c134", "parentcaller": "0x75cb92fe", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000055c" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x77989e76", "parentcaller": "0x75cb9325", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 3, "id": 2714 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000055c" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\WinSock2\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000055c" }, { "name": "ValueName", "value": "WinSock_Registry_Version" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2718 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f094", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000055c" }, { "name": "ValueName", "value": "WinSock_Registry_Version" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "2.0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\DNS" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DNS" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "QueryAdapterName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f094", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000055c" }, { "name": "ValueName", "value": "AutodialDLL" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\rasadhlp.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DisableAdapterDomainName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName" } ], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UseDomainNameDevolution" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "UseDomainNameDevolution" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DomainNameDevolutionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "PrioritizeRecordData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "PrioritizeRecordData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "AllowUnqualifiedQuery" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "AllowUnqualifiedQuery" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "AppendToMultiLabelName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ScreenBadTlds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ScreenUnreachableServers" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ScreenDefaultServers" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DynamicServerQueryOrder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "FilterClusterIp" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "WaitForNameErrorOnAll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UseEdns" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DnsSecureNameQueryFallback" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "EnableDAForAllNetworks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DirectAccessQueryOrder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "QueryIpMatching" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UseHostsFile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "AddrConfigControl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableSmartNameResolution" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "PreferLocalOverLowerBindingDNS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "QueryNetBTFQDN" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableSmartProtocolReordering" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UdpRecvBufferSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableParallelAandAAAA" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableCoalescing" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "FilterVPNTrigger" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "EnableMultiHomedRouteConflicts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ForceQueriesOverTcp" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ShareTcpConnections" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegistrationEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DisableDynamicUpdate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegisterPrimaryName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegisterAdapterName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "EnableAdapterDomainNameRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegisterReverseLookup" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DisableReverseAddressRegistrations" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegisterWanAdapters" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DisableWanDynamicUpdate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegistrationTtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DefaultRegistrationTTL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegistrationRefreshInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DefaultRegistrationRefreshInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegistrationMaxAddressCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "MaxNumberOfAddressesToRegister" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UpdateSecurityLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "UpdateSecurityLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UpdateTopLevelDomainZones" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DowncaseSpnCauseApiOwnerIsTooLazy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "RegistrationOverwrite" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MaxCacheSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MaxCacheTtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MaxNegativeCacheTtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "AdapterTimeoutLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ServerPriorityTimeLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MaxCachedSockets" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableServerUnreachability" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "EnableMulticast" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MulticastResponderFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MulticastSenderFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "MulticastSenderMaxTimeout" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "EnableMDNS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DnsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UseCompartments" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "CacheAllCompartments" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "UseNewRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ResolverRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ResolverRegistrationOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "NewDhcpSrvRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DirectAccessPreferLocal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableIdnEncoding" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "EnableIdnMapping" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "ShortnameProxyDefault" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DisableNRPTForAdapterRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "TestMode_AdaptiveTimeoutHistoryLength" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "TestMode_AdaptiveTimeoutRecalculationInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DnsQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DnsQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "DnsQuickQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "DnsQuickQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2808 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "Class", "value": "Class" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2810 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2812 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "Hostname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "Hostname" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "DESKTOP-HGH2VBT" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2818 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "Class", "value": "Class" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2820 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2822 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2824 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\System\\DNSClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "Domain" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "ValueName", "value": "Domain" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2830 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "Class", "value": "Class" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2832 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000564" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2834 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "Hostname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "ValueName", "value": "Hostname" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "DESKTOP-HGH2VBT" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x703cb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x75d21941", "parentcaller": "0x743770b3", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "HandleName", "value": "\\Device\\Nsi" }, { "name": "IoControlCode", "value": "0x00120007" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xf1)\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xf1)\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00 \\xf1)\\x06\\xb3p7t\\x01\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x75d21966", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70420000" }, { "name": "ModuleName", "value": "DNSAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70420000" }, { "name": "ModuleName", "value": "DNSAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x76c212f8", "parentcaller": "0x76c1ea12", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000564" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798c134", "parentcaller": "0x76c21389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000568" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b16a20", "parentcaller": "0x77b19456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b190c4", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "$\\x98\\x94\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19103", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80[\\x99\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x005\\x00a\\x00e\\x00c\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x005\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19120", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1915f", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x84\\x12\\x99\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19178", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b191b3", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "$\\x90\\x95\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19240", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00 \\x90\\x95\\x00\\x00\\x00#\\x00L\\xeb@\\xebh\\x05\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0h\\x05\\x00\\x00\\x94\\xeb)\\x06\\xb3\\x91\\xb1wh\\x05\\x00\\x00" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1926e", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x84\\xc8\\x7f\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8ike\\x96\\x82\\xc9<\\xe6)\\x06h\\x05\\x00\\x00\\x8c\\xf0)\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xffL\\xeb)\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b16a20", "parentcaller": "0x77b17151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b190c4", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa4\\x9a\\x94\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19103", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P`\\x99\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x000\\x00" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19120", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1915f", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x9c\\x13\\x99\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19178", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b191b3", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x04\\x92\\x95\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19240", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x00\\x92\\x95\\x00\\x00\\x00#\\x004\\xe9(\\xe9h\\x05\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0h\\x05\\x00\\x00|\\xe9)\\x06\\xb3\\x91\\xb1wh\\x05\\x00\\x00" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1926e", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x84\\xc8\\x7f\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8ik}\\x94\\x82\\xc9$\\xe4)\\x06h\\x05\\x00\\x00\\x8c\\xf0)\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xff4\\xe9)\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x76c213d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x76c213f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x76c212f8", "parentcaller": "0x76c2624d", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000568" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798c134", "parentcaller": "0x76c21389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000564" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b16a20", "parentcaller": "0x77b19456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b190c4", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa4\\x9a\\x94\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19103", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\\\x99\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00s\\x00.\\x00>\\xfa\\xa1\\xbf\\xf4\\xee\\xdc\\x01\\x02\\x00\\x00\\x00\\xba\\x06\\x00\\x00\n\\x00\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00t\\x00u\\x004\\x00\\x00\\xc0o\\x00s\\x00\\x02\\x00\\x00\\x00E\\x00x\\x00\\x18\\x00\\x00\\x00" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19120", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1915f", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xfc\\x12\\x99\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19178", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b191b3", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x04\\x92\\x95\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19240", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x00\\x92\\x95\\x00\\x00\\x00#\\x00\\x14\\xea\\x08\\xead\\x05\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0d\\x05\\x00\\x00\\\\xea)\\x06\\xb3\\x91\\xb1wd\\x05\\x00\\x00" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1926e", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x84\\xc8\\x7f\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8ik]\\x95\\x82\\xc9\\x04\\xe5)\\x06d\\x05\\x00\\x00\\x8c\\xf0)\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xff\\x14\\xea)\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b16a20", "parentcaller": "0x77b17151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b190c4", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "$\\x98\\x94\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19103", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x08W\\x99\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00b\\x000\\x005\\x00-\\x004\\x000\\x00e\\x00d\\x00-\\x009\\x004\\x00c\\x008\\x00-\\x00b\\x005\\x00c\\x00e\\x005\\x006\\x00a\\x005\\x000\\x00a\\x00c\\x008\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19120", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1915f", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "L\\x13\\x99\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19178", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b191b3", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x84\\x90\\x95\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b19240", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x80\\x90\\x95\\x00\\x00\\x00#\\x00\\xfc\\xe7\\xf0\\xe7d\\x05\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0d\\x05\\x00\\x00D\\xe8)\\x06\\xb3\\x91\\xb1wd\\x05\\x00\\x00" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1926e", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x84\\xc8\\x7f\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8ik5\\x9b\\x82\\xc9\\xec\\xe2)\\x06d\\x05\\x00\\x00\\x8c\\xf0)\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xff\\xfc\\xe7)\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b195ab", "parentcaller": "0x77b176fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xea)\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x0c\\x00\\x00\\x00x\\xea)\\x06t\\x88\\xb1w\\x94\\x05\\x95\\x00h\\xea)\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x88\\xb1w\\x00\\x00\\x00\\x00\\x00\\x03)\\x06" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b195f2", "parentcaller": "0x77b176fc", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "2" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b1962c", "parentcaller": "0x77b176fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "2" }, { "name": "TokenInformation", "value": "\\x0e\\x00\\x00\\x00\\x0c\\xa5\\x97\\x00\\x07\\x00\\x00\\x00(\\xa5\\x97\\x00\\x07\\x00\\x00\\x004\\xa5\\x97\\x00\\x07\\x00\\x00\\x00@\\xa5\\x97\\x00\\x0f\\x00\\x00\\x00P\\xa5\\x97\\x00\\x07\\x00\\x00\\x00`\\xa5\\x97\\x00\\x07\\x00\\x00\\x00l\\xa5\\x97\\x00\\x07\\x00\\x00\\x00x\\xa5\\x97\\x00\\x07\\x00\\x00\\x00\\x84\\xa5\\x97\\x00\\x07\\x00\\x00\\x00\\x90\\xa5\\x97\\x00\\x07\\x00\\x00\\x00\\x9c\\xa5\\x97\\x00\\x07\\x00\\x00\\xc0\\xb0\\xa5\\x97\\x00\\x07\\x00\\x00\\x00\\xbc\\xa5\\x97\\x00\\x07\\x00\\x00\\x00\\xcc\\xa5\\x97\\x00`\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05r\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x01\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x76c213d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x76c213f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-28 22:53:06,872", "thread_id": "6216", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x77999924", "parentcaller": "0x75cbd80d", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000055c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x7798a206", "parentcaller": "0x75cbb489", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\fwpuclnt" }, { "name": "DllBase", "value": "0x6d200000" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x7798a206", "parentcaller": "0x75cbb489", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\FWPUCLNT.DLL" }, { "name": "BaseAddress", "value": "0x6d200000" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x77991b7a", "parentcaller": "0x75cbb4ab", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "fwpuclnt.dll" }, { "name": "ModuleHandle", "value": "0x6d200000" }, { "name": "FunctionName", "value": "NamespaceCallout" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6d215770" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x7798c134", "parentcaller": "0x6d215d64", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000574" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x6d215d7e", "parentcaller": "0x6d215b55", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x6d215d94", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x7798964f", "parentcaller": "0x6d21623c", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "EventName", "value": "Global\\BFE_Notify_Event_{9b3929ab-10ee-4dbe-a74c-b3011de02a7d}" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x6d215ca4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x75cbdc64", "parentcaller": "0x75cc4f9e", "category": "network", "api": "WSASocketW", "status": true, "return": "0x00000524", "arguments": [ { "name": "af", "value": "23", "pretty_value": "AF_INET6" }, { "name": "type", "value": "2", "pretty_value": "SOCK_DGRAM" }, { "name": "protocol", "value": "0" }, { "name": "socket", "value": "1316" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x6e61a714", "parentcaller": "0x75cbdd57", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00000524" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "IoControlCode", "value": "0x000120bf", "pretty_value": "IOCTL_AFD_DEFER_ACCEPT" }, { "name": "InputBuffer", "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\xc8\\x01\\x00\\x00\\x00\\x10\\x9a\\x95\\x00\\x0c\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x98\\x13\\x99\\x00\\x1c\\x00\\x00\\x00" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x6e61a9c5", "parentcaller": "0x6e61a75c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6216", "caller": "0x6e61ac73", "parentcaller": "0x6e61aa9e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x69baf7b6", "parentcaller": "0x69bafd35", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x69bbb752", "parentcaller": "0x69bc1f5c", "category": "network", "api": "WSASocketW", "status": true, "return": "0x00000574", "arguments": [ { "name": "af", "value": "2", "pretty_value": "AF_INET" }, { "name": "type", "value": "1", "pretty_value": "SOCK_STREAM" }, { "name": "protocol", "value": "6", "pretty_value": "IPPROTO_TCP" }, { "name": "socket", "value": "1396" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x69bbb827", "parentcaller": "0x69bc1f5c", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" }, { "name": "level", "value": "0x0000ffff" }, { "name": "optname", "value": "0x00003007" }, { "name": "optval", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x69bbb878", "parentcaller": "0x69bc1f5c", "category": "network", "api": "bind", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" }, { "name": "ip", "value": "0.0.0.0" }, { "name": "port", "value": "0" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x69bbb8dc", "parentcaller": "0x69bc1f5c", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" }, { "name": "level", "value": "0x00000006" }, { "name": "optname", "value": "0x00000001" }, { "name": "optval", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009b3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\mswsock.dll" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\mswsock.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000524" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000524" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000057c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06460000" }, { "name": "SectionOffset", "value": "0x0631e050" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\mswsock.dll" } ], "repeated": 4, "id": 2926 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798a5ca", "parentcaller": "0x7798a277", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\wshqos.dll" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798a613", "parentcaller": "0x7798a277", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798a66b", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798a672", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009b6000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af93ac", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "SectionOffset", "value": "0x0631e050" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b1a49a", "parentcaller": "0x77b1a3d0", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b1a4a8", "parentcaller": "0x77b1a3d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798893c", "parentcaller": "0x75cb904d", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-28 22:53:06,903", "thread_id": "6220", "caller": "0x7798a5ca", "parentcaller": "0x7798a277", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\wshqos.dll" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a613", "parentcaller": "0x7798a277", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a66b", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a672", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af93ac", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" } ], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "SectionOffset", "value": "0x0631e050" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b1a49a", "parentcaller": "0x77b1a3d0", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b1a4a8", "parentcaller": "0x77b1a3d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798893c", "parentcaller": "0x75cb904d", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a5ca", "parentcaller": "0x7798a277", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\wshqos.dll" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a613", "parentcaller": "0x7798a277", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a66b", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a672", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af93ac", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "SectionOffset", "value": "0x0631e050" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b1a49a", "parentcaller": "0x77b1a3d0", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b1a4a8", "parentcaller": "0x77b1a3d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798893c", "parentcaller": "0x75cb904d", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b053db", "parentcaller": "0x7798a51e", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wshqos.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a5ca", "parentcaller": "0x7798a277", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\wshqos.dll" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a613", "parentcaller": "0x7798a277", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a66b", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798a672", "parentcaller": "0x7798a277", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af93ac", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000057c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000580" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "SectionOffset", "value": "0x0631e050" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b1a49a", "parentcaller": "0x77b1a3d0", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06480000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b1a4a8", "parentcaller": "0x77b1a3d0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798893c", "parentcaller": "0x75cb904d", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x75d52066", "parentcaller": "0x69bbba78", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000574" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "FileInformationClass", "value": "41", "pretty_value": "FileIoStatusBlockRangeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77b2739f", "parentcaller": "0x77b271b6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000574" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "T\\x00\\x00\\x00\\x18\\xe1\\x99\\x00" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x69baee81", "parentcaller": "0x69bc1fa6", "category": "network", "api": "ConnectEx", "status": false, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" }, { "name": "SendBuffer", "value": "" }, { "name": "ip", "value": "57.155.104.224" }, { "name": "port", "value": "443" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x7798ab1a", "parentcaller": "0x75cb5ad9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-28 22:53:06,919", "thread_id": "6220", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x69bc2329", "parentcaller": "0x69bae296", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" }, { "name": "level", "value": "0x0000ffff" }, { "name": "optname", "value": "0x00007010" }, { "name": "optval", "value": "" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x6e62ac5d", "parentcaller": "0x75cc234d", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000574" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "IoControlCode", "value": "0x0001202f", "pretty_value": "IOCTL_AFD_GET_SOCK_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\xc2$\\xc0\\xa8\\x01i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x7798a206", "parentcaller": "0x74d9f15e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\schannel" }, { "name": "DllBase", "value": "0x6d180000" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x7798a206", "parentcaller": "0x74d9f15e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\schannel.dll" }, { "name": "BaseAddress", "value": "0x6d180000" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x77991b7a", "parentcaller": "0x74d9effb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "schannel.dll" }, { "name": "ModuleHandle", "value": "0x6d180000" }, { "name": "FunctionName", "value": "SpUserModeInitialize" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6d188f40" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2998 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000598" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000598" }, { "name": "ValueName", "value": "UserContextLockCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000598" }, { "name": "ValueName", "value": "UserContextListCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x6d1890a0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x74d97592", "parentcaller": "0x74da158b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`t\\x00(\\x08\\x00\\x00L\\x18\\x00\\x00\\x03\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6220" } ], "repeated": 1, "id": 3003 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x69bab419", "parentcaller": "0x69bc2d0d", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1396" }, { "name": "Buffer", "value": "\\x16\\x03\\x03\\x00\\xc1\\x01\\x00\\x00\\xbd\\x03\\x03j\\x18\\xc7S\\x00\\xd4\\xef\\xda\\xa66\\xf3\\xbd\\x16_%\\xd8X\\xa7\\x18J\\xc18\\x9d\\xfc\\x93\\xd4\\xfd\\x87\\xcaG\\xfcC\\x00\\x00&\\xc0,\\xc0+\\xc00\\xc0/\\xc0$\\xc0#\\xc0(\\xc0'\\xc0\n\\xc0\t\\xc0\\x14\\xc0\\x13\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\n\\x01\\x00\\x00n\\x00\\x00\\x00$\\x00\"\\x00\\x00\\x1fsettings-win.data.microsoft.com\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\n\\x00\\x08\\x00\\x06\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00\r\\x00\\x1a\\x00\\x18\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x02\\x01\\x04\\x03\\x05\\x03\\x02\\x03\\x02\\x02\\x06\\x01\\x06\\x03\\x00#\\x00\\x00\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-28 22:53:07,028", "thread_id": "6220", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1396" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-28 22:53:07,153", "thread_id": "6220", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`t\\x00(\\x08\\x00\\x00L\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6220" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-28 22:53:07,169", "thread_id": "6220", "caller": "0x69bab419", "parentcaller": "0x69bc2d0d", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1396" }, { "name": "Buffer", "value": "\\x16\\x03\\x03\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\xd5+h\\x06\\x92\\xc3\\xf8\\xaf:\\xb4\\xf1\\xae]\\xb7\\xf9e\\x0e\\xbamR`tc\\xf17\\x9e\\xf2\\x8f\\xc4r v\\xe1\\xef\\xbd\\x91G\\xc2\\xf9\\xcb\\x84\\xf4MSQih5N\\x82\\xf23\\xf5Y\\x13\\x9c\\x12ej\\xe0\\xc1\\x8bq+\\x02A\\xfaiW\\xb3\\xe7\\xc7\\xdf\\x99\\xd9\\x94\\x8e\\xf0\\xb1\\xa1\\xc0rC\\x925+P\\x0e\\xe36%\\xee\"\\xbdT\\xc5 \\xfc\\xae\\xacwOIV*\\x1d\\xe2\\xc2\\xa4\\xedScd\\x9f\\x10\\xf1Q\\xb4@\\xd7n?\\x849L\\x82\\xd0\\xfcl~~P\\x1b17\\x05\\x85\\xdax\\xc7!7+\\xa4E\\xa8;U\\x14\\x1c{=\\xf2\\x1ex\\x04\\xbe\\x9c\\xa8\\xf8\\xd2\\xe2\\xd6\\xa8\\xc9\\xd3\\xe1\\xc7X\\xbc\\x80\\x00y\\x8b\\xab\\xa4<#\\x90\\xf1(?\\xeb" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x009be660" }, { "name": "Length", "value": "560" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x6d125d74", "parentcaller": "0x70dd3f73", "category": "crypto", "api": "BCryptImportKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyBlob", "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\x04\\xfb\\xd5\\xc1\\x0e\\x11\\x89\\xb2p\\xaa\\x8a!$\\x9cS|\\x03\\xe9\\x00\tS\\x9c\\xd3\\x1c_\\xfb3\\x87 \\xc7\\x1b\\xb3\\x00\\x00\\x00\\x00\\x04\\xfb\\xd5\\xc1\\x0e\\x11\\x89\\xb2p\\xaa\\x8a!$\\x9cS|\\x03\\xe9\\x00\tS\\x9c\\xd3\\x1c_\\xfb3\\x87 \\xc7\\x1b\\xb3\\xc3T\\xb8v\\xcdE1\\xc4\\xbd\\xef\\xbb\\xe5\\x99s\\xe8\\x99\\xedf\\x9b\\xe7\\xbe\\xfaH\\xfb\\xe1\\x01{|\\xc1\\xc6`\\xcfu\\x842\\x0e\\xb8\\xc1\\x03\\xca\\x05.\\xb8/\\x9c]P\\xb63*\\xc8\\xa9\\x8d\\xd0\\x80Rl\\xd1\\xfb.\\xad\\x17\\x9b\\xe1\\x81\\x90\\xca\\x9b9Q\\xc9Q<\\x7fq~\\xa0\"!\\xc8\\xd3\\xb95A^i\\xb5\\x132\\xb8N=\\x9f\\xaf\\xd5\\xdc\\xf0\\x93L@\\xc9\\xc2\\x85\\x11\\xf5\\xbd\\xf4oU\\x9f\\xd5\\xa7/b6\\x1dq\\x0b\\x83\\x0eC\\xb3\\xcd3\\xdc\\x1c\\x18\\xef|>\\x93\\xc6\\xb5\\xfc\\x16\\xd7@A\\xe2\\xb8\\x15\\xde7\\x1fv\\x7f\\xac\\xdd\\x07t/\\xd3D\\xc7\\xe2\\xe0\\x98\\xdb\\xfa\\x0f" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x009bf360" }, { "name": "Length", "value": "560" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6d1f3000" }, { "name": "ModuleName", "value": "schannel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6d1f3000" }, { "name": "ModuleName", "value": "schannel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x05\\xe90\\x82\\x03\\xd1\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x04\\x13\\xa6]\\x07\\xe7AEk\\xff\\x00\\x00\\x00\\x00\\x04\\x130\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft Secure Server CA 20110\\x1e\\x17\r251023205606Z\\x17\r261017205606Z0x1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x06\\xd80\\x82\\x04\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\na?\\xb7\\x18\\x00\\x00\\x00\\x00\\x00\\x040\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r111018225519Z\\x17\r261018230519Z0~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3063 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000608" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000604" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000608" }, { "name": "ObjectAttributesName", "value": "CryptDllFindOIDInfo" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000610" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000060c" }, { "name": "ObjectAttributesName", "value": "1.3.6.1.4.1.311.64.1.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7796b853", "parentcaller": "0x779ce66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000610" }, { "name": "KeyInformation", "value": "\\xff8b1p'\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00N\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000610" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3071 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000614" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000614" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77992972", "parentcaller": "0x779925fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929b2", "parentcaller": "0x779925fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929e0", "parentcaller": "0x779925fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b13909", "parentcaller": "0x77aed7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe71\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x90\\xec1\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x02H\\xbc~\\x04" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77aed7d7", "parentcaller": "0x7798ee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798edea", "parentcaller": "0x7799204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x00000618" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ee1d", "parentcaller": "0x7799204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798c899", "parentcaller": "0x779926ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dnsapi.dll" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798f01c", "parentcaller": "0x77991ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Domain Name System (DNS) Server Trust" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779926df", "parentcaller": "0x77993069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000061c" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000614" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77992972", "parentcaller": "0x779925fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929b2", "parentcaller": "0x779925fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929e0", "parentcaller": "0x779925fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000061c" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b13909", "parentcaller": "0x77aed7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe71\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x90\\xec1\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x02 \\xc6~\\x04" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77aed7d7", "parentcaller": "0x7798ee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798edea", "parentcaller": "0x7799204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x0000061c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ee1d", "parentcaller": "0x7799204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000061c" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798c899", "parentcaller": "0x779926ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dnsapi.dll" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798f01c", "parentcaller": "0x77991ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Domain Name System (DNS) Server Trust" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779926df", "parentcaller": "0x77993069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000614" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff151c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000610" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000610" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000060c" }, { "name": "ObjectAttributesName", "value": "1.3.6.1.4.1.311.80.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7796b853", "parentcaller": "0x779ce66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000610" }, { "name": "KeyInformation", "value": "\\xff8b1p'\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xff84\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000610" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3101 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000614" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000614" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77992972", "parentcaller": "0x779925fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929b2", "parentcaller": "0x779925fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929e0", "parentcaller": "0x779925fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b13909", "parentcaller": "0x77aed7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe71\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x90\\xec1\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\xe0\\xba~\\x04" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77aed7d7", "parentcaller": "0x7798ee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798edea", "parentcaller": "0x7799204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x00000618" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ee1d", "parentcaller": "0x7799204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798c899", "parentcaller": "0x779926ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798f01c", "parentcaller": "0x77991ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Document Encryption" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779926df", "parentcaller": "0x77993069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000061c" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000614" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77992972", "parentcaller": "0x779925fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929b2", "parentcaller": "0x779925fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779929e0", "parentcaller": "0x779925fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000061c" } ], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b13909", "parentcaller": "0x77aed7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xe71\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x90\\xec1\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x02 \\xc6~\\x04" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77aed7d7", "parentcaller": "0x7798ee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000061c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798edea", "parentcaller": "0x7799204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x0000061c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ee1d", "parentcaller": "0x7799204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000061c" } ], "repeated": 0, "id": 3121 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798c899", "parentcaller": "0x779926ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798f01c", "parentcaller": "0x77991ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000618" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Document Encryption" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779926df", "parentcaller": "0x77993069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000614" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff151c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000610" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff15b2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000608" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13cb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3131 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797e6db", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x00000604" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009c1000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009c4000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\CRYPT32.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\CRYPT32.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000608" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000604" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\crypt32.dll.mui" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000608" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06470000" }, { "name": "SectionOffset", "value": "0x0631e660" }, { "name": "ViewSize", "value": "0x0000a000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000608" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009c7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770b3000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770b3000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x775c09b0", "parentcaller": "0x775c0ab4", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001d0" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00m\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77991b7a", "parentcaller": "0x775c12a6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "ModuleHandle", "value": "0x76ba0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76bb5880" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x05\\xe90\\x82\\x03\\xd1\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x04\\x13\\xa6]\\x07\\xe7AEk\\xff\\x00\\x00\\x00\\x00\\x04\\x130\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft Secure Server CA 20110\\x1e\\x17\r251023205606Z\\x17\r261017205606Z0x1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x06\\xd80\\x82\\x04\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\na?\\xb7\\x18\\x00\\x00\\x00\\x00\\x00\\x040\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r111018225519Z\\x17\r261018230519Z0~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69bee000" }, { "name": "ModuleName", "value": "webio.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69bee000" }, { "name": "ModuleName", "value": "webio.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3152 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\crypt32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "ValueName", "value": "DiagLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "ValueName", "value": "DiagMatchAnyMask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x7700722e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3157 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\crypt32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770b3000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770b3000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b2c23d", "parentcaller": "0x77b2c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b2c245", "parentcaller": "0x77b2c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77989e76", "parentcaller": "0x76fe85fb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ab1a", "parentcaller": "0x76fe8618", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3166 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "DisableSerialChain" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe492e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76fe8798", "parentcaller": "0x76fe8278", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3171 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "CryptnetPreFetchTriggerPeriodSeconds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "MaxUrlRetrievalByteCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3175 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "ValueName", "value": "DisallowedCertSyncDeltaTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3179 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6900", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77870000" }, { "name": "FunctionName", "value": "FlsGetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798c970" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000638" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6900", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000063c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "CertDllOpenStoreProv" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000063c" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000063c" }, { "name": "ObjectAttributesName", "value": "#16" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\#16" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7796b853", "parentcaller": "0x779ce66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "KeyInformation", "value": "[\\xff86\\xfff1\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00B\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 3189 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff151c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000640" } ], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000063c" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000063c" }, { "name": "ObjectAttributesName", "value": "Ldap" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\Ldap" } ], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7796b853", "parentcaller": "0x779ce66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "KeyInformation", "value": "[\\xff86\\xfff1\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00B\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff151c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000640" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000063c" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff15b2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000063c" } ], "repeated": 0, "id": 3198 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000638" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000638" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "EncodingType 1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "CertDllOpenStoreProv" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllOpenStoreProv" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000638" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13cb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009c9000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3207 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3209 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffa507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3212 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7700eaa3", "parentcaller": "0x76ffaaeb", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "103" } ], "repeated": 1, "id": 3214 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3215 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000638" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3219 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000063c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3222 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3223 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3225 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffa507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3228 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000640" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3232 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\SmartCardRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3235 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\SmartCardRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3238 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores" } ], "repeated": 0, "id": 3239 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3240 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffa507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3243 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000644" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3247 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3249 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffa507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3252 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000648" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ffb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "AutoFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009cc000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3257 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009cf000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "DisableAutoFlushProcessNameList" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "AutoFlushFirstDeltaSeconds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds" } ], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "AutoFlushNextDeltaSeconds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds" } ], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8bcc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3265 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000063c" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3270 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3271 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000640" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 3278 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000644" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3283 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3286 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000648" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3294 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01" } ], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "8F43288AD272F3103B6FB1428485EA3014C0BCFE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE" } ], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "8F43288AD272F3103B6FB1428485EA3014C0BCFE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "ValueName", "value": "Blob" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob" } ], "repeated": 1, "id": 3300 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "ValueName", "value": "Blob" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00'\\x9c\\xd6R\\xc4\\xe2R\\xbf\\xbeR\\x17\\xacr\"\\x05\\xd7r\\x9b\\xa4\t\\x14\\x8c\\xfa\\x9em\\x9e[\\x1c\\xb9N\\xaf\\xf1\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00T\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00C\\x00e\\x00r\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00e\\x00 \\x00A\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00 \\x002\\x000\\x001\\x001\\x00\\x00\\x00i\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0e\\x00\\x00\\x000\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x03\\x02\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x8fC(\\x8a\\xd2r\\xf3\\x10;o\\xb1B\\x84\\x85\\xea0\\x14\\xc0\\xbc\\xfe\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00r-:\\x021\\x90C\\xb9\\x14\\x05N\\xe1\\xea\\xa7\\xc71\\xd1#\\x894\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\x04\\x90\\xd5\\xe5l4\\xa5\\xae\\x0b\\xe9\\x8b\\xe5\\x81\\x18] \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf1\\x05\\x00\\x000\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff2a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff71d3", "parentcaller": "0x76ff69bd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220528Z\\x17\r360322221304Z0\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x10" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3305 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "CertDllVerifyCertificateChainPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000630" }, { "name": "ObjectAttributesName", "value": "EncodingType 1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000634" }, { "name": "ObjectAttributesName", "value": "CertDllVerifyCertificateChainPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf8eb", "parentcaller": "0x7797cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76ff13cb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76fe9148", "parentcaller": "0x76fe90fd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0!\\x82\\x1fsettings-win.data.microsoft.com" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3318 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3320 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3322 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3324 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" } ], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3326 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000650" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "PinRulesLogDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir" } ], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000630" }, { "name": "ValueName", "value": "PinRules" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3330 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000065c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000065c" }, { "name": "ValueName", "value": "PinRulesLastSyncTime" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "?\\xc2x|\\xb6\\xee\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime" } ], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76fe80d7", "parentcaller": "0x76fe8043", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000065c" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b2c23d", "parentcaller": "0x77b2c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b2c245", "parentcaller": "0x77b2c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000065c" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77989e76", "parentcaller": "0x76fe8665", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ab1a", "parentcaller": "0x76fe867d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000065c" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798c134", "parentcaller": "0x770086e5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000065c" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77989e76", "parentcaller": "0x770089b9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xf01\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x81\\x8d\\x9a\\xc94\\xc1\\x98w\\x00\\x00\\x00\\x00\\xe5\\x86\\x00w-\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x002\\x06\\x00\\x00\\x00\\x00\\xe0\\xf01\\x06\\x1f\\xddkk\\xe4\\xfc1\\x064\\xc1\\x98w\\xc8K\\x8dk\\xe5\\x86\\x00wX\\xf11\\x06\\x96\\xe3kk\\xf0\\xf5\\x8ak\\x8c\\xae\\x93kT\\xfa\\x7f\\x04\\xc8K\\x8dk\\xd5\\x8d\\x9a\\xc9\\x8c\\xec1\\x06\\xec\\xa8ik\\xe4\\xfc1\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xff\\xa4\\xf11\\x06\\x06\\x19mk5\\x00\\x00\\x00\\x04:\\x8bkT_\\x8bk\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\x8bk\\x0c]\\x8bk\\xff\\xff\\xff\\xffP%\\x8bk\\x08\\x00\\x00\\x00@_\\x8bk\\xe4\\xf11\\x06@\\xf4\\x04\\xf2\\xa4\\xf1\\x94\\xf1\\x08\\xf2\\x00\\x00<\\xff\\x00\\x00@\\xf41\\x06\\x04\\xf21\\x06\\x08\\xf21\\x06\\x00\\x00\\x00\\x00\\xb8\\xf11\\x064\\xc1\\x98w\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\xe4\\xf11\\x06" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798ab1a", "parentcaller": "0x7700870c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000065c" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3342 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000065c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x0000049c" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000065c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe81e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000065c" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3346 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000065c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000065c" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 1, "id": 3348 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d2000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000065c" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff75fe", "parentcaller": "0x77000615", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x800\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x00\\x00\\x00" }, { "name": "Flags", "value": "0x00008004" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76ff75fe", "parentcaller": "0x770007c2", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x07\\xb80\\x82\\x07\\x95\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03!\\x01\\x01\\xff\\x04\\x82\\x07\\x820\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*" }, { "name": "Flags", "value": "0x00008004" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000065c" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77003ca9", "parentcaller": "0x76fe3f13", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000c62", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000cd7", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3359 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000c62", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x81\\xb1\\x02\\x01\\x00\\x02\\x01\\x010\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000cd7", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000c62", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000cd7", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000c62", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000cd7", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000c62", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x08\\x02\\x01\\x00\\x02\\x01\\x010\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000cd7", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000c62", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000cd7", "parentcaller": "0x77003d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3390 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77000b98", "parentcaller": "0x77000d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77003d6d", "parentcaller": "0x76fe3f13", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "\\x17\r180601232859Z" }, { "name": "Flags", "value": "0x00000000" } ], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x77003ac2", "parentcaller": "0x76febd4a", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x01" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x76fea2a6", "parentcaller": "0x76fe9622", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 3402 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x6d196967", "parentcaller": "0x6d194f89", "category": "network", "api": "SslEncryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "GET /settings/v2.0/WSD/Setup360?os=windows&osver=10.0.19041.3803.amd64fre.vb_release.191206-1406&scenarioId=7&platformEdition=Professional&platformInstallationType=Client&sku=48&deviceId=%7B088B0758-31C5-47D8-9C4B-32E98EB1AB80%7D&appver=10.0.19041.572&appBuildLab=vb_release_svc_prod1 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: OneSettingsQuery\r\nHost: settings-win.data.microsoft.com\r\n\r\n" }, { "name": "SequenceNumber", "value": "1" }, { "name": "BufferSize", "value": "390" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x69bab419", "parentcaller": "0x69baae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1396" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x01\\x9e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x018\\xd0\t\\x0e\\xe6\\xf5\\xac\\xb6\\xf9\\xef2\\x87ka:&`\"f9\\xb1a.\\x94\\x15\\xa0>4'l\\x1c#N\\x9fy\\xa2\\x01\\x08AM\\x1b\\xac\\xb2\\xd1\\xdd\\x8cv\\x95\\x90\\xd3`\\D\\xe2\\xb7H\\x89\\xbef\\xd5\\xa2\\xf6\\xe5\\xfaPP\\xf1\\xd0\\x93\\xd1>AC02\\x80\\xbd\\xc8!e\\x1d\\xab\\xf1\\xd6\\xdbQ\\xd3\\xff\\xa7M\\x0f\\xe5\\x97I\\xb7d\\xda\\x12\\xcf\\x91)\\x8e\\xbf\\x8a]\\xeeY\\x06\\xc93\\xdf\\xb8n\\x84\\xa6\\xca\\x1f;|f;\\xa9\\xd1\\xd4w:4\\xc1\\xa0\n\\x97\\x9d\\xadD\\xbf\\xfe\\xea\\xa3P#\\x80\\xfc[\\xee\\x01i\t\\x8c\\xed=\\xca\ne\\xf1g\\xb0`\\xe4y\\x15\\xa2<\\xc1W\\xe4\\x96\\x1a\\x1a}\\xb0\\xa13l\\xb8\\x0b\\xa2X\\xeb\\xcc\\x9fCp\\x98&2\\x9dz\\xe1\\xa8g/\\x8d\\xecg3D\\xfcv\\xd6\\x08/\\xd5wN\\xd7P\\x03/2\\xfc\\x19\\x8d\\xc69w\\x85\\xf0\\x8a\\xc8\\xf8\\xd07\\xca\\xaf\\xa0\\xfe\\x82\\x05%\\xce\\xf3\\xd0` \\x88\\x0ch\\x92q\\xf5R#\t\\xe4o\\x7f\\xbdz\\xb0\\xeczkq\\xa4\\xc1\\xc8\\x9f\\xf2]^\\xa5\\xec\\xccV\\x18\\x95\\x83\\xaf\\xca3^\\xdc\\x06\\xfc\\xbeJ1\\xe1\\xde\\xb2b\\xad5\\x92\t\\xd8\\xc8\\x9b\\xb5\\xed\\x96T\\x1e\\xd0\\x06\\xbb\\xad\\xf2\\x14\\xc9\\xb3\\x7f\\x9b\\x8ev\\xdc\\x0c\\xde\\xe4\\xa5e\\xf56\\xfe]\\x8dj\\xb0\\xa5\\x91\\x925\\x81\\x05A\\x1a+*\\x94\\x8f\\xd2\\x9d\n\\xebg\\W\\xd3Q\\xf2_\\xb5\\xea\\x00\\x89PU\\xf5pgu\\x1eW\\xed\\xc1\\xcb\\x93H\\xb9;:\\xfc\\xc5\\xfcB\\xe6\\xfaS\\x06\\xfcx\\xd5\\x0ft\\xe25\\xc4\\x1b\\x02\\xb3\\xd9\\xcb\\xd7?\\xeb\\xba}\\x9bt^D\\x85\\x05\\x0c\\x8a\\xbfx\\xfb\\xcf\\xfa\\xe3i\\x01\\xef\\xa6\\x19" } ], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-28 22:53:07,294", "thread_id": "6220", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1396" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "6220", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 200 OK\r\nCache-Control: no-cache,no-store\r\nContent-Length: 67\r\nContent-Type: application/json;charset=utf-8\r\nETag: 1371:66A2A386\r\nServer: Microsoft-HTTPAPI/2.0\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: script-src https://settings-sandbox.data.microsoft.com https://settings-ppe.data.microsoft.com https://settings.data.microsoft.com http://onesettings-xbox-rp.com https://settings-win.data.microsoft.com\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nDate: Thu, 28 May 2026 15:53:11 GMT\r\n\r\n{\"refreshInterval\":\"1371\",\"queryUrl\":\"/settings/v2.0/WSD/Setup360\"}" }, { "name": "SequenceNumber", "value": "1" }, { "name": "BufferSize", "value": "600" } ], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "6220", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1396" } ], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9500", "parentcaller": "0x00bc8a90", "category": "network", "api": "WinHttpSendRequest", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x00994018" }, { "name": "Headers", "value": "" }, { "name": "Optional", "value": "" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc952d", "parentcaller": "0x00bc8a90", "category": "network", "api": "WinHttpReceiveResponse", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x00994018" } ], "repeated": 1, "id": 3409 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc957b", "parentcaller": "0x00bc8a90", "category": "network", "api": "WinHttpQueryHeaders", "status": false, "return": "0x00000000", "arguments": [ { "name": "InternetHandle", "value": "0x00994018" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc95c5", "parentcaller": "0x00bc8a90", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x00994018" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc95da", "parentcaller": "0x00bc8a90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc95da", "parentcaller": "0x00bc8a90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 1, "id": 3413 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc960d", "parentcaller": "0x00bc8a90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3414 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9acd", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9b02", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004a8" }, { "name": "SubKey", "value": "WSD" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000510" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9b26", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000510" }, { "name": "SubKey", "value": "Setup360" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000580" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9b5d", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" }, { "name": "ValueName", "value": "ETag" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "1371:66A2A386" }, { "name": "BufferLength", "value": "28" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9b7e", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" }, { "name": "ValueName", "value": "RefreshInterval" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1371" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9b96", "parentcaller": "0x00bc8b08", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000580" }, { "name": "ObjectAttributesName", "value": "Settings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9bc4", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000580" }, { "name": "SubKey", "value": "Settings" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000584" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9bf0", "parentcaller": "0x00bc8b08", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000580" }, { "name": "ObjectAttributesName", "value": "QueryParameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9c17", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000580" }, { "name": "SubKey", "value": "QueryParameters" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000660" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "os" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "windows" }, { "name": "BufferLength", "value": "16" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "osver" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "10.0.19041.3803.amd64fre.vb_release.191206-1406" }, { "name": "BufferLength", "value": "96" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "scenarioId" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "7" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "platformEdition" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "Professional" }, { "name": "BufferLength", "value": "26" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "platformInstallationType" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "Client" }, { "name": "BufferLength", "value": "14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "sku" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "48" }, { "name": "BufferLength", "value": "6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "deviceId" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}" }, { "name": "BufferLength", "value": "78" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "appver" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "10.0.19041.572" }, { "name": "BufferLength", "value": "30" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver" } ], "repeated": 0, "id": 3431 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8d36", "parentcaller": "0x00bc9c2f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" }, { "name": "ValueName", "value": "appBuildLab" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "vb_release_svc_prod1" }, { "name": "BufferLength", "value": "42" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9c59", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9c67", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000584" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9c75", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9c83", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc9c91", "parentcaller": "0x00bc8b08", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bca373", "parentcaller": "0x00bc8b0f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bca3f5", "parentcaller": "0x00bc8b0f", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" } ], "repeated": 0, "id": 3439 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bca425", "parentcaller": "0x00bc8b0f", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RefreshAfter" }, { "name": "Type", "value": "11" }, { "name": "Buffer", "value": "IK\\xbdF\\xb4\\xef\\xdc\\x01" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter" } ], "repeated": 0, "id": 3440 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bca441", "parentcaller": "0x00bc8b0f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc8b96", "parentcaller": "0x00b78120", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 1, "id": 3442 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9b\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3445 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9b\\x13\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:07, Info MOUPG OneSettings: Initialization succeeded, but no values found.\r\n" }, { "name": "Length", "value": "111" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3450 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\n\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\n\\x14\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:07, Info MOUPG SetupHost: OneSettings Initialized -> [No]\r\n" }, { "name": "Length", "value": "94" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "DPAPI.DLL" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\DPAPI.DLL" } ], "repeated": 0, "id": 3456 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dpapi.dll" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dpapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000038c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\dpapi.dll" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00008000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e515000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e514000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3462 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e514000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3465 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e514000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3467 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e514000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3469 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\DPAPI.DLL" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dpapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x6e510000" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dpapi" }, { "name": "BaseAddress", "value": "0x6e510000" }, { "name": "InitRoutine", "value": "0x6e511dc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3474 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88db", "parentcaller": "0x00b6bf2c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72838000" }, { "name": "ModuleName", "value": "WINHTTP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc88fb", "parentcaller": "0x00b6bf2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 3477 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-28 22:53:07,419", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00h\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6216", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 3482 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x727dbb8b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727dbb9c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6216", "caller": "0x7798040b", "parentcaller": "0x727dbbab", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6220", "caller": "0x7798ab1a", "parentcaller": "0x727d8afe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6220", "caller": "0x779a906b", "parentcaller": "0x779a900f", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "30000" } ], "repeated": 0, "id": 3487 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "h\\x14\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "Buffer", "value": "2026-05-28 15:53:07, Info MOUPG SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\SetupMgr.dll]...\r\n" }, { "name": "Length", "value": "160" }, { "name": "Status", "value": "Maximum logged writes reached for this file" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x75f20000" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\$Windows.~WS\\Sources\\WINDLP" }, { "name": "DllBase", "value": "0x699b0000" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr" }, { "name": "DllBase", "value": "0x69ad0000" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-processthreads-l1-1-2.dll" }, { "name": "BaseAddress", "value": "0x75d30000" } ], "repeated": 0, "id": 3495 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "BaseAddress", "value": "0x69ad0000" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7b070", "parentcaller": "0x00b78959", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x69ad0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b7897a", "parentcaller": "0x00b6cd31", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SetupMgr.dll" }, { "name": "ModuleHandle", "value": "0x69ad0000" }, { "name": "FunctionName", "value": "CreateSetupObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x69b106b0" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3500 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3505 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00X\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3508 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3510 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd8\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3513 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00A\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "A\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3521 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xaa\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3526 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x13\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3531 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x7f\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xeb\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3537 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS" } ], "repeated": 0, "id": 3540 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00Y\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3545 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "Y\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3549 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3550 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc8\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00/\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "/\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3558 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa6\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3563 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\r\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\r\\x1a\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3566 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00e\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x1a\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3571 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3576 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3577 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3579 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00E\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "E\\x1b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3582 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3584 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8e\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\\x1b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3589 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe1\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe1\\x1b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3594 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00<\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "<\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x95\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3600 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x95\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xee\\x1c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3609 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00L\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x1d\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3612 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa9\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3615 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa9\\x1d\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\x1e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3621 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3624 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00r\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "r\\x1e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3629 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd7\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd7\\x1e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x008\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8\\x1f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x96\\x1f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3645 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xeb\\x1f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00M \\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3650 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "M \\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb0 \\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb0 \\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3657 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0f!\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0f!\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3663 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00r!\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "r!\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xcd!\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcd!\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3672 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3673 }, { "timestamp": "2026-05-28 22:53:07,434", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3674 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3675 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "%\"\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3676 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3677 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3678 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3679 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x82\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3680 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x82\"\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3681 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3682 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3683 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3684 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdf\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3685 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdf\"\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3686 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3687 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3688 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3689 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00?#\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3690 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "?#\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3691 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3692 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3693 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3694 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa0#\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3695 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0#\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3696 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3697 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3698 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3699 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xfd#\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3700 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfd#\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3701 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3702 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3703 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3704 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\$\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3705 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\$\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3706 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3707 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3708 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3709 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xba$\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3710 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xba$\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3711 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3712 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3713 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3714 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x14%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3715 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x14%\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3716 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3717 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3718 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3719 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x84%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3720 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84%\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3721 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3722 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3723 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3724 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe9%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3725 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe9%\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3726 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3727 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3728 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3729 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00J&\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3730 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "J&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3731 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3732 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther" } ], "repeated": 0, "id": 3733 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3734 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3735 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa6&\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3736 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa6&\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3737 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3738 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00020008" }, { "name": "TokenHandle", "value": "0x00000510" } ], "repeated": 0, "id": 3739 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3740 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "h\\x01\\x98\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3741 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 3742 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0xc0140080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|WRITE_DAC|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3743 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "ntmarta.dll" } ], "repeated": 0, "id": 3744 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" } ], "repeated": 0, "id": 3745 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3746 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000584" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000580" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\ntmarta.dll" } ], "repeated": 0, "id": 3747 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000584" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f4e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00029000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3748 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f505000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3749 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3750 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3751 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3752 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3753 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3754 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000584" } ], "repeated": 0, "id": 3755 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 3756 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f503000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3757 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\ntmarta.dll" } ], "repeated": 0, "id": 3758 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000580" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3759 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 3760 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x6f4e0000" } ], "repeated": 0, "id": 3761 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ntmarta" }, { "name": "BaseAddress", "value": "0x6f4e0000" }, { "name": "InitRoutine", "value": "0x6f4e7e90" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3762 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75bc5000" }, { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3763 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75bc5000" }, { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3764 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000510" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000664" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 3765 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01 (\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3766 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00000668" } ], "repeated": 0, "id": 3767 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 3768 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3769 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xbc\\xd6\\x9b\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00" } ], "repeated": 0, "id": 3770 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x88Q\\x99\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3771 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3772 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc4d\\x9c\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3773 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3774 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x04\\x8f\\x95\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 3775 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x00\\x8f\\x95\\x00\\x00\\x00#\\x00<\\xf00\\xf0h\\x06\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0h\\x06\\x00\\x00\\x84\\xf0Z\\x00\\xb3\\x91\\xb1wh\\x06\\x00\\x00" } ], "repeated": 0, "id": 3776 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k|\\x92x\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8iku\\x93\\xf1\\xcf,\\xebZ\\x00h\\x06\\x00\\x00\\xe0\\xf4Z\\x00\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xff<\\xf0Z\\x00\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 3777 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000668" } ], "repeated": 0, "id": 3778 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000664" } ], "repeated": 0, "id": 3779 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00020008" }, { "name": "TokenHandle", "value": "0x00000664" } ], "repeated": 0, "id": 3780 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3781 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "h\\x01\\x98\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3782 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000664" } ], "repeated": 0, "id": 3783 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "DesiredAccess", "value": "0xc0140080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|WRITE_DAC|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3784 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000664" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000584" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 3785 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000584" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01\"-\\xfa\\xbf\\xf4\\xee\\xdc\\x01 (\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3786 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00000660" } ], "repeated": 0, "id": 3787 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000584" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 3788 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3789 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xec\\xd8\\x9b\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00" } ], "repeated": 0, "id": 3790 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0O\\x99\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x12\\xe5\\x00\\x00\\x8c\\x00\\x8f\\x00\\x8c\\x00\\x8f\\x008\\x00\\x8f\\x008\\x00\\x8f\\x00\\x00P\\x99\\x00\\x00\\xa0\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3791 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3792 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "de\\x9c\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3793 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3794 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xa4\\x8e\\x95\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 3795 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\xa0\\x8e\\x95\\x00\\x00\\x00#\\x00<\\xf00\\xf0`\\x06\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0`\\x06\\x00\\x00\\x84\\xf0Z\\x00\\xb3\\x91\\xb1w`\\x06\\x00\\x00" } ], "repeated": 0, "id": 3796 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k|\\x92x\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8iku\\x93\\xf1\\xcf,\\xebZ\\x00`\\x06\\x00\\x00\\xe0\\xf4Z\\x00\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xff<\\xf0Z\\x00\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 3797 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" } ], "repeated": 0, "id": 3798 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000584" } ], "repeated": 0, "id": 3799 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d7000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3800 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3801 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3802 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3803 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3804 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3805 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3806 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3807 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3808 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3809 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3810 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3811 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3812 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3813 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d6000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3814 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009d4000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3815 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3816 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3817 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3818 }, { "timestamp": "2026-05-28 22:53:07,450", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "460" } ], "repeated": 0, "id": 3819 }, { "timestamp": "2026-05-28 22:53:07,465", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3820 }, { "timestamp": "2026-05-28 22:53:07,465", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3821 }, { "timestamp": "2026-05-28 22:53:07,465", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3822 }, { "timestamp": "2026-05-28 22:53:07,465", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "460" } ], "repeated": 0, "id": 3823 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000584" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x699ff6e0" }, { "name": "Parameter", "value": "0x009b47fc" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6936" }, { "name": "ProcessId", "value": "2088" }, { "name": "Module", "value": "WINDLP.DLL" } ], "repeated": 0, "id": 3824 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000584", "arguments": [ { "name": "StartRoutine", "value": "0x699ff6e0" }, { "name": "ModuleName", "value": "WINDLP.DLL" }, { "name": "Parameter", "value": "0x009b47fc" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6936" } ], "repeated": 0, "id": 3825 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xedZ\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x03\\x00\\x00\\x02\\x02\\x00\\x00\\xf0\\xedZ\\x00h\\xa2~\\x04\\xa0\\xe7\\xafwl\\x06\\x00\\x00F\\x02\\x00\\x00h\\xa2~\\x04l\\x06\\x00\\x00\\xa0\\xe7\\xafw" } ], "repeated": 0, "id": 3826 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000670" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3827 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000674" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000670" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International\\Geo" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo" } ], "repeated": 0, "id": 3828 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000670" } ], "repeated": 0, "id": 3829 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000674" }, { "name": "ValueName", "value": "Nation" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "12" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation" } ], "repeated": 0, "id": 3830 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3831 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3832 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3833 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "6936", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3834 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "6936", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 3835 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x80'\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3836 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80'\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3837 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3838 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 3839 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3840 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd6'\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3841 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd6'\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3842 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3843 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3844 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3845 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00B(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3846 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "B(\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3847 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3848 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3849 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3850 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xae(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3851 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae(\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3852 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3853 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3854 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3855 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1a)\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3856 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1a)\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3857 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3858 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Sources\\ws.dat" } ], "repeated": 0, "id": 3859 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3860 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3861 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x98)\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3862 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x98)\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3863 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3864 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate" }, { "name": "Handle", "value": "0x00000674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate" } ], "repeated": 0, "id": 3865 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "SusClientId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId" } ], "repeated": 0, "id": 3866 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "SusClientId" }, { "name": "Data", "value": "0e9cfb40-0d63-45be-b169-515d335337a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId" } ], "repeated": 0, "id": 3867 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3868 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3869 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3870 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x04*\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3871 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04*\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3872 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3873 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\LegacyInterrupt.dat" } ], "repeated": 0, "id": 3874 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3875 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3876 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x94*\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3877 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x94*\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3878 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3879 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 3880 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x00000674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 3881 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "CSDBuildNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber" } ], "repeated": 0, "id": 3882 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3883 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3884 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x00000674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 3885 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "BuildBranch" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch" } ], "repeated": 0, "id": 3886 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "BuildBranch" }, { "name": "Data", "value": "vb_release" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch" } ], "repeated": 0, "id": 3887 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3888 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6bff0", "parentcaller": "0x00b69129", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Sources\\ws.dat" } ], "repeated": 0, "id": 3889 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3890 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3891 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01+\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3892 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x01+\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3893 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3894 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup" }, { "name": "Handle", "value": "0x00000674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup" } ], "repeated": 0, "id": 3895 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "Compact" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact" } ], "repeated": 0, "id": 3896 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3897 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3898 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability" }, { "name": "Handle", "value": "0x00000674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability" } ], "repeated": 0, "id": 3899 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "EnablePreviewBuilds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds" } ], "repeated": 0, "id": 3900 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3901 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3902 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3903 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00_+\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3904 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "_+\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3905 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3906 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3907 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3908 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc9+\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3909 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9+\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3910 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3911 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Control\\ProductOptions" }, { "name": "Handle", "value": "0x00000674" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\ProductOptions" } ], "repeated": 0, "id": 3912 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "ProductType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType" } ], "repeated": 0, "id": 3913 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" }, { "name": "ValueName", "value": "ProductType" }, { "name": "Data", "value": "WinNT" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType" } ], "repeated": 0, "id": 3914 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00b6c020", "parentcaller": "0x00b69129", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 3915 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3916 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3917 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00.,\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3918 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ".,\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3919 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3920 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3921 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3922 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9b,\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3923 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9b,\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3924 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3925 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3926 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3927 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf6,\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3928 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6,\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3929 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3930 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3931 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3932 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00T-\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3933 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "T-\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3934 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 3935 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3936 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3937 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3938 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3939 }, { "timestamp": "2026-05-28 22:53:07,481", "thread_id": "4400", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "Buffer", "value": "\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4315 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727e5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006dc" } ], "repeated": 0, "id": 4316 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d8" } ], "repeated": 0, "id": 4317 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727e50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e0" } ], "repeated": 0, "id": 4318 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e4" } ], "repeated": 0, "id": 4319 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6948", "caller": "0x6d2a16b1", "parentcaller": "0x75cc148c", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000003", "pretty_value": "FILE_READ_ACCESS|FILE_WRITE_ACCESS" }, { "name": "FileName", "value": "\\Device\\RasAcd" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4320 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6948", "caller": "0x77999924", "parentcaller": "0x75cbf81d", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4321 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6952", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4322 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 4323 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4324 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4325 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4326 }, { "timestamp": "2026-05-28 22:53:07,497", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4327 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06631000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4328 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4329 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4330 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4331 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4332 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4333 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4334 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b046e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4335 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4336 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4337 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4338 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4339 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4340 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4341 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4342 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4343 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4344 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4345 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4346 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4347 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4348 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4349 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4350 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4351 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4352 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4353 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4354 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4355 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4356 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4357 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4358 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4359 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4360 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06641000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4361 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4362 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4363 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4364 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4365 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4366 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4367 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4368 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4369 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4370 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4371 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06638000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4372 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06638000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4373 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663c000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4374 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4375 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4376 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4377 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663c000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4378 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4379 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06638000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4380 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06638000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4381 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663a000" }, { "name": "RegionSize", "value": "0x00016000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4382 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4383 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4384 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663a000" }, { "name": "RegionSize", "value": "0x00016000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4385 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4386 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663c000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4387 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4388 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4389 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663c000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4390 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06624000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4391 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06638000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4392 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06638000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4393 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663a000" }, { "name": "RegionSize", "value": "0x00016000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4394 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4395 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4396 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4397 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4398 }, { "timestamp": "2026-05-28 22:53:07,512", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4399 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4400 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4401 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4402 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4403 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6216", "caller": "0x75cbdc64", "parentcaller": "0x75cc4f9e", "category": "network", "api": "WSASocketW", "status": true, "return": "0x000006d8", "arguments": [ { "name": "af", "value": "23", "pretty_value": "AF_INET6" }, { "name": "type", "value": "2", "pretty_value": "SOCK_DGRAM" }, { "name": "protocol", "value": "0" }, { "name": "socket", "value": "1752" } ], "repeated": 0, "id": 4404 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6216", "caller": "0x6e61a714", "parentcaller": "0x75cbdd57", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000006d8" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "IoControlCode", "value": "0x000120bf", "pretty_value": "IOCTL_AFD_DEFER_ACCEPT" }, { "name": "InputBuffer", "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\xc8\\x01\\x00\\x00\\x00\\xb0\\x02\\x9b\\x00\\x0c\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00H\\x83\\x96\\x00\\x1c\\x00\\x00\\x00" } ], "repeated": 0, "id": 4405 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6216", "caller": "0x6e61a9c5", "parentcaller": "0x6e61a75c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4406 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6216", "caller": "0x6e61ac73", "parentcaller": "0x6e61aa9e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d8" } ], "repeated": 0, "id": 4407 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69baf7b6", "parentcaller": "0x69bafd35", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4408 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bbb752", "parentcaller": "0x69bc1f5c", "category": "network", "api": "WSASocketW", "status": true, "return": "0x000006b8", "arguments": [ { "name": "af", "value": "2", "pretty_value": "AF_INET" }, { "name": "type", "value": "1", "pretty_value": "SOCK_STREAM" }, { "name": "protocol", "value": "6", "pretty_value": "IPPROTO_TCP" }, { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4409 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bbb827", "parentcaller": "0x69bc1f5c", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" }, { "name": "level", "value": "0x0000ffff" }, { "name": "optname", "value": "0x00003007" }, { "name": "optval", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4410 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bbb878", "parentcaller": "0x69bc1f5c", "category": "network", "api": "bind", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" }, { "name": "ip", "value": "0.0.0.0" }, { "name": "port", "value": "0" } ], "repeated": 0, "id": 4411 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bbb8dc", "parentcaller": "0x69bc1f5c", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" }, { "name": "level", "value": "0x00000006" }, { "name": "optname", "value": "0x00000001" }, { "name": "optval", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4412 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x75d52066", "parentcaller": "0x69bbba78", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006b8" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "FileInformationClass", "value": "41", "pretty_value": "FileIoStatusBlockRangeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4413 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x77b2739f", "parentcaller": "0x77b271b6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006b8" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "T\\x00\\x00\\x00\\xa8\\xdf\\x99\\x00" } ], "repeated": 0, "id": 4414 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69baee81", "parentcaller": "0x69bc1fa6", "category": "network", "api": "ConnectEx", "status": false, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" }, { "name": "SendBuffer", "value": "" }, { "name": "ip", "value": "23.202.166.58" }, { "name": "port", "value": "443" } ], "repeated": 0, "id": 4415 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x75cb5ad9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" } ], "repeated": 0, "id": 4416 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4417 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bc2329", "parentcaller": "0x69bae296", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" }, { "name": "level", "value": "0x0000ffff" }, { "name": "optname", "value": "0x00007010" }, { "name": "optval", "value": "" } ], "repeated": 0, "id": 4418 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x6e62ac5d", "parentcaller": "0x75cc234d", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006b8" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "IoControlCode", "value": "0x0001202f", "pretty_value": "IOCTL_AFD_GET_SOCK_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\xc2%\\xc0\\xa8\\x01i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4419 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x74d97592", "parentcaller": "0x74da158b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4420 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x77999924", "parentcaller": "0x76c1c2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4421 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4422 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bab419", "parentcaller": "0x69bc2d0d", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1720" }, { "name": "Buffer", "value": "\\x16\\x03\\x03\\x00\\xb2\\x01\\x00\\x00\\xae\\x03\\x03j\\x18\\xc7S\\xd6\\x1f&\\x04\\xea\\xef\\xb0\\xf9\\xdb\\xbb\\xe8Z<\\x00\\xa5\\xba\\x8e\\xb8\\xd7\\xe1C\\xdb\\xd4\\x0f\\xf84Sl\\x00\\x00&\\xc0,\\xc0+\\xc00\\xc0/\\xc0$\\xc0#\\xc0(\\xc0'\\xc0\n\\xc0\t\\xc0\\x14\\xc0\\x13\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\n\\x01\\x00\\x00_\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10go.microsoft.com\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\n\\x00\\x08\\x00\\x06\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00\r\\x00\\x1a\\x00\\x18\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x02\\x01\\x04\\x03\\x05\\x03\\x02\\x03\\x02\\x02\\x06\\x01\\x06\\x03\\x00#\\x00\\x00\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00" } ], "repeated": 0, "id": 4423 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06636000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4424 }, { "timestamp": "2026-05-28 22:53:07,528", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4425 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4426 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4427 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4428 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4429 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4430 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4431 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663a000" }, { "name": "RegionSize", "value": "0x00016000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4432 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4433 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4434 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4435 }, { "timestamp": "2026-05-28 22:53:07,544", "thread_id": "6952", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00Pu\\x00(\\x08\\x00\\x00(\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6952" } ], "repeated": 0, "id": 4436 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x69bab419", "parentcaller": "0x69bc2d0d", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1720" }, { "name": "Buffer", "value": "\\x16\\x03\\x03\\x00F\\x10\\x00\\x00BA\\x04\\xd8p\\xf7\\x1f\\xefd\\xd3\\xda\\xbd\\xdc\\x14\\xb7\\x16\\xee\\x90}\\xb1[gl\\x80\\x04\\xcc\\x9c\\O\\x85\\xa5\\xca\\xf0\\x1b\\x01\\xce\\x9d\\x1a\\x99Q9X2\\xe2Hbv\\xd3\\xads\\x80\\xa0g\\xa9\\xe3i\\xd3\\x8f\\xa9\\xa7\\xa0z\\xfc~|\\xe3\\xba\\x14\\x03\\x03\\x00\\x01\\x01\\x16\\x03\\x03\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00O\\xce7\\xb1{\\x07q\\xfd\\xf10\\xbcZ\\xb2U\\xdc\\x9a\\xd5\\x86w\\xdb\\x11\n\\xca\\x08\\x8e\\x82\\xe5K\\x87P$\\xb6\\x92\\xae\\xea\\xa8d\\x87\\xa7\\xff8+\\xb4|\\x91H\\x9c\\x88\\xb7Z\\xa2S\\xa6Ph[(\\xd2\\xa0r\\xb3\\xe5\\x84\\xc4!KnlE\\xcc\\xc9\\x93}\\xe7x\\x83\\x05\\x95\\xe4\\x0b\\xb2\\xcfFX\\x14\\x9f.\\x030\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00KN\\xb4\\xb0t)\\x8b\\x82\\x8b\\\\x000\\x95\\xa1\\x0bE#\\xfb\\x95\\x1c\\x0c\\x884\\x8b\t\\xc5>[\\xab\\xa4\\x08\\xa3\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe4\\xa6\\x8a\\xc8T\\xacRBF\n\\xfdrH\\x1b*D \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92\\x03\\x00\\x000\\x82\\x03\\x8e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob" } ], "repeated": 0, "id": 4531 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x7798040b", "parentcaller": "0x76ff2a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" } ], "repeated": 0, "id": 4532 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4533 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x76ff71d3", "parentcaller": "0x76ff69bd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x8e0\\x82\\x02v\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x03:\\xf1\\xe6\\xa7\\x11\\xa9\\xa0\\xbb(d\\xb1\\x1d\t\\xfa\\xe50\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G20\\x1e\\x17\r130801120000Z\\x17\r380115120000Z0a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17Dig" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4534 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x76fe9148", "parentcaller": "0x76fe90fd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0P\\x82\\x11go2.microsoft.com\\x82\\x10go.microsoft.com\\x82\nwww.aka.ms\\x82\\x06aka.ms\\x82\\x15fast.go.microsoft.com" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4535 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x77003ac2", "parentcaller": "0x76febd4a", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x01" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4536 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x76fea2a6", "parentcaller": "0x76fe9622", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 4537 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x6d196967", "parentcaller": "0x6d194f89", "category": "network", "api": "SslEncryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HEAD /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com\r\n\r\n" }, { "name": "SequenceNumber", "value": "1" }, { "name": "BufferSize", "value": "121" } ], "repeated": 0, "id": 4538 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x69bab419", "parentcaller": "0x69baae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1720" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x00\\x91\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01b\\x1a\\x0fH\\xfe\\x1e\\xcd\\x926\\x16\\xcb\\x9f\\x88H\\xd95Q\\x12y\\xfe$\\xf6\\xa00b\\xad\\x15\\x9b\\xf5\\x9a\\xa4q\\x91\\x91\\xa2\\xea\\x07ki\\\\xb7\\xa7v\\x19W\\x06\\xaaju+\\x12\\x07\\xda\\xa7\\x06\\x17:\\xb2R\\xca$\\xa3X\\xd5\\xd5\\xe7\\x8c\\xc8\\xce L\\xbfsY|\\xf3\\xf0\\xfax'\\xa6\\xe3)@\\x93\\xad\\xe4\\xb9(GG\\xdc\\x8b\\xde\\x88SoI:\\xca\\xab\\xc2\\xb7\\x1c\\xa0\\x88i\\xfe\\x0c\\x1a\\x87\\x90\\xf3\\xd7\\xd6\\x7f\\x0f)Wy\\xd58\\x15)H\\x8bf\\x11;v1\\xa8\\xcf<\\xd2L\\x03" } ], "repeated": 0, "id": 4539 }, { "timestamp": "2026-05-28 22:53:07,559", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4540 }, { "timestamp": "2026-05-28 22:53:07,856", "thread_id": "6952", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 302 Moved Temporarily\r\nServer: Kestrel\r\nLocation: https://download.microsoft.com/download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab\r\nRequest-Context: appId=cid-v1:d94c0f68-64bf-4036-8409-a0e761bb7ee1\r\nX-Response-Cache-Status: True\r\nContent-Length: 0\r\nExpires: Thu, 28 May 2026 15:53:12 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 May 2026 15:53:12 GMT\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000 ; includeSubDomains\r\n\r\n" }, { "name": "SequenceNumber", "value": "1" }, { "name": "BufferSize", "value": "506" } ], "repeated": 0, "id": 4541 }, { "timestamp": "2026-05-28 22:53:07,856", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4542 }, { "timestamp": "2026-05-28 22:53:07,856", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 4543 }, { "timestamp": "2026-05-28 22:53:07,856", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d4" } ], "repeated": 0, "id": 4544 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x7798ac59", "parentcaller": "0x7279cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4545 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 4546 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4547 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727e5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 4548 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d4" } ], "repeated": 0, "id": 4549 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727e50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4550 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4551 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6952", "caller": "0x69bb00dc", "parentcaller": "0x69bafb17", "category": "network", "api": "GetAddrInfoExW", "status": false, "return": "0x000003e5", "arguments": [ { "name": "Name", "value": "download.microsoft.com" }, { "name": "ServiceName", "value": "" } ], "repeated": 0, "id": 4552 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6216", "caller": "0x75d21941", "parentcaller": "0x743770b3", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "HandleName", "value": "\\Device\\Nsi" }, { "name": "IoControlCode", "value": "0x00120007" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xf1)\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xf1)\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00 \\xf1)\\x06\\xb3p7t\\x01\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4553 }, { "timestamp": "2026-05-28 22:53:07,872", "thread_id": "6948", "caller": "0x6d2a16b1", "parentcaller": "0x75cc148c", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000003", "pretty_value": "FILE_READ_ACCESS|FILE_WRITE_ACCESS" }, { "name": "FileName", "value": "\\Device\\RasAcd" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4554 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6216", "caller": "0x75cbdc64", "parentcaller": "0x75cc4f9e", "category": "network", "api": "WSASocketW", "status": true, "return": "0x000006d4", "arguments": [ { "name": "af", "value": "23", "pretty_value": "AF_INET6" }, { "name": "type", "value": "2", "pretty_value": "SOCK_DGRAM" }, { "name": "protocol", "value": "0" }, { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4555 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6216", "caller": "0x6e61a714", "parentcaller": "0x75cbdd57", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000006d4" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "IoControlCode", "value": "0x000120bf", "pretty_value": "IOCTL_AFD_DEFER_ACCEPT" }, { "name": "InputBuffer", "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\xc8\\x01\\x00\\x00\\x00\\x98\\x05\\x9b\\x00\\x0c\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x90\\x81\\x96\\x00\\x1c\\x00\\x00\\x00" } ], "repeated": 0, "id": 4556 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6216", "caller": "0x6e61a9c5", "parentcaller": "0x6e61a75c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4557 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6216", "caller": "0x6e61ac73", "parentcaller": "0x6e61aa9e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d4" } ], "repeated": 0, "id": 4558 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69baf7b6", "parentcaller": "0x69bafd35", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4559 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bbb752", "parentcaller": "0x69bc1f5c", "category": "network", "api": "WSASocketW", "status": true, "return": "0x000006d4", "arguments": [ { "name": "af", "value": "2", "pretty_value": "AF_INET" }, { "name": "type", "value": "1", "pretty_value": "SOCK_STREAM" }, { "name": "protocol", "value": "6", "pretty_value": "IPPROTO_TCP" }, { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4560 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bbb827", "parentcaller": "0x69bc1f5c", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" }, { "name": "level", "value": "0x0000ffff" }, { "name": "optname", "value": "0x00003007" }, { "name": "optval", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4561 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bbb878", "parentcaller": "0x69bc1f5c", "category": "network", "api": "bind", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" }, { "name": "ip", "value": "0.0.0.0" }, { "name": "port", "value": "0" } ], "repeated": 0, "id": 4562 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bbb8dc", "parentcaller": "0x69bc1f5c", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" }, { "name": "level", "value": "0x00000006" }, { "name": "optname", "value": "0x00000001" }, { "name": "optval", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4563 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x75d52066", "parentcaller": "0x69bbba78", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006d4" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "FileInformationClass", "value": "41", "pretty_value": "FileIoStatusBlockRangeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4564 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x77b2739f", "parentcaller": "0x77b271b6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006d4" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "T\\x00\\x00\\x00h\\xe5\\x99\\x00" } ], "repeated": 0, "id": 4565 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69baee81", "parentcaller": "0x69bc1fa6", "category": "network", "api": "ConnectEx", "status": false, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" }, { "name": "SendBuffer", "value": "" }, { "name": "ip", "value": "23.202.165.103" }, { "name": "port", "value": "443" } ], "repeated": 0, "id": 4566 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x75cb5ad9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4567 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4568 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bc2329", "parentcaller": "0x69bae296", "category": "network", "api": "setsockopt", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" }, { "name": "level", "value": "0x0000ffff" }, { "name": "optname", "value": "0x00007010" }, { "name": "optval", "value": "" } ], "repeated": 0, "id": 4569 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x6e62ac5d", "parentcaller": "0x75cc234d", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006d4" }, { "name": "HandleName", "value": "\\Device\\Afd" }, { "name": "IoControlCode", "value": "0x0001202f", "pretty_value": "IOCTL_AFD_GET_SOCK_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\xc2&\\xc0\\xa8\\x01i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4570 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x74d97592", "parentcaller": "0x74da158b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 4571 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 4572 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bab419", "parentcaller": "0x69bc2d0d", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1748" }, { "name": "Buffer", "value": "\\x16\\x03\\x03\\x00\\xb8\\x01\\x00\\x00\\xb4\\x03\\x03j\\x18\\xc7T\\x96\\xaf3\\xfe\\x8c\\x9f\\xf5\\xfdAY\\x99\\x0f\\x17\\xfd\\xd6\\xbdc-\\xc8\\x04\\x17B\\x19z\r\\x1c\\xd2\\x85\\x00\\x00&\\xc0,\\xc0+\\xc00\\xc0/\\xc0$\\xc0#\\xc0(\\xc0'\\xc0\n\\xc0\t\\xc0\\x14\\xc0\\x13\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\n\\x01\\x00\\x00e\\x00\\x00\\x00\\x1b\\x00\\x19\\x00\\x00\\x16download.microsoft.com\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\n\\x00\\x08\\x00\\x06\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00\r\\x00\\x1a\\x00\\x18\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x02\\x01\\x04\\x03\\x05\\x03\\x02\\x03\\x02\\x02\\x06\\x01\\x06\\x03\\x00#\\x00\\x00\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00" } ], "repeated": 0, "id": 4573 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4574 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 4575 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 4576 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4577 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 1, "id": 4578 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4579 }, { "timestamp": "2026-05-28 22:53:08,012", "thread_id": "6948", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 4580 }, { "timestamp": "2026-05-28 22:53:08,028", "thread_id": "6948", "caller": "0x69bab419", "parentcaller": "0x69bc2d0d", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1748" }, { "name": "Buffer", "value": "\\x16\\x03\\x03\\x00F\\x10\\x00\\x00BA\\x04L0\\xf0\\xa6\\x81\\x9ePD\\xc7\\xacY\\xb8`\\xaa\\xdc\\xe7\\xef9\\xf0m\\xe1\\x149\\xc2\\xf6`\\x07\\x1e\\x07\\x85:\\xeb\\xa6D\\xf9\\xe8\\xd1\\xafghhc~\\xa9\\xfd\\xdd&\\*\\xb8\\xf2\\xce'\n\\xd6M\\xfe\\xfe!\\xa3`v\\xb8G\\x14\\x03\\x03\\x00\\x01\\x01\\x16\\x03\\x03\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x88\\x8a\\xfa\\xc3i.\\xc3\\xbe\\xdczY/\\xbdN\\x0f\\x18\\xd3\\x13\\xb7\\x05\\xbc\\x18DL\\x93\\x03B72\\xd0\\xde" } ], "repeated": 0, "id": 4581 }, { "timestamp": "2026-05-28 22:53:08,028", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4582 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x74d97dba", "parentcaller": "0x74da25ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 4583 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x6d125d74", "parentcaller": "0x70dd3f73", "category": "crypto", "api": "BCryptImportKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyBlob", "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x006Cp\\x91r\\xe4h>\\xf9\\xda\\xf3\\x06\\xb1\\xb7\\xad\\x9a6d:l\\xa6\\xc0\\xb5\\x86\\x06C\\xdf,n\\xf4\\xe8#\\x00\\x00\\x00\\x006Cp\\x91r\\xe4h>\\xf9\\xda\\xf3\\x06\\xb1\\xb7\\xad\\x9a6d:l\\xa6\\xc0\\xb5\\x86\\x06C\\xdf,n\\xf4\\xe8#\\x88\\xd8V\\x0e\\xfa<>0\\x03\\xe6\\xcd6\\xb2Q`\\xac\\x01\\xb5\\xea\\xfd\\xa7u_{\\xa16\\x80W\\xcf\\xc2ht\\xaf\\x9d\\xc4\\x84U\\xa1\\xfa\\xb4VG7\\x82\\xe4\\x16W.h\\xf2\\xb1\\xcc\\xcf\\x87\\xee\\xb7n\\xb1n\\xe0\\xa1s\\x06\\x94$\\xf2\\xe6\\xb6qS\\x1c\\x02'\\x14+\\x80\\xc3\\x02|\\xaeF\\x85\\xa1(\\x89\\x02O\\x9f\\xe7\\xb3!\\x7fF\\xc0'\\xeb\\x96>\\x0f\\xec\\xe7m\\x13\\xee\\xc0y8n\\x03{D\\xc0=\\xa4\\xba\\x92\\xb4\\xa6\\xf5\rS\\x15\\xd4r\\x15\\xd5\\xf3\\x99\\x853\\xe1\\xb5b^\\xf2[\\xa2'\\xca5\\xa1\\\\x8e\\xf5\\x0f\\xee\\xa3t\\xbbHVy\\xe8]\\x82\\x0b\\xfd\\x88q\\x92" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x06644550" }, { "name": "Length", "value": "560" } ], "repeated": 0, "id": 4584 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x6d125d74", "parentcaller": "0x70dd3f73", "category": "crypto", "api": "BCryptImportKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyBlob", "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\x02\\xc6\\xb6\\x83\\xf0\t\\xcc\\xdf\\x9eu\\x06+]\\xa0\\x8e?z\\xe6 \\xec\\xa3*\\xb7\\xefo2\\xac&\\xbb[\\xfa\"\\x00\\x00\\x00\\x00\\x02\\xc6\\xb6\\x83\\xf0\t\\xcc\\xdf\\x9eu\\x06+]\\xa0\\x8e?z\\xe6 \\xec\\xa3*\\xb7\\xefo2\\xac&\\xbb[\\xfa\":\\xeb%i\\xca\\xe2\\xe9\\xb6T\\x97\\xef\\x9d\t7a\\xa2{|\\xcf\\xd6\\xd8Vx9\\xb7d\\xd4\\x1f\\x0c?.=M\\xda\\x02\\x97\\x878\\xeb!\\xd3\\xaf\\x04\\xbc\\xda\\x98e\\x1e,:\\x82\\xa4\\xf4l\\xfa\\x9dC\\x08.\\x82O7\\x00\\xbf\\xd3\\xb9\n\\x13T\\x81\\xe12\\x87.\\xe5\\x8e]\\xb6\\x80\\x90`tO\\xc4\\x94\\x18\\xb5Y\\xd7\\x10\\x9b\\xdb\\x98'\\x9bd\\x17\\xadIUC,\\xa8g\\xc4\\x02M\\xe9\\x99\\xb4\\xcdy\\x8e\\xf9\\xf2r\\x1a\\xe1G+\\xcd\\xf1\\xdc\\xf0U\\xd6G\\x94\\xf1\rk\\xa9\\xb2!\\xc3\\xcev#\\x8e'\\xef\\x97C^Qq\\xe8*K\\x90\\xaf\\x01\\x86as\\xf1\\xd3\\xb74e" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x06645250" }, { "name": "Length", "value": "560" } ], "repeated": 0, "id": 4585 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x06\\xef0\\x82\\x06u\\xa0\\x03\\x02\\x01\\x02\\x02\\x13a\\x00\\x01Hy~\\xb3V\\xb6.!\\xd5\\x1c\\x00\\x00\\x00\\x01Hy0\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060\\x1e\\x17\r260511021540Z\\x17\r261125021540Z0t1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1d" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4586 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x04j0\\x82\\x03\\xef\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\\x06o\\xa2L1\\xc3\\x95o\\xab\\x00\\x00\\x00\\x00\\x00\\x060\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G20\\x1e\\x17\r250801200203Z\\x17\r290603200203Z0W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060v0\\x10\\x06\\x07" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4587 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x03;0\\x82\\x02\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x08\\xd3\\xc6\\xd0\\x01\\xf2l\\xb5\\xa2?\\x0c}js\\xff\\xb60\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G30\\x1e\\x17\r250521000000Z\\x17\r290619235959Z0Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4588 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x06\\xef0\\x82\\x06u\\xa0\\x03\\x02\\x01\\x02\\x02\\x13a\\x00\\x01Hy~\\xb3V\\xb6.!\\xd5\\x1c\\x00\\x00\\x00\\x01Hy0\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060\\x1e\\x17\r260511021540Z\\x17\r261125021540Z0t1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1d" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4589 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x04j0\\x82\\x03\\xef\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\\x06o\\xa2L1\\xc3\\x95o\\xab\\x00\\x00\\x00\\x00\\x00\\x060\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G20\\x1e\\x17\r250801200203Z\\x17\r290603200203Z0W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060v0\\x10\\x06\\x07" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4590 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76ff71d3", "parentcaller": "0x76ff6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x03;0\\x82\\x02\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x08\\xd3\\xc6\\xd0\\x01\\xf2l\\xb5\\xa2?\\x0c}js\\xff\\xb60\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G30\\x1e\\x17\r250521000000Z\\x17\r290619235959Z0Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 4591 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x77b2c23d", "parentcaller": "0x77b2c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4592 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x77b2c245", "parentcaller": "0x77b2c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4593 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x77989e76", "parentcaller": "0x76fe85fb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4594 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x76fe8618", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4595 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x76fe8798", "parentcaller": "0x76fe8278", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4596 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 4597 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4598 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4599 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4600 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000063c" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates" } ], "repeated": 0, "id": 4601 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4602 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4603 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4604 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4605 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4606 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 4607 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4608 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006a4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4609 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4610 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4611 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000640" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 4612 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4613 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4614 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4615 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000644" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 4616 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4617 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4618 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4619 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4620 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4621 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 4622 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4623 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006a4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4624 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4625 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4626 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000648" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 4627 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4628 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B" } ], "repeated": 0, "id": 4629 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4630 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 4631 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4632 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4633 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4634 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000063c" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates" } ], "repeated": 0, "id": 4635 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4636 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4637 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4638 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4639 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4640 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 4641 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4642 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006a4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4643 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4644 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4645 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000640" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 4646 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4647 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4648 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4649 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000644" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 4650 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4651 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4652 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4653 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7797f8f1", "parentcaller": "0x7797d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4654 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf320", "parentcaller": "0x7797d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 4655 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 4656 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4657 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006a4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4658 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4659 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76fe8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4660 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000648" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 4661 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4662 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5" } ], "repeated": 0, "id": 4663 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4664 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000638" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 4665 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E" } ], "repeated": 0, "id": 4666 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E" } ], "repeated": 0, "id": 4667 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x7798040b", "parentcaller": "0x76ff0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4668 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000063c" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates" } ], "repeated": 0, "id": 4669 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E" } ], "repeated": 0, "id": 4670 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E" } ], "repeated": 0, "id": 4671 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "ValueName", "value": "Blob" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob" } ], "repeated": 1, "id": 4672 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006a4" }, { "name": "ValueName", "value": "Blob" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x80\\x01\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xb0\t\\xe9\\x9a\\\\xfc\\x92\\x8a\\x171\\x90\\x10m\\xbb2\\xa9\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00~\\x04\\xde\\x89j>fm\\x00\\xe6\\x87\\xd3?\\xfa\\xd9;\\xe8=4\\x9e\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd0\\xab9\\xed\\xd1\\xa4\\xd8\\x9aU\\x12\\x88-\\xeb\t\\xcb\\x13\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb3\\xdbH\\xa4\\xf9\\xa1\\xc5\\xd8\\xae6A\\xcc\\x11cib)\\xbcK\\xc6b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x001\\xadfH\\xf8\\x10A8\\xc78\\xf3\\x9e\\xa42\\x0139>:\\x18\\xcc\\x02)n\\xf9|*\\xc9\\xefg1\\xd0\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x003\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\x82\\xc8\\x01\\x999w\"\\xb5z\\xd4s\\xea&k\\x93\\xd4\\x7f\\xfcw\\xfe\\x07\\xf0\\x93\\x884_ \\xda\\xb6\\xad\\xdd\\x08vr\\xf9\\x88\\xb4\\xbb\\xfd\\x15LK\\x13\\xe1\\x11,\\xdb\\xb9\\xee\\xfb\\x0bR>\\x1a\\xfe\\xd0+u\\xad]\\x94\\xde\\xe8\\x8b\\xbe\\x9a3u\\xf1i\\xfc\\x0b\\xb3\\x83\\xf1\\x83\\x0f\\x94^h\\x1e;{\\xa9\\x93\\x92\\xcf\\x0f\\xd2\\xc2\\xe4\\x8b\\x18n\\xd6\\xde\\xe8\\x1b^_PvsGQ<\\xe2\\xb4#\\xf6\\xea\\xfb*\\x91\\xda\\xa7\\x08\\x96\\x92j\\xb8\\xb8\\xa1\\xecS\\x14O\\xe3%\\xa8\\xf2`\r\\xb9\\xa3vS\\xd6\\x1c\\xdf\\\\x98\\xb3\\x0fKZ\\xf4\\x8e\\xb2\\xd3\\x03v\\xc0\\x9e\\x8e\\xdfK\\xb2\\x89#]\\x88\\x82\\\\x85\\x10u\\xcb\\xdd'\\x12\\xee\\xa0\\xcf\\xff\\x0cA\\xe7\\xe2\\x94\\x83\\x9eXF\\xb3\\x9b\\xb3\\x16\\x89\\x9b\\xc1?e\\xae_\\xb0\"\\xbfLQ\\xd2\\xf1, \\xce\\xf1\tH\\x0e\\xba<\\x94" } ], "repeated": 0, "id": 4680 }, { "timestamp": "2026-05-28 22:53:08,044", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4681 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "6948", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 200 OK\r\nContent-Length: 44045\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0xED7060958DCC33B9BB33125E0E56E9A6F930E6D7A79B41608B77AAAEBE0A9D40\"\r\nLast-Modified: Mon, 03 Mar 2025 22:20:35 GMT\r\nX-Ms-ApiVersion: Distribute 1.2\r\nX-Ms-Region: prod-neu-z1\r\nContent-Disposition: attachment; filename=products.cab; filename*=UTF-8''products.cab\r\nCache-Control: public, max-age=900\r\nExpires: Thu, 28 May 2026 16:08:12 GMT\r\nDate: Thu, 28 May 2026 15:53:12 GMT\r\nConnection: keep-alive\r\n\r\n" }, { "name": "SequenceNumber", "value": "1" }, { "name": "BufferSize", "value": "526" } ], "repeated": 0, "id": 4682 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4683 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpReceiveResponse", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x009e9be8" } ], "repeated": 1, "id": 4684 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4685 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4686 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00)6\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4687 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ")6\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4688 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 4689 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x009e9be8" } ], "repeated": 0, "id": 4690 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4691 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4692 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x986\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4693 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x986\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4694 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 4695 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06651000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4696 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4697 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4698 }, { "timestamp": "2026-05-28 22:53:08,059", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf76\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4699 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf76\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4700 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 4701 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpConnect", "status": true, "return": "0x009a2b58", "arguments": [ { "name": "SessionHandle", "value": "0x009d60a8" }, { "name": "ServerName", "value": "go.microsoft.com" }, { "name": "ServerPort", "value": "443" } ], "repeated": 0, "id": 4702 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpOpenRequest", "status": true, "return": "0x009e9ba8", "arguments": [ { "name": "InternetHandle", "value": "0x009a2b58" }, { "name": "Verb", "value": "GET" }, { "name": "ObjectName", "value": "/fwlink/?LinkId=841361" }, { "name": "Version", "value": "" }, { "name": "Referrer", "value": "" }, { "name": "Flags", "value": "0x00800000" } ], "repeated": 0, "id": 4703 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4704 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4705 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\7\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4706 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\7\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4707 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 4708 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpSetTimeouts", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x009e9ba8" }, { "name": "ResolveTimeout", "value": "120000" }, { "name": "ConnectTimeout", "value": "120000" }, { "name": "SendTimeout", "value": "120000" }, { "name": "ReceiveTimeout", "value": "120000" } ], "repeated": 0, "id": 4709 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x7798ac59", "parentcaller": "0x7279cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4710 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 4711 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006f8" } ], "repeated": 0, "id": 4712 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6948", "caller": "0x69bb46bc", "parentcaller": "0x69bb463b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4713 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6948", "caller": "0x6d196967", "parentcaller": "0x6d194f89", "category": "network", "api": "SslEncryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "GET /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com\r\n\r\n" }, { "name": "SequenceNumber", "value": "2" }, { "name": "BufferSize", "value": "142" } ], "repeated": 0, "id": 4714 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06661000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4715 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6948", "caller": "0x69bab419", "parentcaller": "0x69baae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1720" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x00\\xa6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02)\\x98T\\x0e\\xa3xSS\\xd3\\x06\\xea.\\xd6dQ\\xf3D\\xe5}?\\xbf\\x13$Ha\\xbe\\xc2\\xe1z\\x87-\\x11\n\\x95\\x90\\xa2@\\xed-^\\xb1\\x80\\xef\\xbf\\xdb\\xf7}'\\xea\\xae9Wzo\\x04\\x9b\\x9a\\xf0\\x1e\\xcb\\x02\\xae\\x01\\xa8\\xcd$\\\\xdc\\x87\\x10\\x0fE\\x1f\\xeb\\x95\\xe6\\xed\\xa1\\x91\\x88!\\xd8\\x88\\xbb\\x82\\x91\\xe6\\xa2$\\xd1\\x0fG$\\xd2\\xbeMM\\xdf\\xcc4p\\xbd@\\x11\\x9a\\xcd\\xd2w\\xfd\\xe3\\xd2^\\xde\\x9a?\\xa4\n\\xb8r\\xd1\\xc2kh}\\xa8mPmV\\x14\\x1b\\x97\\xd6\\x02hO\\xe0\\xa4zJ\\xd59\\xc0\\xeaI8\\xe5\\xa5\\xd8\\xa7C4:,P.Cq" } ], "repeated": 0, "id": 4716 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727e5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4717 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4718 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727e50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 4719 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4720 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4721 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4722 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4723 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4724 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4725 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06663000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4726 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06663000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4727 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4728 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00016000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4729 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06667000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4730 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06667000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4731 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00016000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4732 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4733 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4734 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4735 }, { "timestamp": "2026-05-28 22:53:08,075", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4736 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4737 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4738 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4739 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4740 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4741 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06665000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4742 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b046e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06665000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4743 }, { "timestamp": "2026-05-28 22:53:08,106", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b04218", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4744 }, { "timestamp": "2026-05-28 22:53:08,137", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4745 }, { "timestamp": "2026-05-28 22:53:08,137", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4746 }, { "timestamp": "2026-05-28 22:53:08,137", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4747 }, { "timestamp": "2026-05-28 22:53:08,137", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4748 }, { "timestamp": "2026-05-28 22:53:08,137", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4749 }, { "timestamp": "2026-05-28 22:53:08,137", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4750 }, { "timestamp": "2026-05-28 22:53:08,153", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4751 }, { "timestamp": "2026-05-28 22:53:08,153", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4752 }, { "timestamp": "2026-05-28 22:53:08,153", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4753 }, { "timestamp": "2026-05-28 22:53:08,153", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4754 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 302 Moved Temporarily\r\nContent-Length: 0\r\nServer: Kestrel\r\nLocation: https://download.microsoft.com/download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab\r\nRequest-Context: appId=cid-v1:d94c0f68-64bf-4036-8409-a0e761bb7ee1\r\nX-Response-Ca" }, { "name": "SequenceNumber", "value": "2" }, { "name": "BufferSize", "value": "506" } ], "repeated": 0, "id": 4755 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 4756 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpSendRequest", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x009e9ba8" }, { "name": "Headers", "value": "" }, { "name": "Optional", "value": "" } ], "repeated": 0, "id": 4757 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x7798ac59", "parentcaller": "0x7279cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4758 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 4759 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006a4" } ], "repeated": 0, "id": 4760 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727e5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 4761 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 4762 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727e50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4763 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 4764 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bb46bc", "parentcaller": "0x69bb463b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4765 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x6d196967", "parentcaller": "0x6d194f89", "category": "network", "api": "SslEncryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "GET /download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n" }, { "name": "SequenceNumber", "value": "2" }, { "name": "BufferSize", "value": "191" } ], "repeated": 0, "id": 4766 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bab419", "parentcaller": "0x69baae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1748" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x00\\xd7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x11\\x16\\x91\\xea\\xd1D\\xd1\\xb0y\\xd5\\x11=\\x102g_\\xf2\\xb1\\x98\\xfb\\xb5\\x97d\\x85R_\\xderJT\\xb3\"S\\xae\\x08\\xcd\\x9bP\\x085\\xafG\\xb7\\xea\\xd2,\\xc0\\xedY\\x84*\\xa0O\\xc9(YP'oq\\xec\\x99\nl\r\\xd0\\x03`\\xb5\\xa8n\\xd1\\x12~\\x07\\x99C\\x16{\\x93\\xe7\\xd6\\x99\\xb8L\\x1b\\xfc&y~\\xee\\xae6\\xc1\\xaa6\\xa00\\x9aT\\x07X\\xca\\xa0\\xba/\\x1c\\xa6\\x9e\\xa1\\x96\\x87\\x0e]\\xe1\\x8e\\xab\\x87 \\xeb\\xa1\\xe0\\x86c\\x02\\xbe9v\\xf1S\\xe2oT\\xc3\\x99\\xc5\\xcd\\xae\\x11\\x7f\\x9b.4\\xa6+\\x9a'WX\\xe4:\\x12\\x12l\\x0b\\xeb\\xd20\\x00!\\x8c\\xcb\\xe3\\xc1\\x10\\xac\\xaai\\xc7'\\xf0C\\xe5U\\xa0\\xb4\\x86\\x96\\xe0<\\xd7w=6\\x08\\xd9\\x16\\xd3\\xa0?\\xa5\\xbe4\\x93T\\xa1\\x10U\\x85q\\xa9]\\xad\\xdb\\xdc\\xe8\\x8a" } ], "repeated": 0, "id": 4767 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4768 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4769 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4770 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4771 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4772 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "6216", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 206 Partial Content\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0xED7060958DCC33B9BB33125E0E56E9A6F930E6D7A79B41608B77AAAEBE0A9D40\"\r\nLast-Modified: Mon, 03 Mar 2025 22:20:35 GMT\r\nX-Ms-ApiVersion: Distribu" }, { "name": "SequenceNumber", "value": "2" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 4773 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WinHttpReceiveResponse", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x009e9ba8" } ], "repeated": 1, "id": 4774 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4775 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4776 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc87\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4777 }, { "timestamp": "2026-05-28 22:53:08,450", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc87\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4778 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 4779 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4780 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4781 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4782 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4783 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4784 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000704" } ], "repeated": 1, "id": 4785 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4786 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "MSCF\\x00\\x00\\x00\\x00\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x01\\x00\\x00\\x00\\x08\\x84\\x00\\x00I\\x00\\x00\\x00V\\x00\\x03\\x15)\\xa5*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87W\\xf2\\xb0 \\x00products.xml\\x00\\xf9]\\x06\\xe2\\xee\\x05\\x00\\x80[\\x80\\x80\\x8d\\xaa\\x12\\x92R3\\x03F4U\\x00\\x00\\x00oP\\x98 i/\\x01\\xf1A\\x83o9\\xfe\\xfeQ\\xef\\x06V\\\\xe6\\xd9\\xb6v\\x99\\x9b\\xe1\"\\x99\\x06\\x18\\xef\\x1d\\xce9\\xc9\\\\xeevw\\xd3\\xddr\\xc0\\x93\\xc41\\x1b\\xc7\\x08jqC\\xb4!\\x98\\x00\\x10\\x88\\x89B\\xe4\\xc6FQl\\xd2\\x1c\\x05\\xe2\\x05x2\\xfc\\x08\\x04Bl\\xe3\\xbd\\x10\\x01\\xa1\\xa2\\x19\\xab\\xaa@<48\\x9bG\\xa4\\xae\\xdd\\xfb\\x97-2\\xe7{\\xd4\\xd1\\xb7\\x9e;\\xdd\\x89'z\\x8cu\\xba\\x03\\xa1\\x92\\xb6\\xdc\\xf3XJ\"c\\xf1f.\\xe3M\\x8au\\xdb\\xc8[\\xa5\\xbaun\\xcb\\x06Y\\xb6\\xe6\\xc9\\xdc\\xcc\\xfe\\xcd$\\x00n]s\\x81\\xd5\\x02\\xfb\\xd7d\\x02" }, { "name": "Length", "value": "2967" } ], "repeated": 0, "id": 4787 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4788 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4789 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000704" } ], "repeated": 1, "id": 4790 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4791 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "N%\\xd7\"\\x87/\\xa2\\x83\\x9f\\xbc\\x8f\\xbb\\x14\\xf7\\xfe\\xb3M~\\xe97j;H\\xbaB\\xa8\\x16\\xb0q\\xb5^\\xa8\\xd6\\x02\\x19\\xee\\xe0\\x0b&[\\xd0\\xdf\\x05\\xc0\\xad\\xb2\\x0c\\xe1\\xbd \\xadi\t\\xc5\\xde\\xa0\\x99\\xd0\\xe4\\x00&\\xdb\\xd0\\xd8\\x0b\\xb6\\xae\\xdc\\x02\\xb8\\xa5P\\x7f\\xc8+\\x00\\x16Z\\x84\\x9cb\\xe3\\xfb\\xc7\\x89J\\x13\\xba>A\\xef$\\xdd\\x03\\xfe\\xf8\\xde5\\xc3\\x1f\\xe2\\x91\\xe3]\\xeb[\\xfft\\x9f\\xeapR/-\\x0b\\xc1[\\xe0\\xd2&\\xc0\\xd0\\xb2\\x051\\xad \\x0c\\x97[\\xa8i\\x05bB\\xeb\\x90\\xd3\r\\x9c\t\\xed\\x0e\\xb0\\xb2UA\\xad\\x80\\x0b\\xca\\xbd`\\xec*%\\x87|\\x03\\xfc\\xd5\\x1aM\\xed\\xe6\t\\x90\\xbd\\x98\\x0e\\xda\t\\x81\\x13$>\\x03\\xff\\xa5\\xbfOmK\\xb5\\xe7ZK\\xbf/\\xc8\\xb9\\xf7n\\xf81q*xm,|a\\x95\\xb1\\x8cqkqJY\\xd79\\xb7\\xf0" }, { "name": "SequenceNumber", "value": "3" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 4794 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4795 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 4796 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4797 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xb6\\xc0\\xa6M\\x80\\xa1e\\x0brZ@\\x18.\\xb7\\xd0\\xd3\\x0b\\xc4\\xaf\\xb6\\x08j\\x06N\\x84\\xee\\x07\\xd8\\xdc*R\\xbb\\xe0B>;\\x00\\xb0[\\x11\\x9c\\x10\\xda\\x01\\x00\\x80\\xf92\\x8c]\\xa5\\x04\\x90O\\x80\\xffZc\\xaa\\xc5<\\xa1\\xda\\x1b\\xa0\\x13\\xfd\\xfc\\x9d\\xae\\x1b\\xf8\\xedrqZ\\xa6z\\x81\\xd3AWd\\x95\\x96\\x9bU8\\xc9\\xb3\\x9f\\xac\\xf9\\x0ejFM\\xbd\\xf0]!\\xa4b7g\\xd5\\xf6r\\xb6\\xf9\\x0c\\xe1\\xbe.\\x8eQ\\xf1\\xe4\\xac\\x96\\xca0\\xe5\\xe9\\xc6\\xc0\\xc2t\\xe7\\xae\\xfa\\xc6\\xf8G\\xa5\\x1d\\x94\\xf8\\x9a\\xff\\x90\\xb6\\xa1U\\x0e\\o[\\x0b\\xd5r\\xe0\\xc0\\xe40\\x14l\\x01V\\xab\\x08C\\xf2\\x19\\xc4\\xd0\\x9c\rB\\xe76p&\\xf49\\xc0\\xb7[\\xb8\\x10\\x9e\rcW)\\x01\\xe4S\\xe0?\\xd6\\x18\\xd5\\xa2\\x9e\\x90\\xcd\r\\xd0\t\\x9f|\\xdd\\xe5\\xb9\\x15\\xce\\xbd\\xcc\\xff|-\\xfb,\\x9f\\xfb\\xfd\\x13k\\x16\\xe9\\xbf\\x94\\x1dyZ\\xe6\\xcf'\\xfd\\xe5\\xe6\\x9b\\xf18\\xc3\n\\xa9\\xf8J1\\xd2)\\xc3,\\xf0\\x88\\xc7P\\xcd/\\xad\\xf0\\xaa\\xdfS" }, { "name": "Length", "value": "4650" } ], "repeated": 0, "id": 4798 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4799 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4800 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 1, "id": 4801 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4802 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "!s\\x0b\\x80\\xda`\\x18R\\x01I\\x9d\\x03k\\xae!h\\x1b4\\x13\\xda\\x1c U\\x9b\\xa4\\xb4\\x92-\\x07\\x02\\x95;\\x00\\xd7\\x14J\\x0f\\xb9\\x05\\xe0pm\\xca\\xb4\\x8d\\x13\\x1f\\x8b*\\xed\\xe8&\\x04M\\xc9\\xfcz\\xdb\\xf5ln\\xad\\x19\\xd2\\xc95{\\xf1\\x9fH\\xbf*5\t\\xde\\x91]a\\x1f\\xfb\\xfc\\x94I\\xb9\\x17\\xbc\\x9e\\x9d\\xdf\\x18/\\x8e*\\xdf\\xab\\xbdf\\x98(\\xe1\\xeb`\\xa9\\xe3\\xbdo\\xa4\\xba\\xf5\\xab\\xcdd\\x94J\\x92!E\\x99\\x0euq\\xccvm3\\xe4\\xcf\\xdc\\x937\\xedQ\\xdaN\\x99\\xb6\\xa4\n\\x83+~\\xfc\\x00\\x10\\xa1\\xb8\\x92\\x08\\xbe\\x01\\x00\\x80\\xbf>/-\\x0b\\xc1[\\xe0\\xd2&\\xc0\\xd0\\xb2\\x051\\xad \\x0c\\x97[\\xa8i\\x05bB\\xeb\\x90\\xd3\r\\x9c\t\\xed\\x0e\\xb0\\xb2UA\\xad\\x80\\x0b\\xca\\xbd`\\xec*%\\x87|\\x03\\xfc\\xd5\\x1aM\\xed\\xe6\t\\x90\\xbd\\x98\\x0e\\xda\t\\x81\\x13$>\\x03\\xff\\xa5\\xbfOmK\\xb5\\xe7ZK\\xbf/\\xc8\\xb9\\xf7n\\xf81q*xm,|a\\x95\\xb1\\x8cqkqJY\\xd79\\xb7\\xf0" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 4803 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "\\xd9\\x19\\xdd\\x04\\xb6V\\x9b\\x15\\x84\\xa1\\x13\\x94\\xbe\\x1e6\\xbbB{7\\xb8\\x87m\\xa8h%b\\xc7\\x04\\xae\\xafB\\x8bT\\xa1\\xba\\x1b\\xda\\xec\n)\\xf1\\xe0\\xa2\\xeb\\xe8\\xd1\\x06Y\\xb0\\xed\\x85-d\\x0b\\x98\\xa0\\xf5\\xf5i\\xd3+\\x94w\\x03\\xab]!O\\x1e`t=\\x8d\\xda@\\x0b\\xb5\\xdd}[\\xe1B&(\r?\\xdc\\xaa\\x1a\"AI\\xcf\\x89\n\\xa2\\xd7\\x80\\xd5b\\x01\\xdd\\xb1\\x9f\\xcf\\xde\\x9a\\xb6\\x16*\\xb7\\xc2-\\xa4\\x02\\x92v\\x06\\xed\\xb9\\x85`^\\x10\\x1d\\xb6!\\xb7\\x90p3\\x10\\xd7\\xb5\\x92\\xb5\\xc1\\x13\\{\\xb3\\xf6\\x88B\\xb57\\xb5\\xd7\\x14\\xa2z\\xc1\\x16\\xd8\\x85\\xac@R\\xce@b\\xd7\\xc8\\xd6\\x05Pt\\xed\\xddZ@\n\\xd7\\xde\\xd7bT\\x08\\xeb\\x05\\xb3U+\\xe4\\x02\\x12F\\x07l\\xd5\\x0c\\xe1\\x80ds\\xe3\\xde\\xf4[-z\\xb6>\\x03\\xe6s\\x8fB\\x86\\xab'\\x066\\xb5\\x85rl\\xc0\\xd5\\xda!\\x9d\\x1bH\\xff6\\xce\\xae@\\xfa\\x0b\\x88tP*\\x01\\x00\\x80\\xe8BK\\x05gSP\\x88\\xcd\\x06Y\\xad\\x14\\xea\\xb7\\x81lj" }, { "name": "SequenceNumber", "value": "4" }, { "name": "BufferSize", "value": "1684" } ], "repeated": 0, "id": 4804 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4805 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4806 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 1, "id": 4807 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4808 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "f\\xf3!N\\xbd:\\xc5\\xad|\\x9f\\x98GR7C\\xbe]O\"\\xfc\r\\xbd#\\x83\\xde\\xd3+\\xc1w,\\x02\\xfa]\\xf4\n<\\xee\\xf4v\\xab\\x152+\\xc4\\x9a\\x9a\\xd5w\\xdd\\xbco\\xabE\\xd2\\xb2\\x97\\x97,,\\x03j\\xe2}\\x9f\\xa40\\xc9p\\x9a\\x8fG\\xe5Q\\xb2\\x0f\\xa7=\\x08wm\\xc5P\\xbf\\xcc\\xc7\\x86`n<\\xf2)#\\xffCE\\xd7\\xd2\\xd1\\xbc\\xf7\\xdb\\x9a^\\xa5\\x856H\\xfa\\xd7O\\x8a\\x84\\xf8\\xbb\\xeaP\\xb5\\x1e\\x0f\\xf0A\\x7f\\xf7\\x18\\x85\\xa7\\x9d\\}\\xa5\\x152X\\xe835\\xf5\\xd6\r>\\x7f\\x1a\\xa8-\\x17)\\xac\\xa9\\x9f\\x97\\x9cE\\xda[lI\\x0c\\xbf\\x85\\xa3\\x9b0\\xb7\\xdc=c\\xb5\\xe3m)/|\\xdb\\xbd\\xca\\x90s\\x1b\\x9f\\x11\\x1e2Oh\\xf7\\xc3]\\x84\\x9b.\\xbe\\xaa\\xd7\\x11\\x7f\\xd7\">\\xe4\\xda\\xb7\\xf9ads_\\xfe\\xf3\\x9a\\xcb\\x17x\\xfdi>\\xc6`Y\\x19\\xfa\\\r\\xbe\\xf5TWK\\xd9\\xa5\\xd8\\xffqPJ\\xe868\\xc76\\xa7\\xfc`(c\\x10\\xbeU\\xbe8do\\xb4Ts\\xe6\\xcd" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 4809 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "\\x1elvM~\\xaf\\xd0\\x85\\xdb5R\\xbe\\xc1\\x17\\xb6\\xe4\\xfd\\x05\\x84!\\x13\\x94\\x1a\\x1a\\xdf\\xec\\x0b\\x81\\xf2\\x80\\xb7k\\xb4~\\x01/&\\xaf\\xc8\\xfe\\x07`\\xd5\\x92ioD\\x0c\\x98\\xa0\\xda\\xeb\\xe9\\xadf%\\x90\\xfe\\xc2\\xf2x\\xf3\\x16\\x01\\x00\\x80\\xad\\x00\\xea\\xdd?\\xdc\\xcfu~\\x7f\\xcf\\x80\\xd8 \\xb6\\xcfT\\x9da\\xfb\\xd2]\\x89\\x16\\x03\\x01\\xd7\\xd5\\xf3E\\xa0P\\xab\r\\xdda\\x16\\x02\\x01\\xc9\\xd5\\x03b\\xd7h\\xf4\\x06N\\xba\\xd6\\x1c/\\x00\\x85knw\\xb1)\\x94j\\x03\\x16\\xd8\\x85\\xd8@B\\xf5@\\xcfu\\xf4t\\x83']k:7\\x88B57r\\xcf)Tj\\x83l\\xd5\n\\xe1\\x80\\xa4\\xf8\\x81V-\\xd0\\xcaH\\xc47\\x0e\\x8d>\\xf6\\xcdY\\xd4@\\x97\\xcaf\\xa1k\\xab\\en!\\x9d\\x1b\\x88\\xa6\\xf6\\x90\\xd0\r\\xb0s\\xfb)m`\\x0c\\xb4\\xdf\\xa4\\xf6`\\x85\\xdaoZ\\x9b\\xc0B\\x9e\\x16\\x90\\xd8\r\\xb4d\\xfbR\\xdb\\x01\\x17j\\xbf\\xc9-\\xe0\n\\xb5\\xdfz\\x9b\\xc8B\\xa2\\x16\\x90\\xe0\r\\xb6e\\xfbR\\@\\x17\\xa9\\xb7Hr" }, { "name": "SequenceNumber", "value": "5" }, { "name": "BufferSize", "value": "10168" } ], "repeated": 0, "id": 4810 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4811 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4812 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 1, "id": 4813 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4814 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xd9\\x19\\xdd\\x04\\xb6V\\x9b\\x15\\x84\\xa1\\x13\\x94\\xbe\\x1e6\\xbbB{7\\xb8\\x87m\\xa8h%b\\xc7\\x04\\xae\\xafB\\x8bT\\xa1\\xba\\x1b\\xda\\xec\n)\\xf1\\xe0\\xa2\\xeb\\xe8\\xd1\\x06Y\\xb0\\xed\\x85-d\\x0b\\x98\\xa0\\xf5\\xf5i\\xd3+\\x94w\\x03\\xab]!O\\x1e`t=\\x8d\\xda@\\x0b\\xb5\\xdd}[\\xe1B&(\r?\\xdc\\xaa\\x1a\"AI\\xcf\\x89\n\\xa2\\xd7\\x80\\xd5b\\x01\\xdd\\xb1\\x9f\\xcf\\xde\\x9a\\xb6\\x16*\\xb7\\xc2-\\xa4\\x02\\x92v\\x06\\xed\\xb9\\x85`^\\x10\\x1d\\xb6!\\xb7\\x90p3\\x10\\xd7\\xb5\\x92\\xb5\\xc1\\x13\\{\\xb3\\xf6\\x88B\\xb57\\xb5\\xd7\\x14\\xa2z\\xc1\\x16\\xd8\\x85\\xac@R\\xce@b\\xd7\\xc8\\xd6\\x05Pt\\xed\\xddZ@\n\\xd7\\xde\\xd7bT\\x08\\xeb\\x05\\xb3U+\\xe4\\x02\\x12F\\x07l\\xd5\\x0c\\xe1\\x80ds\\xe3\\xde\\xf4[-z\\xb6>\\x03\\xe6s\\x8fB\\x86\\xab'\\x066\\xb5\\x85rl\\xc0\\xd5\\xda!\\x9d\\x1bH\\xff6\\xce\\xae@\\xfa\\x0b\\x88tP*\\x01\\x00\\x80\\xe8BK\\x05gSP\\x88\\xcd\\x06Y\\xad\\x14\\xea\\xb7\\x81lj" }, { "name": "Length", "value": "1684" } ], "repeated": 0, "id": 4815 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4816 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4817 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 1, "id": 4818 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4819 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x1elvM~\\xaf\\xd0\\x85\\xdb5R\\xbe\\xc1\\x17\\xb6\\xe4\\xfd\\x05\\x84!\\x13\\x94\\x1a\\x1a\\xdf\\xec\\x0b\\x81\\xf2\\x80\\xb7k\\xb4~\\x01/&\\xaf\\xc8\\xfe\\x07`\\xd5\\x92ioD\\x0c\\x98\\xa0\\xda\\xeb\\xe9\\xadf%\\x90\\xfe\\xc2\\xf2x\\xf3\\x16\\x01\\x00\\x80\\xad\\x00\\xea\\xdd?\\xdc\\xcfu~\\x7f\\xcf\\x80\\xd8 \\xb6\\xcfT\\x9da\\xfb\\xd2]\\x89\\x16\\x03\\x01\\xd7\\xd5\\xf3E\\xa0P\\xab\r\\xdda\\x16\\x02\\x01\\xc9\\xd5\\x03b\\xd7h\\xf4\\x06N\\xba\\xd6\\x1c/\\x00\\x85knw\\xb1)\\x94j\\x03\\x16\\xd8\\x85\\xd8@B\\xf5@\\xcfu\\xf4t\\x83']k:7\\x88B57r\\xcf)Tj\\x83l\\xd5\n\\xe1\\x80\\xa4\\xf8\\x81V-\\xd0\\xcaH\\xc47\\x0e\\x8d>\\xf6\\xcdY\\xd4@\\x97\\xcaf\\xa1k\\xab\\en!\\x9d\\x1b\\x88\\xa6\\xf6\\x90\\xd0\r\\xb0s\\xfb)m`\\x0c\\xb4\\xdf\\xa4\\xf6`\\x85\\xdaoZ\\x9b\\xc0B\\x9e\\x16\\x90\\xd8\r\\xb4d\\xfbR\\xdb\\x01\\x17j\\xbf\\xc9-\\xe0\n\\xb5\\xdfz\\x9b\\xc8B\\xa2\\x16\\x90\\xe0\r\\xb6e\\xfbR\\@\\x17\\xa9\\xb7Hr" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 4820 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 4821 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4822 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4823 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 1, "id": 4824 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b0" } ], "repeated": 0, "id": 4825 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xfe\\xf7`\\x12=\\xfa\\xc0|\\xc7w\\x1et_g~\\xec\\xf1zzr\t\\xf1\\xce~\t\\xf7\\x1d\\xfa\\xbd\\xce\\x1evp\\x9e\\xaf\\xeb\\xb7\\xf4q:\\xdf\\x02\\xf2\\x1d\\x9dyC~\\xaf\\x1bYR?\\xba\\xf8\\xdfV/\\xe2\\x9c{\\xe9\\xe7\\xaf\\xd7}\\x7f\\xe6\\xfc9\\xba\\x8f\\xaf\\xfc\\xfc\\\\xfb(Z<\\xe8\\xba\\x07\\x00\\xfc\\xdc\\x1a\\x15|\\x9e\\xfb\\x0f\\xef\\x85\\xff\\xe6\\xeb\\x9c\\xa5\\x9f\\xb5?\\xd7\\xbf\\x80>\\xe7>\\x07\\xf1\\xffO\\xcb\r<\\xc4s]\\xf3\\xe0\\xf2\\xee\\xe7\\xba\\x07\\xb0\\xc7\\xdd'V\\xd6\\x03\\xd7\\x82\\x00\\xad{\\x1f\\xd5\\xfclp\\xe9\\xe2\\x1er\\xd7\\xa2\\x01H\\xfe\\xd7\\xb7\\x17\\xaa\\x89\\x85\\xbd\\x7f\\xbc\\x01h\\xfe\\xd7\\xdb\\xdb\\xf8\\xdc\\x00\\xe0\\xf9\\x7f\\xdd\\xe3\\x17\\x89O\\xfc\\xae\\x1f\\x94{\\xd6~\\\\xf7\\x00\\xf8\\xd7\\xfey\\xd1\\x00 \\xc3\\x7f9\\xd28\\xc7\\xf2\\xae\\x10\\xbe\\xf5\\xd8\\xa2\\xcf\\xb3\\x8f\\xd7\\xc1\\x00?\\xe7>\\\\xff\\x0e\\xbcO\\x7fO\\xe3\\x9d\\xf8\\xf8s\\xfb\\xb7]\\\\x00t\\xee\\x03\\xd7\\xf8B_\\xf7/\\xec\\x9f\\x18\\xfb\\x8f7\\x7f\\xcd\\x14\\xe4\\x87W\\xf4\\xe1" }, { "name": "Length", "value": "1976" } ], "repeated": 0, "id": 4826 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" } ], "repeated": 0, "id": 4827 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4828 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4829 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06671000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4830 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x0078\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4831 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "78\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4832 }, { "timestamp": "2026-05-28 22:53:08,465", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 4833 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76629000" }, { "name": "ModuleName", "value": "SETUPAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4834 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76629000" }, { "name": "ModuleName", "value": "SETUPAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4835 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 4836 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" } ], "repeated": 0, "id": 4837 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 1, "id": 4838 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\" } ], "repeated": 0, "id": 4839 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 4840 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4841 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4842 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "MSCF\\x00\\x00\\x00\\x00\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x01\\x00\\x00\\x00\\x08\\x84\\x00\\x00" }, { "name": "Length", "value": "36" } ], "repeated": 0, "id": 4843 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4844 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ",\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4845 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "DEVRTL.dll" } ], "repeated": 0, "id": 4846 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\devrtl.dll" } ], "repeated": 0, "id": 4847 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006e8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\devrtl.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4848 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000708" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000006e8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\devrtl.dll" } ], "repeated": 0, "id": 4849 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000708" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69990000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4850 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6999e000" }, { "name": "ModuleName", "value": "DEVRTL.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4851 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6999e000" }, { "name": "ModuleName", "value": "DEVRTL.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4852 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4853 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4854 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6999e000" }, { "name": "ModuleName", "value": "DEVRTL.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4855 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000708" } ], "repeated": 0, "id": 4856 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06669000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4857 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06646000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4858 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0665e000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4859 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06652000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4860 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0096b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4861 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4862 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6999e000" }, { "name": "ModuleName", "value": "DEVRTL.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4863 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\DEVRTL.dll" } ], "repeated": 0, "id": 4864 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4865 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006e8" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\devrtl.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4866 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 4867 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DEVRTL" }, { "name": "DllBase", "value": "0x69990000" } ], "repeated": 0, "id": 4868 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x7797498d", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4869 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4870 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4871 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4872 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000708" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 4873 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\devrtl" }, { "name": "BaseAddress", "value": "0x69990000" }, { "name": "InitRoutine", "value": "0x69995950" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 4874 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76629000" }, { "name": "ModuleName", "value": "SETUPAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4875 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76629000" }, { "name": "ModuleName", "value": "SETUPAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4876 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000708" } ], "repeated": 0, "id": 4877 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 4878 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000070c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Setup" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup" } ], "repeated": 0, "id": 4879 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 4880 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "ValueName", "value": "SetupOverride" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride" } ], "repeated": 0, "id": 4881 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "ValueName", "value": "LogPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath" } ], "repeated": 0, "id": 4882 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 4883 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\INF\\" } ], "repeated": 0, "id": 4884 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 4885 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000710" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Setup" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup" } ], "repeated": 0, "id": 4886 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 4887 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "SetupOverride" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride" } ], "repeated": 0, "id": 4888 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "LogLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "536887297" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel" } ], "repeated": 0, "id": 4889 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "LogMask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask" } ], "repeated": 0, "id": 4890 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "LogMaxFileSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize" } ], "repeated": 0, "id": 4891 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 4892 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ",\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4893 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": ")\\xa5*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87W\\xf2\\xb0 \\x00" }, { "name": "Length", "value": "16" } ], "repeated": 0, "id": 4894 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "<\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4895 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "products.xml\\x00\\xf9]\\x06\\xe2\\xee\\x05\\x00\\x80[\\x80\\x80\\x8d\\xaa\\x12\\x92R3\\x03F4U\\x00\\x00\\x00oP\\x98 i/\\x01\\xf1A\\x83o9\\xfe\\xfeQ\\xef\\x06V\\\\xe6\\xd9\\xb6v\\x99\\x9b\\xe1\"\\x99\\x06\\x18\\xef\\x1d\\xce9\\xc9\\\\xeevw\\xd3\\xddr\\xc0\\x93\\xc41\\x1b\\xc7\\x08jqC\\xb4!\\x98\\x00\\x10\\x88\\x89B\\xe4\\xc6FQl\\xd2\\x1c\\x05\\xe2\\x05x2\\xfc\\x08\\x04Bl\\xe3\\xbd\\x10\\x01\\xa1\\xa2\\x19\\xab\\xaa@<48\\x9bG\\xa4\\xae\\xdd\\xfb\\x97-2\\xe7{\\xd4\\xd1\\xb7\\x9e;\\xdd\\x89'z\\x8cu\\xba\\x03\\xa1\\x92\\xb6\\xdc\\xf3XJ\"c\\xf1f.\\xe3M\\x8au\\xdb\\xc8[\\xa5\\xbaun\\xcb\\x06Y\\xb6\\xe6\\xc9\\xdc\\xcc\\xfe\\xcd$\\x00n]s\\x81\\xd5\\x02\\xfb\\xd7d\\x02=\t\\x1f\\x1d 2\\x10jpT\\x07vLr\\xdb\\xc0\\xcf\\x07\\xcaU\\x07\\x81'\\x9bh\\xf2.\\xe0\\xc9=\\xaaA\t\n\\xf0\\x07\\x07\\x1e-\\x10\\x01\\xcc\\xe0\\xd0\\x81\\xce\"\\x82\t\\x04l\\x00N\\xc0\\x89\\x1b\\x18\\x03\\x01\\xa0" }, { "name": "Length", "value": "256" } ], "repeated": 0, "id": 4896 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "I\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4897 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4898 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4899 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "I\\x00\\x00\\x00V\\x00\\x03\\x15" }, { "name": "Length", "value": "8" } ], "repeated": 0, "id": 4900 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "I\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4901 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06669000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4902 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06646000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4903 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0663c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4904 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06810000" }, { "name": "RegionSize", "value": "0x00211000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4905 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06810000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4906 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06a20000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4907 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xf9]\\x06\\xe2\\xee\\x05\\x00\\x80" }, { "name": "Length", "value": "1526" } ], "repeated": 0, "id": 4908 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "\r\n \r\n \r\n \r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd\r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4909 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x9d\\xb4\\x1b\\x8a\\x1e\\x02\\x00\\x80" }, { "name": "Length", "value": "550" } ], "repeated": 0, "id": 4910 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "\r\n ar-sa\r\n Arabic (Saudi Arabia)\r\n EducationN\r\n x64\r\n 3978057283\r\n 2119ef" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4911 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "Y\\xeb\\x01\\xc8\\x06\\x02\\x00\\x80" }, { "name": "Length", "value": "526" } ], "repeated": 0, "id": 4912 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4913 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": " ARM64\r\n 3557644558\r\n 7b87e44d4e11e5891feeaf350ed94eab9fcb78e7\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/661a66b4-966c-46f3-b1e7-" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4914 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "4048" } ], "repeated": 0, "id": 4915 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "resh_CLIENTCONSUMER_RET_x86FRE_et-ee.esd\r\n \r\n %ARCH_32%\r\n %CLIENT%\r\n False\r\n \r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4916 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x1e\\xb03\\xae\"\\x02\\x00\\x80" }, { "name": "Length", "value": "554" } ], "repeated": 0, "id": 4917 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "64%\r\n %CLIENT%\r\n True\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64F" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4918 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "4\\xa4\\xafc\\x02\\x02\\x00\\x80" }, { "name": "Length", "value": "522" } ], "repeated": 0, "id": 4919 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "64%\r\n %CLIENT%\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4920 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x95\\xd9a\\xbf\\xfa\\x01\\x00\\x80" }, { "name": "Length", "value": "514" } ], "repeated": 0, "id": 4921 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "\r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_fr-ca.esd\r\n fr-ca\r\n French (Canada)\r\n Core\r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4922 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "-\\xfe\\x07\\x04\\xf8\\x01\\x00\\x80" }, { "name": "Length", "value": "512" } ], "repeated": 0, "id": 4923 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": " d035018417af686fc854850966e22cc89b4f1336\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ba9f4677-1dff-4286-bf73-8b03476cf5d8/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64F" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4924 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xd9\\x84\\xcc\\xec\\x02\\x02\\x00\\x80" }, { "name": "Length", "value": "522" } ], "repeated": 0, "id": 4925 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "rchitecture_Loc>\r\n %CLIENT%\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_nb" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4926 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xff\\xe5\\xf4\\xdc\\xda\\x01\\x00\\x80" }, { "name": "Length", "value": "482" } ], "repeated": 0, "id": 4927 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "ame>\r\n ro-ro\r\n Romanian (Romania)\r\n ProfessionalWorkstation\r\n x86\r\n 2825172084\r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4928 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xb9\\xd1\\x9a\\x88\\x1e\\x02\\x00\\x80" }, { "name": "Length", "value": "550" } ], "repeated": 0, "id": 4929 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "ion>ProfessionalEducationN\r\n x86\r\n 2866872688\r\n 0c100bff127c72c09e4943e42babb7aea6f0b1b5\r\n http://dl.delivery.mp.microsoft.com/filestream" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4930 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\"g\\xcey\\xe4\\x01\\x00\\x80" }, { "name": "Length", "value": "492" } ], "repeated": 0, "id": 4931 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_zh-tw.esd\r\n \r\n %ARCH_64%\r\n %CLIENT%\r\n False\r" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4932 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\t\\xe2\\xbb\\x9f\\xda\\x01\\x00\\x80" }, { "name": "Length", "value": "482" } ], "repeated": 0, "id": 4933 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "31204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_nb-no.esd\r\n \r\n %ARCH_64%\r\n %CLIENT%\r\n True\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_pt-pt.esd\r\n pt-pt\r\n x86\r\n 2828812256\r\n 170c123ceb0f4d240dd644a9c6d3bd4aa428689a\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/16cf0" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4938 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xb7\\xb7\\xd4\\xca\\xca\\x01\\x00\\x80" }, { "name": "Length", "value": "466" } ], "repeated": 0, "id": 4939 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "ONSUMER_RET_x86FRE_sr-latn-rs.esd\r\n sr-latn-rs\r\n Serbian (Latin, Serbia)\r\n CloudN\r\n x86\r\n f0a6fdbd471f13b009aa03d4e2d95da8d25d6a8a\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9c1da917-dc7f-47a8-81fe-97344d254de8/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_fi-fi.esd" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4942 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xa3ffJ\n\\x02\\x00\\x80" }, { "name": "Length", "value": "530" } ], "repeated": 0, "id": 4943 }, { "timestamp": "2026-05-28 22:53:08,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "n_Loc>\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_cs-cz.esd\r\n cs-czx86\r\n 2956184919\r\n e1566a1cbe23de0f133f9920fa29b7ff74dfc38e\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/6657c195-f60e-41dc-a25e-f205d78de" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4946 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "1wk\\xd7\\xce\\x01\\x00\\x80" }, { "name": "Length", "value": "470" } ], "repeated": 0, "id": 4947 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "ilePath>\r\n \r\n %ARCH_32%\r\n %CLIENT%\r\n False\r\n \r\n \r\n 190" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4948 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "[\\x11\\x9c\\x10\\xda\\x01\\x00\\x80" }, { "name": "Length", "value": "482" } ], "repeated": 0, "id": 4949 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "es-mx\r\n Spanish (Mexico)\r\n Education\r\n ARM64\r\n 3615174250\r\n fdce6cee7f656c96b61966a3505bda7e45ea62" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4950 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xc9Q\\xae\\x8e\\xe4\\x01\\x00\\x80" }, { "name": "Length", "value": "492" } ], "repeated": 0, "id": 4951 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "\r\n 3669966055\r\n d56d895f1cd6cfc2f78cf8b2df85a405db160d7e\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/a0f9a4c1-f2b4-4f9d-8598-ca0afeb81ebd/19045.3803.23" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4952 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xe3\\x1a!\\xa2\\xda\\x01\\x00\\x80" }, { "name": "Length", "value": "482" } ], "repeated": 0, "id": 4953 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "04.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_hu-hu.esd\r\n \r\n %ARCH_64%\r\n %CLIENT%\r\n False\r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4954 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xd9\\x9d\\xdd\\xd3\\xd6\\x01\\x00\\x80" }, { "name": "Length", "value": "478" } ], "repeated": 0, "id": 4955 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "e id=\"\">\r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_zh-cn.esd\r\n zh-cn\r\n Chinese (Simplified, China)\r\n \r\n Core\r\n x64\r\n 4016207526\r\n daaf51acc44e13894e91c7914564c092bc379ef7\r\n http://dl.delivery.mp.m" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4958 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xc7h9U\\xc4\\x01\\x00\\x80" }, { "name": "Length", "value": "460" } ], "repeated": 0, "id": 4959 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_th-th.esd\r\n \r\n %ARCH_64%\r\n %CLIENT%\r\n False\r" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4960 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x97#\\x83U\\xd0\\x01\\x00\\x80" }, { "name": "Length", "value": "472" } ], "repeated": 0, "id": 4961 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "_refresh_CLIENTCONSUMER_RET_A64FRE_da-dk.esd\r\n da-dk\r\n Danish (Denmark)\r\n ProfessionalWorkstationN\r\n ARM64\r\n b271403ab23826708f626f671b2115e6f96c166d\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/91c7756c-5b20-4342-8651-e5186d978951/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSU" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4964 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xe7\\x96\\xa3D\\xde\\x01\\x00\\x80" }, { "name": "Length", "value": "486" } ], "repeated": 0, "id": 4965 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "Path>\r\n \r\n %ARCH_64%\r\n %CLIENT%\r\n True\r\n \r\n \r\n 19045.3" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4966 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x96\\xb9HC\\xc8\\x01\\x00\\x80" }, { "name": "Length", "value": "464" } ], "repeated": 0, "id": 4967 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": ">\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_zh-cn.esd\r\n zh-cn\r\n ProfessionalEducation\r\n x64\r\n 4029185753\r\n 58b5d832727db7225f9998835f2316ecee5ce0bc\r\n h" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4971 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xbe\\xee\\xfb\\x98\\xe8\\x01\\x00\\x80" }, { "name": "Length", "value": "496" } ], "repeated": 0, "id": 4972 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "5970\r\n e1c14e3e70fc8d14f683245ed9a33aec51dcb77b\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/1ccdf6b6-f9d9-4a6f-b0bd-0baffc051025/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENT" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4973 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "/,\\x1f\\xa0~\\x01\\x00\\x80" }, { "name": "Length", "value": "390" } ], "repeated": 0, "id": 4974 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": " %ARCH_32%\r\n %CLIENT%\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4975 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "e+6\"\\xe2\\x01\\x00\\x80" }, { "name": "Length", "value": "490" } ], "repeated": 0, "id": 4976 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": " Chinese (Traditional, Taiwan)\r\n Professional\r\n x86\r\n 2983288179\r\n c5a58604b5912d13e9cfaf7e3380ea324aa9b6d8\r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4977 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "/i\\xc3f\\xcc\\x01\\x00\\x80" }, { "name": "Length", "value": "468" } ], "repeated": 0, "id": 4978 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": ">bfc2015c5b40b52fffe8d117223e2f6a146cc64e\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/26a80973-49ac-4fde-9f86-fbb072abfb84/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_uk-ua.esd<" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4979 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xba\\xb3q\\x8d\\xd8\\x01\\x00\\x80" }, { "name": "Length", "value": "480" } ], "repeated": 0, "id": 4980 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": ">%ARCH_64%\r\n %CLIENT%\r\n True\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_R" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4981 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xdb\\xed<6\\xd6\\x01\\x00\\x80" }, { "name": "Length", "value": "478" } ], "repeated": 0, "id": 4982 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": " fr-fr\r\n French (France)\r\n Cloud\r\n ARM64\r\n 3668803448\r\n 4702f40db9c76cb5a25241ca4fa" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4983 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\yi%\\xd2\\x01\\x00\\x80" }, { "name": "Length", "value": "474" } ], "repeated": 0, "id": 4984 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "/Sha1>\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/a122c262-ba72-4db6-8112-efe1000ae31f/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_uk-ua.esd\r\n \r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4985 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xd6\\xdf\\xe79(\\x03\\x00\\x80" }, { "name": "Length", "value": "816" } ], "repeated": 0, "id": 4986 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "sRetailOnly>False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_et-ee.esd\r\n et-ee\r\n <" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4987 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x99\\xfb|\\xb9\\x98\\x06\\x00\\x80" }, { "name": "Length", "value": "8" } ], "repeated": 0, "id": 4988 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06652000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4989 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b046e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06652000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4990 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06617000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4991 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06673000" }, { "name": "RegionSize", "value": "0x0001d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4992 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "{0,\\x12]\\x88s5\\xdb\\xd6\\xff\\xa3?)cQ)\\xb3>\\x14\\x83K\\xc9\\xa0\\x8a@k\\xb1\\xa40\\x0eaL\\x1a\\xf5V\\xae\\xec0\\xfefS\\xc6\\xb9p\\x99`\\xf9\\xfa\\xe7\\xcd|k$k\\xf0\\xe8^\\xeb:\\xaa\\xd8P\\xf9\\x1a\\x9f\\x17\\xceG\\xdd\\x8fSy\\x93z\\xc0\\\\x98\\xbe\\x18\\xf0\\xb5\\xdd\\x0e\\xf9\\x0fx\\xda\\x89\\x16W\\xdc\\xb0\\xb4\\x85\\x80W\\x83eM\\xab\\x7f\\xd3\\xd6r\\xac\\x82\\xd9\\xf21'\\xe7>K9\\x06{jm\\xaf\\x9e\\xea\\xc5\nk\\x93\\x95i\\xc2#\\xf0I\\x16\\xa7/\\xbe\\xee\\x9d]\\x86\\xc9\\xfc\\xfc\\xd8|\\xa1\\xa5\\xf0w\\x1dG\\xbdPr\\xa5^\\x84?\\xb0\\xe0\\x99s1\\'w\\x05\\x1e\\xfb\\xee#G<\\xfd\\xe4\n\\xab\\xee\\xe4r\\x14A\\x9a+\\xeb\\x99{w9=\\xc5\\xbey\\xa5|\\xd3\\xf4\\x1b\\xe7\\xf6\\x98\\x12\\xaa\\xc5\\xcb.\\xe2\\x17\\xa2\\xac7\\xa7B*\\xdf7\\xff\n\\xab}-'c\\xd8\\xbf\\x07\\xcc\\xd5\\xa8\\xec\\x15\\xe3\\xf5\\xaa7J,*S\\xc3\\x9a>\\xb9\\xb8E\\;\\xf8M%\\xdf\\xd4\\xfa\\xf3:\\x04" }, { "name": "Length", "value": "1688" } ], "repeated": 0, "id": 4993 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "ithuania)\r\n EnterpriseN\r\n x86\r\n 2771838649\r\n 86d8510e84a79f5041cb0d5509b8d204f66c5b47\r\n http://dl.delivery" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4994 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "_a\\xb8\\xd0|\\x06\\x00\\x80" }, { "name": "Length", "value": "1668" } ], "repeated": 0, "id": 4995 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "Path>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/b081c583-39e7-455e-9097-a360a30a145d/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTBUSINESS_VOL_x64FRE_ro-ro.esd\r\n \r\n %ARC" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 4996 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "g\\xf2\\xbfuj\\x06\\x00\\x80" }, { "name": "Length", "value": "1650" } ], "repeated": 0, "id": 4997 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "_VOL_x64FRE_nl-nl.esd\r\n \r\n %ARCH_64%\r\n %ENTERPRISE_N%\r\n True\r\n \r\n \r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTBUSINESS_VOL_x86FRE_es-mx.esd\r\n es-mx\r\n Spanish (Mexi" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 5000 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "'I0G\\x84\\x06\\x00\\x80" }, { "name": "Length", "value": "1676" } ], "repeated": 0, "id": 5001 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "-jp.esd\r\n ja-jp\r\n Japanese (Japan)\r\n Enterprise\r\n ARM64\r\n 3713870165\r\n " }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 5002 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5003 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xb2I>\\x9cJ\\x05\\x00\\x80" }, { "name": "Length", "value": "1362" } ], "repeated": 0, "id": 5004 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "ze>4029086170\r\n caa24a06d73531b5b588ed717a185a72d57f128b\r\n http://dl.delivery.mp.microsoft.com/filestreamingservice/files/b4fe2c14-0069-421d-a78d-64f75c2828f0/19045.3803.231204-0204.22h2_release_svc_refre" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 5005 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\x88v\\xb8\\xbc:\\x01\\x00\\x80" }, { "name": "Length", "value": "322" } ], "repeated": 0, "id": 5006 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd\r\n \r\n %ARCH_64%\r\n %CLIENT%\r\n %CLIENT%\r\n False\r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_nb-no.esd\r" }, { "name": "Length", "value": "32768" } ], "repeated": 0, "id": 5010 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xf5P\\xd7\\x036\\x01\\x00\\x80" }, { "name": "Length", "value": "318" } ], "repeated": 0, "id": 5011 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "R\\xc9\\x91P&\\x01\\x00\\x80" }, { "name": "Length", "value": "302" } ], "repeated": 0, "id": 5012 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xc0C\\xc4a.\\x01\\x00\\x80" }, { "name": "Length", "value": "310" } ], "repeated": 0, "id": 5013 }, { "timestamp": "2026-05-28 22:53:08,497", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5014 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000704" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "Buffer", "value": "\\xfeJi\\xaa\\x08\\x01\\x00\\x80" }, { "name": "Length", "value": "8908" } ], "repeated": 0, "id": 5015 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000070c" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdcAu\\x94)\\xda\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5016 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 5017 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.cab" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "I\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 5018 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" } ], "repeated": 0, "id": 5019 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000704" } ], "repeated": 0, "id": 5020 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" } ], "repeated": 0, "id": 5021 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5022 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5023 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc78\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5024 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc78\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5025 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5026 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5027 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5028 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00;9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5029 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ";9\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5030 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5031 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources" } ], "repeated": 1, "id": 5032 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000071c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x699e7340" }, { "name": "Parameter", "value": "0x00964280" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6972" }, { "name": "ProcessId", "value": "2088" }, { "name": "Module", "value": "WINDLP.DLL" } ], "repeated": 0, "id": 5033 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "threading", "api": "CreateThread", "status": true, "return": "0x0000071c", "arguments": [ { "name": "StartRoutine", "value": "0x699e7340" }, { "name": "ModuleName", "value": "WINDLP.DLL" }, { "name": "Parameter", "value": "0x00964280" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6972" } ], "repeated": 0, "id": 5034 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000724" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x699e7340" }, { "name": "Parameter", "value": "0x00964294" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6976" }, { "name": "ProcessId", "value": "2088" }, { "name": "Module", "value": "WINDLP.DLL" } ], "repeated": 0, "id": 5035 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000724", "arguments": [ { "name": "StartRoutine", "value": "0x699e7340" }, { "name": "ModuleName", "value": "WINDLP.DLL" }, { "name": "Parameter", "value": "0x00964294" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6976" } ], "repeated": 0, "id": 5036 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06673000" }, { "name": "RegionSize", "value": "0x0001d000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5037 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0665e000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5038 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5039 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06617000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5040 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06617000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5041 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06673000" }, { "name": "RegionSize", "value": "0x0001d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5042 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5043 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5044 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xfd9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5045 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfd9\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5046 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5047 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5048 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5049 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00N:\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5050 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5051 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N:\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5052 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5053 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5054 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5055 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e:\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5056 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0665e000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5057 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e:\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5058 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5059 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5060 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5061 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xff:\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5062 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xff:\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5063 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5064 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5065 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5066 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00_;\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5067 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "_;\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5068 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5069 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5070 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5071 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb3;\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5072 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb3;\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5073 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5074 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5075 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5076 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1b<\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5077 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1b<\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5078 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5079 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5080 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000072c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x699e6f90" }, { "name": "Parameter", "value": "0x00963f60" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6980" }, { "name": "ProcessId", "value": "2088" }, { "name": "Module", "value": "WINDLP.DLL" } ], "repeated": 0, "id": 5081 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "threading", "api": "CreateThread", "status": true, "return": "0x0000072c", "arguments": [ { "name": "StartRoutine", "value": "0x699e6f90" }, { "name": "ModuleName", "value": "WINDLP.DLL" }, { "name": "Parameter", "value": "0x00963f60" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6980" } ], "repeated": 0, "id": 5082 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5083 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5084 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00l<\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5085 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "l<\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5086 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5087 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6972", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5088 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6972", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5089 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6976", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5090 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6976", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5091 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x77b265e6", "parentcaller": "0x77b264f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5092 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5093 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5094 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5095 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd1<\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5096 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd1<\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5097 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5098 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5099 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5100 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x001=\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5101 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "1=\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5102 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5103 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5104 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5105 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x96=\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5106 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x96=\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5107 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5108 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5109 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000704" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5110 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x699e7163", "parentcaller": "0x75d4fcc9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 5111 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5112 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5113 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf8\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5114 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5116 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x11>\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5117 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5118 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5119 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5120 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8d>\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5121 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8d>\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5122 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5123 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00b6d5ae", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5124 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x69ebb4b3", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "MediaSetupUIMgr.dll" }, { "name": "ModuleHandle", "value": "0x69e80000" } ], "repeated": 0, "id": 5125 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5126 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4ced62", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c33e0" } ], "repeated": 0, "id": 5127 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b594000" }, { "name": "ModuleName", "value": "MFC42u.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5128 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b594000" }, { "name": "ModuleName", "value": "MFC42u.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5129 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5130 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4ced62", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c33e0" } ], "repeated": 0, "id": 5131 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5132 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4ced62", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c33e0" } ], "repeated": 0, "id": 5133 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5134 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4ced62", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c33e0" } ], "repeated": 0, "id": 5135 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798e5e6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "COMCTL32.DLL" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5136 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4ced62", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "InitCommonControlsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c33e0" } ], "repeated": 0, "id": 5137 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00b6d5ae", "parentcaller": "0x00000000", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 5138 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5139 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5140 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdc>\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5141 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdc>\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5142 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x777e2ee4", "parentcaller": "0x777dbe71", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 5143 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06691000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5144 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066d1000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5145 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x747e43c2", "parentcaller": "0x747e45a1", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\ThemeSection" } ], "repeated": 0, "id": 5146 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x747e4413", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000073c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06bb0000" }, { "name": "SectionOffset", "value": "0x0606e22c" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5147 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x747e43c2", "parentcaller": "0x747e4668", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000740" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Windows\\Theme4085422095" } ], "repeated": 0, "id": 5148 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x747e43c2", "parentcaller": "0x747e467a", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000744" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\Theme149276106" } ], "repeated": 0, "id": 5149 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77999145", "parentcaller": "0x747e4721", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06bb0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 5150 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x747e472a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 5151 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x747e49c2", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000740" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06bb0000" }, { "name": "SectionOffset", "value": "0x0606e8b8" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5152 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x747e49db", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000744" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ca0000" }, { "name": "SectionOffset", "value": "0x0606e8b8" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5153 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x747e51bf", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 5154 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747e51d0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af2470" } ], "repeated": 0, "id": 5155 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747e569c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 5156 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747e561b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af0700" } ], "repeated": 0, "id": 5157 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747e631e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b2c3b0" } ], "repeated": 0, "id": 5158 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747e575b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 5159 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747e526e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 5160 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77989b67", "parentcaller": "0x747e584c", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "MutexName", "value": "Local\\SM0:2088:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5161 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x747e592b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5162 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5163 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5164 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x747e5a20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" } ], "repeated": 0, "id": 5165 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798dd70", "parentcaller": "0x747e590a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 1, "id": 5166 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b11f80", "parentcaller": "0x77af8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 5167 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006b0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\USER32.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 5168 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af97cc", "parentcaller": "0x77af92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006bc" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000006b0" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\en-US\\user32.dll.mui" } ], "repeated": 0, "id": 5169 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af97f4", "parentcaller": "0x77af92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06cb0000" }, { "name": "SectionOffset", "value": "0x0606e458" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5170 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af9804", "parentcaller": "0x77af92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 5171 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x775fe27c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5172 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x775fe294", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "RegisterClassNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c3530" } ], "repeated": 0, "id": 5173 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x7798ad32", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x775d0000" } ], "repeated": 0, "id": 5174 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066d4000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5175 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5176 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5177 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5178 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72b20000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5179 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72b20000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5180 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747dca5a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 5181 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00Q?\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5182 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\USER32.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 5183 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x775fe27c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x72970000" } ], "repeated": 0, "id": 5184 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x775fe294", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "RegisterClassNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729c3530" } ], "repeated": 0, "id": 5185 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "Q?\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5186 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5187 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5188 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5189 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747dc9dd", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 5190 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06021000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5191 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06022000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5192 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06024000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5193 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af130f", "parentcaller": "0x77af108a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006bc" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 5194 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af132c", "parentcaller": "0x77af108a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006bc" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 5195 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af1342", "parentcaller": "0x77af108a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 5196 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77aef00b", "parentcaller": "0x77aeef00", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06cc0000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5197 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77aef052", "parentcaller": "0x77aeef00", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06cc0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5198 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa2?\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5199 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747dc9dd", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 14, "id": 5200 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\SystemResources\\MediaSetupUIMgr.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 5201 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af931b", "parentcaller": "0x77af9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\MFC42u.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 5202 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5203 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5204 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x77634af7", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 5205 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x77634b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 5206 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x77634a46", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 5207 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5208 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5209 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x777e2552", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 5210 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77989b67", "parentcaller": "0x778168a7", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" }, { "name": "MutexName", "value": "Local\\SM0:2088:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5211 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x77819d24", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 5212 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5213 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 5214 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x778169fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 5215 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x7798dd70", "parentcaller": "0x778189b9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 1, "id": 5216 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5217 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5218 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "TextShaping.dll" } ], "repeated": 0, "id": 5219 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" } ], "repeated": 0, "id": 5220 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1e65c", "parentcaller": "0x77b1e3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 5221 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1e699", "parentcaller": "0x77b1e3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000006fc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\TextShaping.dll" } ], "repeated": 0, "id": 5222 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1122c", "parentcaller": "0x77b11397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000700" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b250000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00095000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5223 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b100b7", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5224 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b100e5", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5225 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5226 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5227 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77af9d5b", "parentcaller": "0x77b0b4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5228 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1e6ed", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 5229 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b1e6f5", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 5230 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x77b10d10", "parentcaller": "0x77afe4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b2e2000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5231 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x74d198b1", "parentcaller": "0x74d18c82", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\TextShaping.dll" } ], "repeated": 0, "id": 5232 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x74d198f0", "parentcaller": "0x74d18c82", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 5233 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 5234 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\TextShaping" }, { "name": "DllBase", "value": "0x6b250000" } ], "repeated": 0, "id": 5235 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2?\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5236 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 5237 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x7798917f", "parentcaller": "0x69cec56b", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75d30000" } ], "repeated": 0, "id": 5238 }, { "timestamp": "2026-05-28 22:53:08,512", "thread_id": "6980", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "GetUILanguageInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d639e0" } ], "repeated": 0, "id": 5239 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75d30000" }, { "name": "FunctionName", "value": "GetUserPreferredUILanguages" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d493e0" } ], "repeated": 0, "id": 5240 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x7798c899", "parentcaller": "0x69cec168", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" } ], "repeated": 0, "id": 5241 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x69d48bda", "parentcaller": "0x69d4afa1", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006bc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 5242 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x69d48bf4", "parentcaller": "0x69d4afa1", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006bc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xb0*\\x00\\x00\\x00\\x00\\x00)\\xa5*\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5243 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x002b3000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5244 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5245 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06f92000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5246 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x69d48cd4", "parentcaller": "0x69d5326f", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006bc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "Buffer", "value": "\r\n \r\n \r\n \r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd\r\n " }, { "name": "Length", "value": "2794793" } ], "repeated": 0, "id": 5247 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 5248 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5249 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5250 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6646" } ], "repeated": 0, "id": 5251 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextShaping" }, { "name": "BaseAddress", "value": "0x6b250000" }, { "name": "InitRoutine", "value": "0x6b2df2f0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 5252 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7784e000" }, { "name": "ModuleName", "value": "gdi32full.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5253 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7784e000" }, { "name": "ModuleName", "value": "gdi32full.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5254 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5255 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5256 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5257 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink" } ], "repeated": 0, "id": 5258 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7796b853", "parentcaller": "0x779ce66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "KeyInformation", "value": "\\xff9a\\x066\\xffe5\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00\\x00\\x006\\x00\\x00\\x00\\xff84\\x03\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 5259 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5260 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5261 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5262 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5263 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5264 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5265 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5266 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5267 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5268 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5269 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5270 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5271 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5272 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5273 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5274 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5275 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5276 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5277 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5278 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5279 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5280 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5281 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5282 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5283 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5284 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5285 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5286 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5287 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5288 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5289 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5290 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5291 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5292 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5293 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5294 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5295 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5296 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5297 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5298 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5299 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5300 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5301 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5302 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5303 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5304 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5305 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5306 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5307 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "24" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5308 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "24" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5309 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5310 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5311 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5312 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5313 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "27" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5314 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "27" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5315 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "28" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5316 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "28" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5317 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "29" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5318 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "29" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5319 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "30" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5320 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "30" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5321 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "31" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5322 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "31" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5323 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "32" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5324 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "32" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5325 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "33" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5326 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "33" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5327 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "34" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5328 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "34" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5329 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5330 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5331 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "36" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5332 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "36" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5333 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "37" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5334 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "37" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5335 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "38" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5336 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "38" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5337 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "39" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5338 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "39" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5339 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "40" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5340 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "40" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5341 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "41" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5342 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "41" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5343 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "42" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5344 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "42" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5345 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "43" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5346 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "43" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5347 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "44" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5348 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "44" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5349 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "45" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5350 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "45" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5351 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "46" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5352 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "46" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5353 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "47" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5354 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "47" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5355 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "48" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5356 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "48" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5357 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "49" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5358 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "49" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5359 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "50" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5360 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "50" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5361 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "51" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5362 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "51" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5363 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "52" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5364 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "52" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5365 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "53" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5366 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "53" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5367 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "54" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5368 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "54" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5369 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "55" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5370 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "55" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5371 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "56" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5372 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "56" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5373 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "57" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5374 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "57" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5375 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "58" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5376 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "58" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5377 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "59" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5378 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "59" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5379 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "60" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5380 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "60" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5381 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "61" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5382 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "61" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5383 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "62" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5384 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "62" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5385 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "63" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5386 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "63" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5387 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "64" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5388 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "64" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5389 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "65" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5390 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "65" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5391 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "66" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5392 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfe05", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "66" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5393 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cfd73", "parentcaller": "0x7797d052", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "67" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5394 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777d530f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 5395 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x777dec67", "parentcaller": "0x777d33cc", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000c09", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 5396 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5397 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0" } ], "repeated": 0, "id": 5398 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "Disable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable" } ], "repeated": 0, "id": 5399 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "DataFilePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\Fonts\\staticcache.dat" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath" } ], "repeated": 0, "id": 5400 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777dfc31", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 5401 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\staticcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5402 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779aecdc", "parentcaller": "0x777dfd24", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000700" }, { "name": "HandleName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5403 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798a90c", "parentcaller": "0x777dfd7d", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000700" }, { "name": "HandleName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" }, { "name": "Buffer", "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00" }, { "name": "Length", "value": "60" } ], "repeated": 0, "id": 5404 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77989888", "parentcaller": "0x779894ee", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006a4" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000700" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" } ], "repeated": 0, "id": 5405 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x777dff85", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06fa0000" }, { "name": "SectionOffset", "value": "0x0606d170" }, { "name": "ViewSize", "value": "0x01260000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5406 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066e4000" }, { "name": "RegionSize", "value": "0x00015000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5407 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5408 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 5409 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1" } ], "repeated": 0, "id": 5410 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane2" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "SimSun-ExtB" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2" } ], "repeated": 1, "id": 5411 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3" } ], "repeated": 0, "id": 5412 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4" } ], "repeated": 0, "id": 5413 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5" } ], "repeated": 0, "id": 5414 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6" } ], "repeated": 0, "id": 5415 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane7" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7" } ], "repeated": 0, "id": 5416 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8" } ], "repeated": 0, "id": 5417 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9" } ], "repeated": 0, "id": 5418 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10" } ], "repeated": 0, "id": 5419 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11" } ], "repeated": 0, "id": 5420 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane12" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12" } ], "repeated": 0, "id": 5421 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08200000" }, { "name": "RegionSize", "value": "0x002b1000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5422 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane13" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13" } ], "repeated": 0, "id": 5423 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 5424 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14" } ], "repeated": 0, "id": 5425 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane15" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15" } ], "repeated": 0, "id": 5426 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "ValueName", "value": "Plane16" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16" } ], "repeated": 0, "id": 5427 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777e2764", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 5428 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5429 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 5430 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7796b853", "parentcaller": "0x779ce66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "KeyInformation", "value": "i\\xffb0\\xfffc\\xffbe\\xffe3\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x18\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 5431 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf8eb", "parentcaller": "0x7797e6db", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 5432 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf8eb", "parentcaller": "0x7797e6db", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 5433 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf8eb", "parentcaller": "0x7797e6db", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 5434 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf8eb", "parentcaller": "0x7797e6db", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b4" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 5435 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000006b4" }, { "name": "ObjectAttributesName", "value": "Tahoma" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Tahoma" } ], "repeated": 0, "id": 5436 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777e26fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006b4" } ], "repeated": 0, "id": 5437 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6980", "caller": "0x69d48e3f", "parentcaller": "0x69d5409c", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006bc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5438 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5439 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5440 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5441 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5442 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5443 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5444 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5445 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5446 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5447 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5448 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5449 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5450 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5451 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5452 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5453 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5454 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5455 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5456 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5457 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5458 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5459 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 5460 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x77601426", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll" }, { "name": "ModuleHandle", "value": "0x69e80000" } ], "repeated": 0, "id": 5461 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecfe2c", "parentcaller": "0x6b4e753f", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000401aa" }, { "name": "Message", "value": "0x00008002" } ], "repeated": 0, "id": 5462 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ecf69c", "parentcaller": "0x69ecfcea", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 5463 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ec9d45", "parentcaller": "0x69ec5af0", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x69ef10f8", "arguments": [ { "name": "Module", "value": "0x69e80000" }, { "name": "Type", "value": "IMAGE" }, { "name": "Name", "value": "#20012" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 5464 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ec9d64", "parentcaller": "0x69ec5af0", "category": "misc", "api": "LoadResource", "status": true, "return": "0x69f02fdc", "arguments": [ { "name": "Module", "value": "0x69e80000" }, { "name": "ResourceInfo", "value": "0x69ef10f8" } ], "repeated": 0, "id": 5465 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ec9d6f", "parentcaller": "0x69ec5af0", "category": "misc", "api": "LockResource", "status": true, "return": "0x69f02fdc", "arguments": [ { "name": "ResourceData", "value": "0x69f02fdc" } ], "repeated": 0, "id": 5466 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x69ec9d7e", "parentcaller": "0x69ec5af0", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x000007e5", "arguments": [ { "name": "ModuleHandle", "value": "0x69e80000" }, { "name": "ResourceInfo", "value": "0x69ef10f8" } ], "repeated": 0, "id": 5467 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\windowscodecs" }, { "name": "DllBase", "value": "0x6be60000" } ], "repeated": 0, "id": 5468 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 5469 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5470 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5471 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6646" } ], "repeated": 0, "id": 5472 }, { "timestamp": "2026-05-28 22:53:08,528", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowscodecs.dll" }, { "name": "BaseAddress", "value": "0x6be60000" } ], "repeated": 0, "id": 5473 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x69ec5b24", "parentcaller": "0x69ed19a7", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CACAF262-9370-4615-A13B-9F5539DA4C0A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5474 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6becf90f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 5475 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5476 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5477 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b6" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5478 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" } ], "repeated": 0, "id": 5479 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" } ], "repeated": 0, "id": 5480 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797c29f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5481 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5482 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd8\\xdc\\xd7\\xd0\\xd7\\xfa\\x06\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xda\\x06\\x06\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 5483 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" } ], "repeated": 0, "id": 5484 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 5485 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5486 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5487 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xdb\\xdc\\xda\\xd0\\xda\\xfa\\x06\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00x\\xdd\\x06\\x06\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 5488 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5489 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5490 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5491 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5492 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xda\\xac\\xda\\xa0\\xda\\xae\\x06\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdd\\x06\\x06\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 5493 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5494 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID" } ], "repeated": 0, "id": 5495 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5496 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5497 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006b6" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5498 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5499 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000748" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5500 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5501 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5502 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5503 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5504 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Author" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author" } ], "repeated": 0, "id": 5505 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5506 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5507 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5508 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5509 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Author" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Corporation" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author" } ], "repeated": 0, "id": 5510 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5511 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5512 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5513 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5514 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FriendlyName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName" } ], "repeated": 0, "id": 5515 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5516 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5517 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5518 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5519 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FriendlyName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Raw Image Decoder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName" } ], "repeated": 0, "id": 5520 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5521 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5522 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5523 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5524 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Version" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version" } ], "repeated": 0, "id": 5525 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5526 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5527 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5528 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5529 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Version" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "10.0.19041.3636" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version" } ], "repeated": 0, "id": 5530 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5531 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5532 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5533 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5534 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SpecVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion" } ], "repeated": 0, "id": 5535 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5536 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5537 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5538 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5539 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SpecVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.0.0.0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion" } ], "repeated": 0, "id": 5540 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5541 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5542 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00<\\xda\\xec\\xd9\\xe0\\xd9J\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x88\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5543 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5544 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Vendor" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor" } ], "repeated": 0, "id": 5545 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5546 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5547 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00<\\xda\\xec\\xd9\\xe0\\xd9J\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x88\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5548 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5549 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Vendor" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{F0E749CA-EDEF-4589-A73A-EE0E626A2A2B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor" } ], "repeated": 0, "id": 5550 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5551 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5552 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xbc\\xdal\\xda`\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x08\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5553 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32" } ], "repeated": 0, "id": 5554 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074a" }, { "name": "ObjectAttributesName", "value": "InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32" } ], "repeated": 0, "id": 5555 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5556 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5557 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaN\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5558 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32" } ], "repeated": 0, "id": 5559 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 5560 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5561 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5562 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaN\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5563 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32" } ], "repeated": 0, "id": 5564 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemRoot%\\system32\\MSRAWImage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 5565 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed0502", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074e" } ], "repeated": 0, "id": 5566 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5567 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5568 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5569 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5570 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ContainerFormat" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat" } ], "repeated": 0, "id": 5571 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5572 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5573 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xda\\x0c\\xda\\x00\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5574 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5575 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ContainerFormat" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{FE99CE60-F19C-433C-A3AE-00ACEFA9CA21}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat" } ], "repeated": 0, "id": 5576 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5577 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5578 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5579 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5580 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "DeviceManufacturer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer" } ], "repeated": 0, "id": 5581 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5582 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5583 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5584 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5585 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "DeviceModels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels" } ], "repeated": 0, "id": 5586 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5587 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5588 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5589 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5590 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ColorManagementVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion" } ], "repeated": 0, "id": 5591 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5592 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5593 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5594 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5595 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ColorManagementVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.0.0.0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion" } ], "repeated": 0, "id": 5596 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5597 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5598 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5599 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5600 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "MimeTypes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes" } ], "repeated": 0, "id": 5601 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5602 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5603 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5604 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5605 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "MimeTypes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes" } ], "repeated": 0, "id": 5606 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "MimeTypes" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "image/3FR,image/ARI,image/ARW,image/BAY,image/CAP,image/CR2,image/CR3,image/CRW,image/DCS,image/DCR,image/DRF,image/EIP,image/ERF,image/FFF,image/IIQ,image/K25,image/KDC,image/MEF,image/MOS,image/MRW,image/NEF,image/NRW,image/ORF,image/ORI,image/PEF,image/" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes" } ], "repeated": 0, "id": 5607 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5608 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5609 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5610 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5611 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FileExtensions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions" } ], "repeated": 0, "id": 5612 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5613 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5614 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xda4\\xda(\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5615 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5616 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FileExtensions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions" } ], "repeated": 0, "id": 5617 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FileExtensions" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": ".3FR,.ARI,.ARW,.BAY,.CAP,.CR2,.CR3,.CRW,.DCS,.DCR,.DRF,.EIP,.ERF,.FFF,.IIQ,.K25,.KDC,.MEF,.MOS,.MRW,.NEF,.NRW,.ORF,.ORI,.PEF,.PTX,.PXN,.RAF,.RAW,.RW2,.RWL,.SR2,.SRF,.SRW,.X3F,.DNG" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions" } ], "repeated": 0, "id": 5618 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5619 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5620 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xda|\\xdap\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5621 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5622 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportAnimation" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation" } ], "repeated": 0, "id": 5623 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5624 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5625 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xda|\\xdap\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5626 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5627 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportChromakey" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey" } ], "repeated": 0, "id": 5628 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5629 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5630 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xda|\\xdap\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5631 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5632 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportLossless" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless" } ], "repeated": 0, "id": 5633 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5634 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5635 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xda|\\xdap\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5636 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5637 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportMultiframe" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe" } ], "repeated": 0, "id": 5638 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5639 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5640 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xda|\\xdap\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5641 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" } ], "repeated": 0, "id": 5642 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ArbitrationPriority" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority" } ], "repeated": 0, "id": 5643 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5644 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5645 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xda\\xf4\\xd9\\xe8\\xd9J\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x90\\xdc\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5646 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats" } ], "repeated": 0, "id": 5647 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074a" }, { "name": "ObjectAttributesName", "value": "Formats" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats" } ], "repeated": 0, "id": 5648 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797c29f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5649 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5650 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xd6\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xd7\\xf4\\xd6\\xe8\\xd6N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x90\\xd9\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5651 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats" } ], "repeated": 0, "id": 5652 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 5653 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 5654 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed0af1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074e" } ], "repeated": 0, "id": 5655 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5656 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5657 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xc4\\xdat\\xdah\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x10\\xdd\\x06\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 5658 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" } ], "repeated": 0, "id": 5659 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074a" }, { "name": "ObjectAttributesName", "value": "Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" } ], "repeated": 0, "id": 5660 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797c29f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5661 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5662 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd6\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xd7\\xbc\\xd6\\xb0\\xd6N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02X\\xd9\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5663 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" } ], "repeated": 0, "id": 5664 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 5665 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5666 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5667 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5668 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5669 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5670 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5671 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5672 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5673 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5674 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern" } ], "repeated": 0, "id": 5675 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5676 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 5677 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5678 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5679 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5680 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5681 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5682 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5683 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5684 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5685 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5686 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern" } ], "repeated": 0, "id": 5687 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5688 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 5689 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5690 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5691 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5692 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5693 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "10" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5694 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5695 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5696 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5697 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5698 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern" } ], "repeated": 0, "id": 5699 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5700 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 5701 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5702 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5703 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5704 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5705 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "11" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5706 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5707 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5708 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5709 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5710 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern" } ], "repeated": 0, "id": 5711 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5712 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "4" } ], "repeated": 0, "id": 5713 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5714 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5715 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5716 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5717 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "12" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5718 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5719 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5720 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5721 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5722 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern" } ], "repeated": 0, "id": 5723 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5724 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "5" } ], "repeated": 0, "id": 5725 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5726 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5727 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5728 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 5729 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "13" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 5730 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5731 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5732 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5733 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 5734 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern" } ], "repeated": 0, "id": 5735 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5736 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "6" } ], "repeated": 0, "id": 5737 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5738 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5739 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5740 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 5741 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "14" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 5742 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5743 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5744 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5745 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 5746 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern" } ], "repeated": 0, "id": 5747 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5748 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "7" } ], "repeated": 0, "id": 5749 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5750 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5751 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5752 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 5753 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 5754 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5755 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5756 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5757 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 5758 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern" } ], "repeated": 0, "id": 5759 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5760 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "8" } ], "repeated": 0, "id": 5761 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5762 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5763 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5764 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 5765 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "3" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 5766 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5767 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5768 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5769 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 5770 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern" } ], "repeated": 0, "id": 5771 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5772 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "9" } ], "repeated": 0, "id": 5773 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5774 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5775 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5776 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 5777 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "4" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 5778 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5779 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5780 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5781 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 5782 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern" } ], "repeated": 0, "id": 5783 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5784 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "10" } ], "repeated": 0, "id": 5785 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5786 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5787 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5788 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 5789 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 5790 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5791 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5792 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5793 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 5794 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern" } ], "repeated": 0, "id": 5795 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5796 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "11" } ], "repeated": 0, "id": 5797 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5798 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5799 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5800 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 5801 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "6" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 5802 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5803 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5804 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5805 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 5806 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern" } ], "repeated": 0, "id": 5807 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5808 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "12" } ], "repeated": 0, "id": 5809 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5810 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5811 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5812 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 5813 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 5814 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5815 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5816 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5817 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 5818 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern" } ], "repeated": 0, "id": 5819 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5820 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "13" } ], "repeated": 0, "id": 5821 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5822 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5823 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5824 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 5825 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "8" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 5826 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5827 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5828 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5829 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 5830 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern" } ], "repeated": 0, "id": 5831 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5832 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "14" } ], "repeated": 0, "id": 5833 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5834 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5835 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5836 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 5837 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "9" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 5838 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5839 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5840 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5841 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 5842 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern" } ], "repeated": 0, "id": 5843 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5844 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "15" } ], "repeated": 0, "id": 5845 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797c29f", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5846 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5847 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd6\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xd7\\xbc\\xd6\\xb0\\xd6N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02X\\xd9\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5848 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" } ], "repeated": 0, "id": 5849 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 5850 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5851 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5852 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5853 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5854 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5855 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5856 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5857 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5858 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5859 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position" } ], "repeated": 0, "id": 5860 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5861 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5862 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5863 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5864 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream" } ], "repeated": 0, "id": 5865 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5866 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5867 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5868 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5869 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MM\\x00*" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern" } ], "repeated": 0, "id": 5870 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5871 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5872 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5873 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5874 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask" } ], "repeated": 0, "id": 5875 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5876 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5877 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5878 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0" } ], "repeated": 0, "id": 5879 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask" } ], "repeated": 0, "id": 5880 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5881 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 5882 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5883 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5884 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5885 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5886 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5887 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5888 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5889 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5890 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5891 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position" } ], "repeated": 0, "id": 5892 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5893 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5894 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5895 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5896 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream" } ], "repeated": 0, "id": 5897 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5898 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5899 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5900 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5901 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "II*\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern" } ], "repeated": 0, "id": 5902 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5903 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5904 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5905 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5906 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask" } ], "repeated": 0, "id": 5907 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5908 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5909 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5910 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1" } ], "repeated": 0, "id": 5911 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask" } ], "repeated": 0, "id": 5912 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5913 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 5914 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5915 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5916 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5917 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5918 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "10" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5919 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5920 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5921 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5922 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5923 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position" } ], "repeated": 0, "id": 5924 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5925 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5926 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5927 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5928 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream" } ], "repeated": 0, "id": 5929 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5930 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5931 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5932 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5933 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MMMMRaw\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern" } ], "repeated": 0, "id": 5934 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5935 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5936 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5937 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5938 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask" } ], "repeated": 0, "id": 5939 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5940 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5941 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5942 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10" } ], "repeated": 0, "id": 5943 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask" } ], "repeated": 0, "id": 5944 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5945 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 5946 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5947 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5948 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5949 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5950 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "11" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5951 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5952 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5953 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5954 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5955 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position" } ], "repeated": 0, "id": 5956 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5957 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5958 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5959 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5960 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream" } ], "repeated": 0, "id": 5961 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5962 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5963 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5964 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5965 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIU\\x00\\x08\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern" } ], "repeated": 0, "id": 5966 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5967 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5968 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5969 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5970 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask" } ], "repeated": 0, "id": 5971 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5972 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5973 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5974 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11" } ], "repeated": 0, "id": 5975 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask" } ], "repeated": 0, "id": 5976 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 5977 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "4" } ], "repeated": 0, "id": 5978 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5979 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5980 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 5981 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5982 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "12" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5983 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5984 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5985 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5986 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5987 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position" } ], "repeated": 0, "id": 5988 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5989 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5990 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5991 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5992 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream" } ], "repeated": 0, "id": 5993 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5994 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 5995 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 5996 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 5997 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIU\\x00\\x18\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern" } ], "repeated": 0, "id": 5998 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 5999 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6000 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6001 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 6002 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask" } ], "repeated": 0, "id": 6003 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6004 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6005 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6006 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12" } ], "repeated": 0, "id": 6007 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask" } ], "repeated": 0, "id": 6008 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 6009 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "5" } ], "repeated": 0, "id": 6010 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6011 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6012 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6013 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6014 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "13" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6015 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6016 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6017 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6018 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6019 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position" } ], "repeated": 0, "id": 6020 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6021 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6022 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6023 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6024 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream" } ], "repeated": 0, "id": 6025 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6026 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6027 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6028 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6029 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "FOVb" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern" } ], "repeated": 0, "id": 6030 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6031 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6032 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6033 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6034 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask" } ], "repeated": 0, "id": 6035 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6036 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6037 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6038 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13" } ], "repeated": 0, "id": 6039 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask" } ], "repeated": 0, "id": 6040 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 6041 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "6" } ], "repeated": 0, "id": 6042 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6043 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6044 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6045 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6046 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "14" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6047 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6048 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6049 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6050 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6051 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position" } ], "repeated": 0, "id": 6052 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6053 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6054 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6055 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6056 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream" } ], "repeated": 0, "id": 6057 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6058 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6059 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6060 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6061 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "ftypcrx " }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern" } ], "repeated": 0, "id": 6062 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6063 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6064 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6065 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6066 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask" } ], "repeated": 0, "id": 6067 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6068 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6069 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6070 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14" } ], "repeated": 0, "id": 6071 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask" } ], "repeated": 0, "id": 6072 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 6073 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "7" } ], "repeated": 0, "id": 6074 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6075 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6076 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6077 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6078 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6079 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6080 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6081 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6082 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6083 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position" } ], "repeated": 0, "id": 6084 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6085 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6086 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6087 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6088 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream" } ], "repeated": 0, "id": 6089 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6090 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6091 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6092 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6093 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIRO" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern" } ], "repeated": 0, "id": 6094 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6095 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6096 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6097 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6098 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask" } ], "repeated": 0, "id": 6099 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6100 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6101 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6102 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2" } ], "repeated": 0, "id": 6103 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask" } ], "repeated": 0, "id": 6104 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 6105 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "8" } ], "repeated": 0, "id": 6106 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6107 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6108 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6109 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6110 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "3" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6111 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6112 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6113 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6114 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6115 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position" } ], "repeated": 0, "id": 6116 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6117 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6118 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6119 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6120 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream" } ], "repeated": 0, "id": 6121 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6122 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6123 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6124 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6125 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIRS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern" } ], "repeated": 0, "id": 6126 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6127 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6128 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6129 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6130 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask" } ], "repeated": 0, "id": 6131 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6132 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6133 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6134 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3" } ], "repeated": 0, "id": 6135 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask" } ], "repeated": 0, "id": 6136 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 6137 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "9" } ], "repeated": 0, "id": 6138 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6139 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6140 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xda\\xbc\\xd9\\xb0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xdc\\x06\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6141 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6142 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000750" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "4" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6143 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6144 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6145 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6146 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6147 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position" } ], "repeated": 0, "id": 6148 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6149 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6150 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6151 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6152 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream" } ], "repeated": 0, "id": 6153 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6154 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6155 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6156 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6157 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MMOR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern" } ], "repeated": 0, "id": 6158 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6159 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6160 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6161 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6162 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask" } ], "repeated": 0, "id": 6163 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7796a8fe", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6164 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fcdc", "parentcaller": "0x7796a934", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 6165 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd9\\\\xd9P\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xdb\\x06\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00" } ], "repeated": 0, "id": 6166 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4" } ], "repeated": 0, "id": 6167 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000752" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask" } ], "repeated": 0, "id": 6168 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000752" } ], "repeated": 0, "id": 6169 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "10" } ], "repeated": 0, "id": 6170 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "2320", "caller": "0x7798005b", "parentcaller": "0x7797fbbd", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 6171 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6936", "caller": "0x77b0058c", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084c0000" }, { "name": "RegionSize", "value": "0x00200000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6172 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6936", "caller": "0x77b005eb", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084c0000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6173 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6936", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066f9000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6174 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084e2000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6175 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08502000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6176 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00086000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6177 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 6178 }, { "timestamp": "2026-05-28 22:53:08,544", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08745000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 6179 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 6180 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6181 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00108000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6182 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 6183 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08857000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 6184 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6888" } ], "repeated": 0, "id": 6185 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6186 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6187 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6188 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6189 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6190 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position" } ], "repeated": 0, "id": 6191 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6192 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6193 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream" } ], "repeated": 0, "id": 6194 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6195 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6196 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MMSR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern" } ], "repeated": 0, "id": 6197 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6198 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6199 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask" } ], "repeated": 0, "id": 6200 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6201 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5" } ], "repeated": 0, "id": 6202 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask" } ], "repeated": 0, "id": 6203 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6204 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "11" } ], "repeated": 0, "id": 6205 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6206 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6207 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "6" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6208 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6209 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6210 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position" } ], "repeated": 0, "id": 6211 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6212 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6213 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream" } ], "repeated": 0, "id": 6214 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6215 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6216 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "II\\x1a\\x00\\x00\\x00HE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern" } ], "repeated": 0, "id": 6217 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6218 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6219 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask" } ], "repeated": 0, "id": 6220 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6221 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6" } ], "repeated": 0, "id": 6222 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask" } ], "repeated": 0, "id": 6223 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6224 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "12" } ], "repeated": 0, "id": 6225 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6226 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6227 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6228 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6229 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6230 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position" } ], "repeated": 0, "id": 6231 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6232 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6233 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream" } ], "repeated": 0, "id": 6234 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6235 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6236 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "FUJIFILM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern" } ], "repeated": 0, "id": 6237 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6238 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6239 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask" } ], "repeated": 0, "id": 6240 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6241 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7" } ], "repeated": 0, "id": 6242 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask" } ], "repeated": 0, "id": 6243 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6244 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "13" } ], "repeated": 0, "id": 6245 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6246 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6247 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "8" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6248 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6249 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6250 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position" } ], "repeated": 0, "id": 6251 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6252 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6253 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream" } ], "repeated": 0, "id": 6254 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6255 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6256 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x00MRM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern" } ], "repeated": 0, "id": 6257 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6258 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6259 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask" } ], "repeated": 0, "id": 6260 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6261 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8" } ], "repeated": 0, "id": 6262 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask" } ], "repeated": 0, "id": 6263 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6264 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "14" } ], "repeated": 0, "id": 6265 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6266 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6267 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "9" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6268 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6269 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6270 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position" } ], "repeated": 0, "id": 6271 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6272 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6273 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6274 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream" } ], "repeated": 0, "id": 6275 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6276 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6277 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIII\\x00waR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern" } ], "repeated": 0, "id": 6278 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6279 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6280 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask" } ], "repeated": 0, "id": 6281 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6282 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9" } ], "repeated": 0, "id": 6283 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask" } ], "repeated": 0, "id": 6284 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6285 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "15" } ], "repeated": 0, "id": 6286 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed09aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074e" } ], "repeated": 0, "id": 6287 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed0089", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074a" } ], "repeated": 0, "id": 6288 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6becf7ff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6289 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 6290 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdd\\x06\\x06\\xe0\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6291 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x7797498d", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6292 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6293 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6294 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdd\\x06\\x06\\xb0\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6295 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6296 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "ValueName", "value": "CLSID" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID" } ], "repeated": 0, "id": 6297 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6298 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6299 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000748" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6300 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6301 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6302 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Author" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author" } ], "repeated": 0, "id": 6303 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6304 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6305 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6306 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6307 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6308 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FriendlyName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName" } ], "repeated": 0, "id": 6309 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6310 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6311 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FriendlyName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Camera Raw Decoder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName" } ], "repeated": 0, "id": 6312 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6313 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6314 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Version" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version" } ], "repeated": 0, "id": 6315 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6316 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6317 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Version" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "10.0.19041.3636" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version" } ], "repeated": 0, "id": 6318 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6319 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6320 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SpecVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion" } ], "repeated": 0, "id": 6321 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6322 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6323 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SpecVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.0.0.0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion" } ], "repeated": 0, "id": 6324 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xdc\\x06\\x06\\xf0\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6325 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6326 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Vendor" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor" } ], "repeated": 0, "id": 6327 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xdc\\x06\\x06\\xf0\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6328 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6329 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "Vendor" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{F0E749CA-EDEF-4589-A73A-EE0E626A2A2B}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor" } ], "repeated": 0, "id": 6330 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xdd\\x06\\x06p\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6331 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32" } ], "repeated": 0, "id": 6332 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074a" }, { "name": "ObjectAttributesName", "value": "InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32" } ], "repeated": 0, "id": 6333 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6334 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32" } ], "repeated": 0, "id": 6335 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 6336 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xdc\\x06\\x06\\x10\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6337 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32" } ], "repeated": 0, "id": 6338 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6888" } ], "repeated": 0, "id": 6339 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6340 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6341 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "DeviceManufacturer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer" } ], "repeated": 0, "id": 6342 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6343 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6344 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "DeviceModels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels" } ], "repeated": 0, "id": 6345 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6346 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6347 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ColorManagementVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion" } ], "repeated": 0, "id": 6348 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6349 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6350 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ColorManagementVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.0.0.0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion" } ], "repeated": 0, "id": 6351 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6352 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6353 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "MimeTypes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes" } ], "repeated": 0, "id": 6354 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6355 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6356 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "MimeTypes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes" } ], "repeated": 0, "id": 6357 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "MimeTypes" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "image/ARW,image/CR2,image/CRW,image/ERF,image/KDC,image/MRW,image/NEF,image/NRW,image/ORF,image/PEF,image/RAF,image/RAW,image/RW2,image/RWL,image/SR2,image/SRW,image/DNG" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes" } ], "repeated": 0, "id": 6358 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6359 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6360 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FileExtensions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions" } ], "repeated": 0, "id": 6361 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdc\\x06\\x068\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6362 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6363 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FileExtensions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions" } ], "repeated": 0, "id": 6364 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cecbb", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "FileExtensions" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": ".ARW,.CR2,.CRW,.ERF,.KDC,.MRW,.NEF,.NRW,.ORF,.PEF,.RAF,.RAW,.RW2,.RWL,.SR2,.SRW,.DNG" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions" } ], "repeated": 0, "id": 6365 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xdd\\x06\\x06\\x80\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6366 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6367 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportAnimation" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation" } ], "repeated": 0, "id": 6368 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xdd\\x06\\x06\\x80\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6369 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6370 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportChromakey" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey" } ], "repeated": 0, "id": 6371 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xdd\\x06\\x06\\x80\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6372 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6373 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportLossless" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless" } ], "repeated": 0, "id": 6374 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xdd\\x06\\x06\\x80\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6375 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6376 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "SupportMultiframe" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe" } ], "repeated": 0, "id": 6377 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xdd\\x06\\x06\\x80\\xda\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6378 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" } ], "repeated": 0, "id": 6379 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074a" }, { "name": "ValueName", "value": "ArbitrationPriority" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority" } ], "repeated": 0, "id": 6380 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xdc\\x06\\x06\\xf8\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6381 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats" } ], "repeated": 0, "id": 6382 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074a" }, { "name": "ObjectAttributesName", "value": "Formats" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats" } ], "repeated": 0, "id": 6383 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xd6\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xd9\\x06\\x06\\xf8\\xd6\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6384 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats" } ], "repeated": 0, "id": 6385 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6386 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 6387 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 6388 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 6389 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "4" } ], "repeated": 0, "id": 6390 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "5" } ], "repeated": 0, "id": 6391 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "6" } ], "repeated": 0, "id": 6392 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "7" } ], "repeated": 0, "id": 6393 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "8" } ], "repeated": 0, "id": 6394 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed0af1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074e" } ], "repeated": 0, "id": 6395 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x10\\xdd\\x06\\x06x\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00" } ], "repeated": 0, "id": 6396 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" } ], "repeated": 0, "id": 6397 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074a" }, { "name": "ObjectAttributesName", "value": "Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" } ], "repeated": 0, "id": 6398 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd6\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xd9\\x06\\x06\\xc0\\xd6\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6399 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" } ], "repeated": 0, "id": 6400 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6401 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6402 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6403 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6404 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6405 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6406 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern" } ], "repeated": 0, "id": 6407 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6408 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 6409 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6410 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6411 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6412 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6413 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6414 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern" } ], "repeated": 0, "id": 6415 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6416 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 6417 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6418 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6419 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "10" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6420 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6421 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6422 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern" } ], "repeated": 0, "id": 6423 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a65000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 6424 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 6425 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6426 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6427 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "11" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6428 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6429 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6430 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern" } ], "repeated": 0, "id": 6431 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6432 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "4" } ], "repeated": 0, "id": 6433 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6434 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6435 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "12" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6436 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6437 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6438 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern" } ], "repeated": 0, "id": 6439 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6440 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "5" } ], "repeated": 0, "id": 6441 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6442 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6443 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6444 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6445 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6446 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern" } ], "repeated": 0, "id": 6447 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6448 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "6" } ], "repeated": 0, "id": 6449 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6450 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6451 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "3" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6452 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6453 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6454 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern" } ], "repeated": 0, "id": 6455 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6456 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "7" } ], "repeated": 0, "id": 6457 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6458 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6459 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "4" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6460 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6461 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6462 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern" } ], "repeated": 0, "id": 6463 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6464 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "8" } ], "repeated": 0, "id": 6465 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6466 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6467 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6468 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6469 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6470 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern" } ], "repeated": 0, "id": 6471 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6472 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "9" } ], "repeated": 0, "id": 6473 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6474 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6475 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "6" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6476 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6477 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6478 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern" } ], "repeated": 0, "id": 6479 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6480 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "10" } ], "repeated": 0, "id": 6481 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6482 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6483 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6484 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6485 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6486 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern" } ], "repeated": 0, "id": 6487 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6488 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "11" } ], "repeated": 0, "id": 6489 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6490 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6491 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "8" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6492 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6493 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6494 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern" } ], "repeated": 0, "id": 6495 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6496 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "12" } ], "repeated": 0, "id": 6497 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6498 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6499 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "9" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6500 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6501 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6502 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern" } ], "repeated": 0, "id": 6503 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6504 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "13" } ], "repeated": 0, "id": 6505 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd6\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xd9\\x06\\x06\\xc0\\xd6\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6506 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns" } ], "repeated": 0, "id": 6507 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6508 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6509 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6510 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6511 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6512 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6513 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position" } ], "repeated": 0, "id": 6514 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6515 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6516 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream" } ], "repeated": 0, "id": 6517 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6518 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6519 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MM\\x00*" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern" } ], "repeated": 0, "id": 6520 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6521 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6522 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask" } ], "repeated": 0, "id": 6523 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6524 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0" } ], "repeated": 0, "id": 6525 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask" } ], "repeated": 0, "id": 6526 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6527 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 6528 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6529 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6530 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6531 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6532 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6533 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position" } ], "repeated": 0, "id": 6534 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6535 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6536 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream" } ], "repeated": 0, "id": 6537 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6538 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6539 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "II*\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern" } ], "repeated": 0, "id": 6540 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6541 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6542 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask" } ], "repeated": 0, "id": 6543 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6544 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1" } ], "repeated": 0, "id": 6545 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask" } ], "repeated": 0, "id": 6546 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6547 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 6548 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6549 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6550 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "10" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6551 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6552 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6553 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position" } ], "repeated": 0, "id": 6554 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6555 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6556 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream" } ], "repeated": 0, "id": 6557 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6558 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6559 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MMMMRaw\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern" } ], "repeated": 0, "id": 6560 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6561 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6562 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask" } ], "repeated": 0, "id": 6563 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6564 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10" } ], "repeated": 0, "id": 6565 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask" } ], "repeated": 0, "id": 6566 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6567 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 6568 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6569 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6570 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "11" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6571 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6572 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6573 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position" } ], "repeated": 0, "id": 6574 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6575 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6576 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream" } ], "repeated": 0, "id": 6577 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6578 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6579 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIU\\x00\\x08\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern" } ], "repeated": 0, "id": 6580 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6581 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6582 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask" } ], "repeated": 0, "id": 6583 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6584 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11" } ], "repeated": 0, "id": 6585 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask" } ], "repeated": 0, "id": 6586 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6587 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "4" } ], "repeated": 0, "id": 6588 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6589 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6590 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "12" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6591 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6592 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6593 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position" } ], "repeated": 0, "id": 6594 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6595 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6596 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream" } ], "repeated": 0, "id": 6597 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6598 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6599 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIU\\x00\\x18\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern" } ], "repeated": 0, "id": 6600 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6601 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6602 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask" } ], "repeated": 0, "id": 6603 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6604 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12" } ], "repeated": 0, "id": 6605 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask" } ], "repeated": 0, "id": 6606 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6607 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "5" } ], "repeated": 0, "id": 6608 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6609 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6610 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6611 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6612 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6613 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position" } ], "repeated": 0, "id": 6614 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6615 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6616 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream" } ], "repeated": 0, "id": 6617 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6618 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6619 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIRO" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern" } ], "repeated": 0, "id": 6620 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6621 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6622 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask" } ], "repeated": 0, "id": 6623 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6624 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2" } ], "repeated": 0, "id": 6625 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask" } ], "repeated": 0, "id": 6626 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6627 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "6" } ], "repeated": 0, "id": 6628 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6629 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6630 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "3" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6631 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6632 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6633 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position" } ], "repeated": 0, "id": 6634 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6635 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6636 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream" } ], "repeated": 0, "id": 6637 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6638 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6639 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIRS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern" } ], "repeated": 0, "id": 6640 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6641 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6642 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask" } ], "repeated": 0, "id": 6643 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6644 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3" } ], "repeated": 0, "id": 6645 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask" } ], "repeated": 0, "id": 6646 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6647 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "7" } ], "repeated": 0, "id": 6648 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6649 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6650 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "4" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6651 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6652 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6653 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position" } ], "repeated": 0, "id": 6654 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6655 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6656 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream" } ], "repeated": 0, "id": 6657 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6658 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6659 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MMOR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern" } ], "repeated": 0, "id": 6660 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6661 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6662 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask" } ], "repeated": 0, "id": 6663 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6664 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4" } ], "repeated": 0, "id": 6665 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask" } ], "repeated": 0, "id": 6666 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6667 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "8" } ], "repeated": 0, "id": 6668 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6669 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6670 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "5" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6671 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6672 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6673 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position" } ], "repeated": 0, "id": 6674 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6675 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6676 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream" } ], "repeated": 0, "id": 6677 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6678 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6679 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "MMSR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern" } ], "repeated": 0, "id": 6680 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6681 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6682 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask" } ], "repeated": 0, "id": 6683 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6684 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5" } ], "repeated": 0, "id": 6685 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask" } ], "repeated": 0, "id": 6686 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6687 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "9" } ], "repeated": 0, "id": 6688 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6689 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6690 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "6" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6691 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6692 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6693 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position" } ], "repeated": 0, "id": 6694 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6695 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6696 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream" } ], "repeated": 0, "id": 6697 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6698 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6699 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "II\\x1a\\x00\\x00\\x00HE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern" } ], "repeated": 0, "id": 6700 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6701 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6702 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask" } ], "repeated": 0, "id": 6703 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6704 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6" } ], "repeated": 0, "id": 6705 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask" } ], "repeated": 0, "id": 6706 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6707 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "10" } ], "repeated": 0, "id": 6708 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6709 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6710 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6711 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6712 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6713 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position" } ], "repeated": 0, "id": 6714 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6715 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6716 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream" } ], "repeated": 0, "id": 6717 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6718 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6719 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "FUJIFILM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern" } ], "repeated": 0, "id": 6720 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6721 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6722 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask" } ], "repeated": 0, "id": 6723 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6724 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7" } ], "repeated": 0, "id": 6725 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask" } ], "repeated": 0, "id": 6726 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6727 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "11" } ], "repeated": 0, "id": 6728 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6729 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6730 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "8" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6731 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6732 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6733 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position" } ], "repeated": 0, "id": 6734 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6735 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6736 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream" } ], "repeated": 0, "id": 6737 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6738 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6739 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x00MRM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern" } ], "repeated": 0, "id": 6740 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6741 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6742 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask" } ], "repeated": 0, "id": 6743 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6744 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8" } ], "repeated": 0, "id": 6745 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask" } ], "repeated": 0, "id": 6746 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6747 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "12" } ], "repeated": 0, "id": 6748 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xdc\\x06\\x06\\xc0\\xd9\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00" } ], "repeated": 0, "id": 6749 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6750 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000754" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000074e" }, { "name": "ObjectAttributesName", "value": "9" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6751 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6752 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6753 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Position" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position" } ], "repeated": 0, "id": 6754 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6755 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6756 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "EndOfStream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream" } ], "repeated": 0, "id": 6757 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc\\x06\\x06h\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6758 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6759 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Pattern" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "IIII\\x00waR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern" } ], "repeated": 0, "id": 6760 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6761 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6762 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask" } ], "repeated": 0, "id": 6763 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd9\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xdb\\x06\\x06`\\xd9\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00" } ], "repeated": 0, "id": 6764 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9" } ], "repeated": 0, "id": 6765 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000756" }, { "name": "ValueName", "value": "Mask" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask" } ], "repeated": 0, "id": 6766 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bebf891", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000756" } ], "repeated": 0, "id": 6767 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000074e" }, { "name": "Index", "value": "13" } ], "repeated": 0, "id": 6768 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed09aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074e" } ], "repeated": 0, "id": 6769 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed0089", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074a" } ], "repeated": 0, "id": 6770 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6becf7ff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6771 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006fa" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 6772 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6becf829", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6773 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6774 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}" } ], "repeated": 0, "id": 6775 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}" } ], "repeated": 0, "id": 6776 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6777 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers" } ], "repeated": 0, "id": 6778 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers" } ], "repeated": 0, "id": 6779 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6780 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers" } ], "repeated": 0, "id": 6781 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6782 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6783 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6784 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6785 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}" } ], "repeated": 0, "id": 6786 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}" } ], "repeated": 0, "id": 6787 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6788 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers" } ], "repeated": 0, "id": 6789 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers" } ], "repeated": 0, "id": 6790 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6791 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers" } ], "repeated": 0, "id": 6792 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6793 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6794 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6795 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6796 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}" } ], "repeated": 0, "id": 6797 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}" } ], "repeated": 0, "id": 6798 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6799 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers" } ], "repeated": 0, "id": 6800 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers" } ], "repeated": 0, "id": 6801 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6802 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers" } ], "repeated": 0, "id": 6803 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6804 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6805 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6806 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6807 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}" } ], "repeated": 0, "id": 6808 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}" } ], "repeated": 0, "id": 6809 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6810 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers" } ], "repeated": 0, "id": 6811 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers" } ], "repeated": 0, "id": 6812 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6813 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers" } ], "repeated": 0, "id": 6814 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6815 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6816 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6817 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6818 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}" } ], "repeated": 0, "id": 6819 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}" } ], "repeated": 0, "id": 6820 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6821 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers" } ], "repeated": 0, "id": 6822 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers" } ], "repeated": 0, "id": 6823 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6824 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers" } ], "repeated": 0, "id": 6825 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6826 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6827 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6828 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6829 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}" } ], "repeated": 0, "id": 6830 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}" } ], "repeated": 0, "id": 6831 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6832 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers" } ], "repeated": 0, "id": 6833 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers" } ], "repeated": 0, "id": 6834 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6835 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers" } ], "repeated": 0, "id": 6836 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6837 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6838 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6839 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6840 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}" } ], "repeated": 0, "id": 6841 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}" } ], "repeated": 0, "id": 6842 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6843 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers" } ], "repeated": 0, "id": 6844 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers" } ], "repeated": 0, "id": 6845 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6846 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers" } ], "repeated": 0, "id": 6847 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6848 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6849 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6850 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6851 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{3697790B-223B-484E-9925-C4869218F17A}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}" } ], "repeated": 0, "id": 6852 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}" } ], "repeated": 0, "id": 6853 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6854 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers" } ], "repeated": 0, "id": 6855 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers" } ], "repeated": 0, "id": 6856 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6857 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers" } ], "repeated": 0, "id": 6858 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6859 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6860 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6861 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6862 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}" } ], "repeated": 0, "id": 6863 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}" } ], "repeated": 0, "id": 6864 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6865 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers" } ], "repeated": 0, "id": 6866 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers" } ], "repeated": 0, "id": 6867 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6868 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers" } ], "repeated": 0, "id": 6869 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6870 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6871 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6872 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6873 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}" } ], "repeated": 0, "id": 6874 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}" } ], "repeated": 0, "id": 6875 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6876 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" } ], "repeated": 0, "id": 6877 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" } ], "repeated": 0, "id": 6878 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6879 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" } ], "repeated": 0, "id": 6880 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6881 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6882 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6883 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6884 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}" } ], "repeated": 0, "id": 6885 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}" } ], "repeated": 0, "id": 6886 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6887 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" } ], "repeated": 0, "id": 6888 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" } ], "repeated": 0, "id": 6889 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6890 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers" } ], "repeated": 0, "id": 6891 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6892 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6893 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6894 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6895 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}" } ], "repeated": 0, "id": 6896 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}" } ], "repeated": 0, "id": 6897 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6898 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers" } ], "repeated": 0, "id": 6899 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers" } ], "repeated": 0, "id": 6900 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6901 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers" } ], "repeated": 0, "id": 6902 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6903 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6904 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6905 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6906 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}" } ], "repeated": 0, "id": 6907 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}" } ], "repeated": 0, "id": 6908 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6909 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers" } ], "repeated": 0, "id": 6910 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers" } ], "repeated": 0, "id": 6911 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6912 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers" } ], "repeated": 0, "id": 6913 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6914 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6915 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6916 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6917 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}" } ], "repeated": 0, "id": 6918 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}" } ], "repeated": 0, "id": 6919 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6920 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers" } ], "repeated": 0, "id": 6921 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers" } ], "repeated": 0, "id": 6922 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6923 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers" } ], "repeated": 0, "id": 6924 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6925 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6926 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6927 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6928 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}" } ], "repeated": 0, "id": 6929 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}" } ], "repeated": 0, "id": 6930 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6931 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers" } ], "repeated": 0, "id": 6932 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers" } ], "repeated": 0, "id": 6933 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6934 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers" } ], "repeated": 0, "id": 6935 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6936 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6937 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6938 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6939 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}" } ], "repeated": 0, "id": 6940 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}" } ], "repeated": 0, "id": 6941 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6942 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers" } ], "repeated": 0, "id": 6943 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers" } ], "repeated": 0, "id": 6944 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6945 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers" } ], "repeated": 0, "id": 6946 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6947 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6948 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6949 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6950 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}" } ], "repeated": 0, "id": 6951 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}" } ], "repeated": 0, "id": 6952 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6953 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers" } ], "repeated": 0, "id": 6954 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers" } ], "repeated": 0, "id": 6955 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6956 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers" } ], "repeated": 0, "id": 6957 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6958 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6959 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6960 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6961 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}" } ], "repeated": 0, "id": 6962 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}" } ], "repeated": 0, "id": 6963 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6964 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers" } ], "repeated": 0, "id": 6965 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers" } ], "repeated": 0, "id": 6966 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6967 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers" } ], "repeated": 0, "id": 6968 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6969 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6970 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6971 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6972 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}" } ], "repeated": 0, "id": 6973 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}" } ], "repeated": 0, "id": 6974 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6975 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers" } ], "repeated": 0, "id": 6976 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers" } ], "repeated": 0, "id": 6977 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6978 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers" } ], "repeated": 0, "id": 6979 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6980 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6981 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6982 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6983 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}" } ], "repeated": 0, "id": 6984 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}" } ], "repeated": 0, "id": 6985 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6986 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers" } ], "repeated": 0, "id": 6987 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers" } ], "repeated": 0, "id": 6988 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 6989 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers" } ], "repeated": 0, "id": 6990 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6991 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 6992 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 6993 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6994 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}" } ], "repeated": 0, "id": 6995 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}" } ], "repeated": 0, "id": 6996 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 6997 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers" } ], "repeated": 0, "id": 6998 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers" } ], "repeated": 0, "id": 6999 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7000 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers" } ], "repeated": 0, "id": 7001 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7002 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7003 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7004 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7005 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}" } ], "repeated": 0, "id": 7006 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}" } ], "repeated": 0, "id": 7007 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7008 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers" } ], "repeated": 0, "id": 7009 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers" } ], "repeated": 0, "id": 7010 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7011 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers" } ], "repeated": 0, "id": 7012 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7013 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7014 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7015 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7016 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}" } ], "repeated": 0, "id": 7017 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}" } ], "repeated": 0, "id": 7018 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7019 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers" } ], "repeated": 0, "id": 7020 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers" } ], "repeated": 0, "id": 7021 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7022 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers" } ], "repeated": 0, "id": 7023 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7024 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7025 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7026 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7027 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}" } ], "repeated": 0, "id": 7028 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}" } ], "repeated": 0, "id": 7029 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7030 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers" } ], "repeated": 0, "id": 7031 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a70000" }, { "name": "RegionSize", "value": "0x0040f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7032 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a70000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7033 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7034 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08e7e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7035 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers" } ], "repeated": 0, "id": 7036 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7037 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7038 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7039 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7040 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}" } ], "repeated": 0, "id": 7041 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}" } ], "repeated": 0, "id": 7042 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7043 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers" } ], "repeated": 0, "id": 7044 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers" } ], "repeated": 0, "id": 7045 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7046 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers" } ], "repeated": 0, "id": 7047 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7048 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7049 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7050 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7051 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}" } ], "repeated": 0, "id": 7052 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}" } ], "repeated": 0, "id": 7053 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7054 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers" } ], "repeated": 0, "id": 7055 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers" } ], "repeated": 0, "id": 7056 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7057 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers" } ], "repeated": 0, "id": 7058 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7059 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7060 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7061 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7062 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}" } ], "repeated": 0, "id": 7063 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}" } ], "repeated": 0, "id": 7064 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7065 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers" } ], "repeated": 0, "id": 7066 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers" } ], "repeated": 0, "id": 7067 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7068 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers" } ], "repeated": 0, "id": 7069 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7070 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7071 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7072 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7073 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}" } ], "repeated": 0, "id": 7074 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}" } ], "repeated": 0, "id": 7075 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7076 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers" } ], "repeated": 0, "id": 7077 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers" } ], "repeated": 0, "id": 7078 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7079 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers" } ], "repeated": 0, "id": 7080 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7081 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7082 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7083 }, { "timestamp": "2026-05-28 22:53:08,559", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7084 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}" } ], "repeated": 0, "id": 7085 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}" } ], "repeated": 0, "id": 7086 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xfa\\x06\\x00\\x00" } ], "repeated": 0, "id": 7087 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers" } ], "repeated": 0, "id": 7088 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fa" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers" } ], "repeated": 0, "id": 7089 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xae\\x06\\x00\\x00" } ], "repeated": 0, "id": 7090 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers" } ], "repeated": 0, "id": 7091 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006ae" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7092 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ae" } ], "repeated": 0, "id": 7093 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fa" } ], "repeated": 0, "id": 7094 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7095 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}" } ], "repeated": 0, "id": 7096 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}" } ], "repeated": 0, "id": 7097 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7098 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers" } ], "repeated": 0, "id": 7099 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers" } ], "repeated": 0, "id": 7100 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7101 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers" } ], "repeated": 0, "id": 7102 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7103 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7104 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7105 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7106 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}" } ], "repeated": 0, "id": 7107 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}" } ], "repeated": 0, "id": 7108 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7109 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers" } ], "repeated": 0, "id": 7110 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers" } ], "repeated": 0, "id": 7111 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7112 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers" } ], "repeated": 0, "id": 7113 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7114 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7115 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7116 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7117 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}" } ], "repeated": 0, "id": 7118 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}" } ], "repeated": 0, "id": 7119 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7120 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers" } ], "repeated": 0, "id": 7121 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers" } ], "repeated": 0, "id": 7122 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7123 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers" } ], "repeated": 0, "id": 7124 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7125 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7126 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7127 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7128 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}" } ], "repeated": 0, "id": 7129 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}" } ], "repeated": 0, "id": 7130 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7131 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers" } ], "repeated": 0, "id": 7132 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers" } ], "repeated": 0, "id": 7133 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7134 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers" } ], "repeated": 0, "id": 7135 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7136 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7137 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7138 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7139 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}" } ], "repeated": 0, "id": 7140 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}" } ], "repeated": 0, "id": 7141 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7142 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers" } ], "repeated": 0, "id": 7143 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers" } ], "repeated": 0, "id": 7144 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7145 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers" } ], "repeated": 0, "id": 7146 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7147 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7148 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7149 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7150 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}" } ], "repeated": 0, "id": 7151 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}" } ], "repeated": 0, "id": 7152 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7153 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers" } ], "repeated": 0, "id": 7154 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers" } ], "repeated": 0, "id": 7155 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7156 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers" } ], "repeated": 0, "id": 7157 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7158 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7159 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7160 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7161 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}" } ], "repeated": 0, "id": 7162 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}" } ], "repeated": 0, "id": 7163 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7164 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers" } ], "repeated": 0, "id": 7165 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers" } ], "repeated": 0, "id": 7166 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7167 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers" } ], "repeated": 0, "id": 7168 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7169 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7170 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7171 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7172 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}" } ], "repeated": 0, "id": 7173 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}" } ], "repeated": 0, "id": 7174 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7175 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers" } ], "repeated": 0, "id": 7176 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers" } ], "repeated": 0, "id": 7177 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7178 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers" } ], "repeated": 0, "id": 7179 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7180 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7181 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7182 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7183 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}" } ], "repeated": 0, "id": 7184 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000758" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}" } ], "repeated": 0, "id": 7185 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xda\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdd\\x06\\x06\\xd8\\xda\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wZ\\x07\\x00\\x00" } ], "repeated": 0, "id": 7186 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers" } ], "repeated": 0, "id": 7187 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075a" }, { "name": "ObjectAttributesName", "value": "Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers" } ], "repeated": 0, "id": 7188 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xda\\x06\\x06\\xd8\\xd7\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w^\\x07\\x00\\x00" } ], "repeated": 0, "id": 7189 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers" } ], "repeated": 0, "id": 7190 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7796b7c5", "parentcaller": "0x7797bee8", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000075e" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7191 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6bed8691", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075e" } ], "repeated": 0, "id": 7192 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x6beb8292", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075a" } ], "repeated": 0, "id": 7193 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7194 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}" } ], "repeated": 0, "id": 7195 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}" } ], "repeated": 0, "id": 7196 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7197 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}" } ], "repeated": 0, "id": 7198 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}" } ], "repeated": 0, "id": 7199 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7200 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}" } ], "repeated": 0, "id": 7201 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}" } ], "repeated": 0, "id": 7202 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7203 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}" } ], "repeated": 0, "id": 7204 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}" } ], "repeated": 0, "id": 7205 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6becf90f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 7206 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7207 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006b6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance" } ], "repeated": 0, "id": 7208 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance" } ], "repeated": 0, "id": 7209 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77989888", "parentcaller": "0x75d41713", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000000" }, { "name": "FileName", "value": "" } ], "repeated": 0, "id": 7210 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779a9141", "parentcaller": "0x6bed9603", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08e90000" }, { "name": "RegionSize", "value": "0x00030000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7211 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779a8de2", "parentcaller": "0x779a8da5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08e90000" }, { "name": "RegionSize", "value": "0x00030000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7212 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779a96ab", "parentcaller": "0x779a95ee", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08e90000" }, { "name": "SectionOffset", "value": "0x0606e424" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7213 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779a96ab", "parentcaller": "0x779a95ee", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ea0000" }, { "name": "SectionOffset", "value": "0x0606e424" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7214 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779a96ab", "parentcaller": "0x779a95ee", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08eb0000" }, { "name": "SectionOffset", "value": "0x0606e424" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7215 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x773d6a20", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76e60000" } ], "repeated": 0, "id": 7216 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7217 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7218 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7219 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7220 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7221 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7222 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7223 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7224 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7225 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7226 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7227 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7228 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7229 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7230 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7231 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7232 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7233 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7234 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77af003d", "parentcaller": "0x7798e8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 7235 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x6b4cef7c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "USER32" }, { "name": "ModuleHandle", "value": "0x775d0000" } ], "repeated": 0, "id": 7236 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cef92", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "GetSystemMetrics" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77604ef0" } ], "repeated": 0, "id": 7237 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cefab", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "MonitorFromWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x776096f0" } ], "repeated": 0, "id": 7238 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cefc0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "MonitorFromRect" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775f92f0" } ], "repeated": 0, "id": 7239 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cefd5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "MonitorFromPoint" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77600be0" } ], "repeated": 0, "id": 7240 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cefea", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "EnumDisplayMonitors" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77611a20" } ], "repeated": 0, "id": 7241 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cefff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "EnumDisplayDevicesW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77610150" } ], "repeated": 0, "id": 7242 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x6b4cf024", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x775d0000" }, { "name": "FunctionName", "value": "GetMonitorInfoW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77602f50" } ], "repeated": 0, "id": 7243 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x76e331ca", "parentcaller": "0x76e32e5f", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 7244 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1621a", "parentcaller": "0x779af2ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7245 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b16241", "parentcaller": "0x779af2ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" } ], "repeated": 0, "id": 7246 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7247 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe" } ], "repeated": 0, "id": 7248 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7249 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7250 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7251 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77577000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7252 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7253 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e4d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7254 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1621a", "parentcaller": "0x779ad839", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" } ], "repeated": 0, "id": 7255 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b16241", "parentcaller": "0x779ad839", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7256 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x75c05e85", "parentcaller": "0x75bff661", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49240" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 7257 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x75c05eab", "parentcaller": "0x75bff661", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49241" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 7258 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1621a", "parentcaller": "0x779ad839", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7259 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b16241", "parentcaller": "0x779ad839", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" } ], "repeated": 1, "id": 7260 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b16241", "parentcaller": "0x779af2ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7261 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77989595", "parentcaller": "0x75c040ac", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" }, { "name": "MutexName", "value": "Local\\MSCTF.Asm.MutexDefault1" } ], "repeated": 0, "id": 7262 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7263 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" }, { "name": "Milliseconds", "value": "2000" } ], "repeated": 0, "id": 7264 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798c34d", "parentcaller": "0x75c041d5", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000748" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\CTF.AsmListCache.FMPDefault1" } ], "repeated": 0, "id": 7265 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x75c041f2", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000748" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ec0000" }, { "name": "SectionOffset", "value": "0x0606dfc4" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7266 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77999145", "parentcaller": "0x75c0460a", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ec0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 7267 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x75c0461b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" } ], "repeated": 0, "id": 7268 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798dd70", "parentcaller": "0x75c04654", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 1, "id": 7269 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7270 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe" } ], "repeated": 0, "id": 7271 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x75c0940e", "parentcaller": "0x75c0aa46", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 7272 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x75c08e01", "parentcaller": "0x75c06a54", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 7273 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77989595", "parentcaller": "0x75c0924b", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" }, { "name": "MutexName", "value": "CicLoadWinStaWinSta0" } ], "repeated": 0, "id": 7274 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x75c09258", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7275 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77989595", "parentcaller": "0x75c08ed9", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" }, { "name": "MutexName", "value": "Local\\MSCTF.CtfMonitorInstMutexDefault1" } ], "repeated": 0, "id": 7276 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x75c08ee4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7277 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7278 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" } ], "repeated": 0, "id": 7279 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006ac" }, { "name": "ValueName", "value": "LaunchUserOOBE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE" } ], "repeated": 0, "id": 7280 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x7797ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ac" } ], "repeated": 0, "id": 7281 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7282 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7283 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77999924", "parentcaller": "0x76c1c2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000748" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7284 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x75c2c42c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 7285 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x75c20248", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af2470" } ], "repeated": 0, "id": 7286 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x75c2aef1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 7287 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x75befbbe", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af0700" } ], "repeated": 0, "id": 7288 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x75c1e911", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b2c3b0" } ], "repeated": 0, "id": 7289 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x75c201f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 7290 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x75be85de", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 7291 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77989b67", "parentcaller": "0x75be96fb", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000758" }, { "name": "MutexName", "value": "Local\\SM0:2088:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 7292 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x75be99e3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7293 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7294 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7295 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x75bf049e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7296 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798dd70", "parentcaller": "0x75bf046e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 1, "id": 7297 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798964f", "parentcaller": "0x75c0508d", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "Local\\1ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 7298 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x76e33224", "parentcaller": "0x76e32e5f", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 7299 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "textinputframework.dll" } ], "repeated": 0, "id": 7300 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" } ], "repeated": 0, "id": 7301 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e65c", "parentcaller": "0x77b1e1d2", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7302 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e699", "parentcaller": "0x77b1e1d2", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000075c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\TextInputFramework.dll" } ], "repeated": 0, "id": 7303 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1122c", "parentcaller": "0x77b11397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fba0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7304 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1000f", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4e000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7305 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100b7", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7306 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100e5", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7307 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7308 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7309 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77af9d5b", "parentcaller": "0x77b0b4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7310 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CoreUIComponents.dll" } ], "repeated": 0, "id": 7311 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CoreMessaging.dll" } ], "repeated": 0, "id": 7312 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6ed", "parentcaller": "0x77b1e1d2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000760" } ], "repeated": 0, "id": 7313 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6f5", "parentcaller": "0x77b1e1d2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7314 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\CoreUIComponents.dll" } ], "repeated": 0, "id": 7315 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e65c", "parentcaller": "0x77b1e3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreUIComponents.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7316 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e699", "parentcaller": "0x77b1e3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000075c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\CoreUIComponents.dll" } ], "repeated": 0, "id": 7317 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1122c", "parentcaller": "0x77b11397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f6a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0027f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7318 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1000f", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f8bb000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7319 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100b7", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7320 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100e5", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7321 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7322 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7323 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77af9d5b", "parentcaller": "0x77b0b4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7324 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CoreMessaging.dll" } ], "repeated": 0, "id": 7325 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "wintypes.dll" } ], "repeated": 2, "id": 7326 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6ed", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000760" } ], "repeated": 0, "id": 7327 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6f5", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7328 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" } ], "repeated": 0, "id": 7329 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e65c", "parentcaller": "0x77b1e3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7330 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e699", "parentcaller": "0x77b1e3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000075c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\CoreMessaging.dll" } ], "repeated": 0, "id": 7331 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1122c", "parentcaller": "0x77b11397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0009b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7332 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1000f", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f594000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7333 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100b7", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7334 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100e5", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7335 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7336 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7337 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77af9d5b", "parentcaller": "0x77b0b4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7338 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6ed", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000760" } ], "repeated": 0, "id": 7339 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6f5", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7340 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" } ], "repeated": 0, "id": 7341 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" } ], "repeated": 0, "id": 7342 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e65c", "parentcaller": "0x77b1e1d2", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7343 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e699", "parentcaller": "0x77b1e1d2", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000075c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\WinTypes.dll" } ], "repeated": 0, "id": 7344 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1122c", "parentcaller": "0x77b11397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fac0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000dc000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7345 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1000f", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb83000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7346 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100b7", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7347 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b100e5", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7348 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7349 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7350 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77af9d5b", "parentcaller": "0x77b0b4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7351 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6ed", "parentcaller": "0x77b1e1d2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000760" } ], "repeated": 0, "id": 7352 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1e6f5", "parentcaller": "0x77b1e1d2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7353 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" } ], "repeated": 1, "id": 7354 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b10d10", "parentcaller": "0x77afe4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fc4c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7355 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b10d10", "parentcaller": "0x77afe4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f576000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7356 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b10d10", "parentcaller": "0x77afe4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fb81000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7357 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b10d10", "parentcaller": "0x77afe4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f80e000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7358 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b10eea", "parentcaller": "0x77b10d32", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\x00" } ], "repeated": 0, "id": 7359 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198b1", "parentcaller": "0x74d18c82", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" } ], "repeated": 0, "id": 7360 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198f0", "parentcaller": "0x74d18c82", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7361 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7362 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x6f510000" } ], "repeated": 0, "id": 7363 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198b1", "parentcaller": "0x74d18c82", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\wintypes.dll" } ], "repeated": 0, "id": 7364 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198f0", "parentcaller": "0x74d18c82", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7365 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7366 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x6fac0000" } ], "repeated": 0, "id": 7367 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198b1", "parentcaller": "0x74d18c82", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\System32\\CoreUIComponents.dll" } ], "repeated": 0, "id": 7368 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198f0", "parentcaller": "0x74d18c82", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreUIComponents.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7369 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7370 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreUIComponents" }, { "name": "DllBase", "value": "0x6f6a0000" } ], "repeated": 0, "id": 7371 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198b1", "parentcaller": "0x74d18c82", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\SYSTEM32\\textinputframework.dll" } ], "repeated": 0, "id": 7372 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d198f0", "parentcaller": "0x74d18c82", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 7373 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 7374 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\textinputframework" }, { "name": "DllBase", "value": "0x6fba0000" } ], "repeated": 0, "id": 7375 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreMessaging" }, { "name": "BaseAddress", "value": "0x6f510000" }, { "name": "InitRoutine", "value": "0x6f570f60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 7376 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WinTypes" }, { "name": "BaseAddress", "value": "0x6fac0000" }, { "name": "InitRoutine", "value": "0x6fb38ec0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 7377 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreUIComponents" }, { "name": "BaseAddress", "value": "0x6f6a0000" }, { "name": "InitRoutine", "value": "0x6f6feba0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 7378 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextInputFramework" }, { "name": "BaseAddress", "value": "0x6fba0000" }, { "name": "InitRoutine", "value": "0x6fbe08c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 7379 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7380 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c98000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7381 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7382 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000770" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\" } ], "repeated": 0, "id": 7383 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000770" }, { "name": "ValueName", "value": "EnableAnchorContext" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext" } ], "repeated": 0, "id": 7384 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x75c21321", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" } ], "repeated": 0, "id": 7385 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 7386 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x77601426", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "USER32" }, { "name": "ModuleHandle", "value": "0x775d0000" } ], "repeated": 0, "id": 7387 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009ea000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7388 }, { "timestamp": "2026-05-28 22:53:08,575", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06709000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7389 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 7390 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00000000" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7391 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09050000" }, { "name": "RegionSize", "value": "0x00406000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7392 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09050000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7393 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09455000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7394 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747dca5a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 11, "id": 7395 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08542000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7396 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7397 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000770" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 7398 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000770" }, { "name": "ObjectAttributesName", "value": "Setup" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Setup" } ], "repeated": 0, "id": 7399 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777e26fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" } ], "repeated": 0, "id": 7400 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0854b000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7401 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08551000" }, { "name": "RegionSize", "value": "0x00015000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7402 }, { "timestamp": "2026-05-28 22:53:08,590", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08566000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7403 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\oleacc" }, { "name": "DllBase", "value": "0x69930000" } ], "repeated": 0, "id": 7404 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\oleacc.dll" }, { "name": "BaseAddress", "value": "0x69930000" } ], "repeated": 0, "id": 7405 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x779afb91", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "OLEAUT32.DLL" }, { "name": "BaseAddress", "value": "0x76e60000" } ], "repeated": 0, "id": 7406 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x69ecf33b", "parentcaller": "0x69ecf5b0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7" }, { "name": "ClsContext", "value": "0x00000015", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "6E26E776-04F0-495D-80E4-3330352E3169" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7407 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69977000" }, { "name": "ModuleName", "value": "oleacc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7408 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69977000" }, { "name": "ModuleName", "value": "oleacc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7409 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69977000" }, { "name": "ModuleName", "value": "oleacc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7410 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x69977000" }, { "name": "ModuleName", "value": "oleacc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7411 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MSAA_*FCFFFFFF00000000" }, { "name": "Atom", "value": "0x0000c043" } ], "repeated": 0, "id": 7412 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x69ecf505", "parentcaller": "0x69ed3927", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7" }, { "name": "ClsContext", "value": "0x00000015", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "6E26E776-04F0-495D-80E4-3330352E3169" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7413 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MSAA_*FCFFFFFF00000000" }, { "name": "Atom", "value": "0x0000c043" } ], "repeated": 0, "id": 7414 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09480000" }, { "name": "RegionSize", "value": "0x0040f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7415 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09480000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7416 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0988e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7417 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0856e000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7418 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7419 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000774" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 7420 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000774" }, { "name": "ObjectAttributesName", "value": "Segoe UI Light" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI Light" } ], "repeated": 0, "id": 7421 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777e26fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000774" } ], "repeated": 0, "id": 7422 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7423 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000774" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 7424 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000774" }, { "name": "ObjectAttributesName", "value": "Segoe UI" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI" } ], "repeated": 0, "id": 7425 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x777e26fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000774" } ], "repeated": 0, "id": 7426 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x69ecf505", "parentcaller": "0x69ecf636", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7" }, { "name": "ClsContext", "value": "0x00000015", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "6E26E776-04F0-495D-80E4-3330352E3169" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7427 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MSAA_*FCFFFFFF00000000" }, { "name": "Atom", "value": "0x0000c043" } ], "repeated": 0, "id": 7428 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 7429 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ed10e9", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7430 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 3, "id": 7431 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09890000" }, { "name": "RegionSize", "value": "0x00398000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7432 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09890000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7433 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c27000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7434 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 5, "id": 7435 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x76b1c5c4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 7436 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76b1c728", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 7437 }, { "timestamp": "2026-05-28 22:53:08,606", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76b1c68e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 7438 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed258e", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 11, "id": 7439 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7440 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7441 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 7442 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7443 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7444 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe0d", "parentcaller": "0x729900f3", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000068" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7445 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe1c", "parentcaller": "0x729900f3", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000006c" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7446 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe27", "parentcaller": "0x729900f3", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "4096" } ], "repeated": 0, "id": 7447 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe3b", "parentcaller": "0x729900f3", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000026" }, { "name": "uiParam", "value": "0x00000004" } ], "repeated": 0, "id": 7448 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe4d", "parentcaller": "0x729900f3", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000103e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7449 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe5f", "parentcaller": "0x729900f3", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001042" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7450 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x729efe6e", "parentcaller": "0x729900f3", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000001b" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 7451 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72b20000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7452 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x72b20000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7453 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798917f", "parentcaller": "0x76cd45c6", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" } ], "repeated": 0, "id": 7454 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76d0443f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af2470" } ], "repeated": 0, "id": 7455 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76cd6bb6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b341e0" } ], "repeated": 0, "id": 7456 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76cd457a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77af0700" } ], "repeated": 0, "id": 7457 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76d03661", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b2c3b0" } ], "repeated": 0, "id": 7458 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76d043ec", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b253f0" } ], "repeated": 0, "id": 7459 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x76cd5eee", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77ac0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77b1f560" } ], "repeated": 0, "id": 7460 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77989b67", "parentcaller": "0x76cd6c5d", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000774" }, { "name": "MutexName", "value": "Local\\SM0:2088:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 7461 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x76cd8bb8", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000774" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7462 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7463 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7464 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x76ce9b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7465 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798dd70", "parentcaller": "0x76ce9aae", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000774" } ], "repeated": 1, "id": 7466 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77989b67", "parentcaller": "0x76cd6f55", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000774" }, { "name": "MutexName", "value": "Local\\SM0:2088:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 7467 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x76cd8bb8", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000774" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7468 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7469 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 7470 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x76ce9b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7471 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798dd70", "parentcaller": "0x76ce9aae", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000774" } ], "repeated": 1, "id": 7472 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798c34d", "parentcaller": "0x76cd85a9", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000774" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "windows_shell_global_counters" } ], "repeated": 0, "id": 7473 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x76cd8457", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000774" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c30000" }, { "name": "SectionOffset", "value": "0x0606ede4" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7474 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 7475 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09480000" }, { "name": "RegionSize", "value": "0x0040f000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7476 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000077c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 7477 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000077c" }, { "name": "ValueName", "value": "TurnOffSPIAnimations" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations" } ], "repeated": 0, "id": 7478 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x76cd7bb5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7479 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7480 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003a0" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 7481 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09050000" }, { "name": "RegionSize", "value": "0x00406000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7482 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06026000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7483 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a70000" }, { "name": "RegionSize", "value": "0x0040f000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7484 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 7485 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08860000" }, { "name": "RegionSize", "value": "0x00206000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7486 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08750000" }, { "name": "RegionSize", "value": "0x00108000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7487 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00086000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7488 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08502000" }, { "name": "RegionSize", "value": "0x0003f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7489 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08562000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7490 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084e1000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7491 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066e4000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7492 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b04218", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066e4000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7493 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08200000" }, { "name": "RegionSize", "value": "0x002b1000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7494 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00348000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7495 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7496 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a07000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7497 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 7498 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a10000" }, { "name": "RegionSize", "value": "0x002f1000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7499 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7500 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08d00000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7501 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08200000" }, { "name": "RegionSize", "value": "0x0014f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7502 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0834e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7503 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c40000" }, { "name": "RegionSize", "value": "0x00bbc000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7504 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c40000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7505 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a7fb000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7506 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09890000" }, { "name": "RegionSize", "value": "0x00398000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7507 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x69d48b3d", "parentcaller": "0x69cec1d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7508 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x002b3000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7509 }, { "timestamp": "2026-05-28 22:53:08,622", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084e1000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7510 }, { "timestamp": "2026-05-28 22:53:08,637", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08562000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7511 }, { "timestamp": "2026-05-28 22:53:08,637", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7512 }, { "timestamp": "2026-05-28 22:53:08,653", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08502000" }, { "name": "RegionSize", "value": "0x0003f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7513 }, { "timestamp": "2026-05-28 22:53:08,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7514 }, { "timestamp": "2026-05-28 22:53:08,700", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08577000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7515 }, { "timestamp": "2026-05-28 22:53:08,700", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0857c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7516 }, { "timestamp": "2026-05-28 22:53:08,700", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0857f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7517 }, { "timestamp": "2026-05-28 22:53:08,700", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08584000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7518 }, { "timestamp": "2026-05-28 22:53:08,715", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7519 }, { "timestamp": "2026-05-28 22:53:08,715", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08589000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7520 }, { "timestamp": "2026-05-28 22:53:08,715", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0858e000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7521 }, { "timestamp": "2026-05-28 22:53:08,715", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08591000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7522 }, { "timestamp": "2026-05-28 22:53:08,731", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08596000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7523 }, { "timestamp": "2026-05-28 22:53:08,731", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0859b000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7524 }, { "timestamp": "2026-05-28 22:53:08,747", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7525 }, { "timestamp": "2026-05-28 22:53:08,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085a0000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7526 }, { "timestamp": "2026-05-28 22:53:08,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085a3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7527 }, { "timestamp": "2026-05-28 22:53:08,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085a8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7528 }, { "timestamp": "2026-05-28 22:53:08,762", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085ab000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7529 }, { "timestamp": "2026-05-28 22:53:08,778", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085b0000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7530 }, { "timestamp": "2026-05-28 22:53:08,778", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085b5000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7531 }, { "timestamp": "2026-05-28 22:53:08,778", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7532 }, { "timestamp": "2026-05-28 22:53:08,794", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085ba000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7533 }, { "timestamp": "2026-05-28 22:53:08,794", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085c3000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7534 }, { "timestamp": "2026-05-28 22:53:08,794", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085cc000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7535 }, { "timestamp": "2026-05-28 22:53:08,809", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085d1000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7536 }, { "timestamp": "2026-05-28 22:53:08,825", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7537 }, { "timestamp": "2026-05-28 22:53:08,825", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085da000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7538 }, { "timestamp": "2026-05-28 22:53:08,840", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085df000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7539 }, { "timestamp": "2026-05-28 22:53:08,856", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7540 }, { "timestamp": "2026-05-28 22:53:08,872", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085e4000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7541 }, { "timestamp": "2026-05-28 22:53:08,872", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085e9000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7542 }, { "timestamp": "2026-05-28 22:53:08,872", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085f2000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7543 }, { "timestamp": "2026-05-28 22:53:08,887", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085fb000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7544 }, { "timestamp": "2026-05-28 22:53:08,887", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x085fd000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7545 }, { "timestamp": "2026-05-28 22:53:08,903", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7546 }, { "timestamp": "2026-05-28 22:53:08,903", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08602000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7547 }, { "timestamp": "2026-05-28 22:53:08,903", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0860b000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7548 }, { "timestamp": "2026-05-28 22:53:08,934", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7549 }, { "timestamp": "2026-05-28 22:53:08,950", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08614000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7550 }, { "timestamp": "2026-05-28 22:53:08,965", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7551 }, { "timestamp": "2026-05-28 22:53:08,965", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08619000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7552 }, { "timestamp": "2026-05-28 22:53:08,981", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08622000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7553 }, { "timestamp": "2026-05-28 22:53:08,981", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0862b000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7554 }, { "timestamp": "2026-05-28 22:53:08,997", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7555 }, { "timestamp": "2026-05-28 22:53:09,012", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08630000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7556 }, { "timestamp": "2026-05-28 22:53:09,012", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08632000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7557 }, { "timestamp": "2026-05-28 22:53:09,028", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7558 }, { "timestamp": "2026-05-28 22:53:09,044", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0863b000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7559 }, { "timestamp": "2026-05-28 22:53:09,044", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08640000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7560 }, { "timestamp": "2026-05-28 22:53:09,075", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7561 }, { "timestamp": "2026-05-28 22:53:09,090", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08649000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7562 }, { "timestamp": "2026-05-28 22:53:09,106", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7563 }, { "timestamp": "2026-05-28 22:53:09,106", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08652000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7564 }, { "timestamp": "2026-05-28 22:53:09,122", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0865b000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7565 }, { "timestamp": "2026-05-28 22:53:09,137", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7566 }, { "timestamp": "2026-05-28 22:53:09,137", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08660000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7567 }, { "timestamp": "2026-05-28 22:53:09,169", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08665000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7568 }, { "timestamp": "2026-05-28 22:53:09,169", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0866e000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7569 }, { "timestamp": "2026-05-28 22:53:09,184", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7570 }, { "timestamp": "2026-05-28 22:53:09,200", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08673000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7571 }, { "timestamp": "2026-05-28 22:53:09,215", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7572 }, { "timestamp": "2026-05-28 22:53:09,215", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0867c000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7573 }, { "timestamp": "2026-05-28 22:53:09,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0868d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7574 }, { "timestamp": "2026-05-28 22:53:09,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08690000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7575 }, { "timestamp": "2026-05-28 22:53:09,247", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08693000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7576 }, { "timestamp": "2026-05-28 22:53:09,247", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7577 }, { "timestamp": "2026-05-28 22:53:09,278", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a4000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7578 }, { "timestamp": "2026-05-28 22:53:09,278", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7579 }, { "timestamp": "2026-05-28 22:53:09,294", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a9000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7580 }, { "timestamp": "2026-05-28 22:53:09,325", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7581 }, { "timestamp": "2026-05-28 22:53:09,325", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086b2000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7582 }, { "timestamp": "2026-05-28 22:53:09,356", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7583 }, { "timestamp": "2026-05-28 22:53:09,403", "thread_id": "6980", "caller": "0x77b0058c", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09050000" }, { "name": "RegionSize", "value": "0x00400000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7584 }, { "timestamp": "2026-05-28 22:53:09,403", "thread_id": "6980", "caller": "0x77b005eb", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09050000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7585 }, { "timestamp": "2026-05-28 22:53:09,419", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7586 }, { "timestamp": "2026-05-28 22:53:09,434", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0905a000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7587 }, { "timestamp": "2026-05-28 22:53:09,450", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0905f000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7588 }, { "timestamp": "2026-05-28 22:53:09,465", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7589 }, { "timestamp": "2026-05-28 22:53:09,465", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09068000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7590 }, { "timestamp": "2026-05-28 22:53:09,497", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7591 }, { "timestamp": "2026-05-28 22:53:09,497", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0906d000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7592 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 7593 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7594 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x01@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7595 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x01@\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7596 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7597 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7598 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7599 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00J@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7600 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "J@\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7601 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7602 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7603 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7604 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x91@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7605 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x91@\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7606 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7607 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7608 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "SetupProgress" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress" } ], "repeated": 0, "id": 7609 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7610 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7611 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7612 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xdb@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7613 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdb@\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7614 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7615 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7616 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7617 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00+A\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7618 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "+A\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7619 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7620 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7621 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "SetupPhase" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "2" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase" } ], "repeated": 0, "id": 7622 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7623 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7624 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7625 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00oA\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7626 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "oA\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7627 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7628 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7629 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "SetupSubPhase" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "24" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase" } ], "repeated": 0, "id": 7630 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7631 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7632 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7633 }, { "timestamp": "2026-05-28 22:53:09,512", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7634 }, { "timestamp": "2026-05-28 22:53:09,528", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0907e000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7635 }, { "timestamp": "2026-05-28 22:53:09,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7636 }, { "timestamp": "2026-05-28 22:53:09,590", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0908f000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7637 }, { "timestamp": "2026-05-28 22:53:09,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7638 }, { "timestamp": "2026-05-28 22:53:09,622", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090a0000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7639 }, { "timestamp": "2026-05-28 22:53:09,637", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7640 }, { "timestamp": "2026-05-28 22:53:09,653", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090a9000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7641 }, { "timestamp": "2026-05-28 22:53:09,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7642 }, { "timestamp": "2026-05-28 22:53:09,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090b2000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7643 }, { "timestamp": "2026-05-28 22:53:09,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090bb000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7644 }, { "timestamp": "2026-05-28 22:53:09,762", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7645 }, { "timestamp": "2026-05-28 22:53:09,856", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090c4000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7646 }, { "timestamp": "2026-05-28 22:53:09,872", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090cd000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7647 }, { "timestamp": "2026-05-28 22:53:09,872", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7648 }, { "timestamp": "2026-05-28 22:53:09,887", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090d6000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7649 }, { "timestamp": "2026-05-28 22:53:09,903", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7650 }, { "timestamp": "2026-05-28 22:53:09,919", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090e7000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7651 }, { "timestamp": "2026-05-28 22:53:09,934", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7652 }, { "timestamp": "2026-05-28 22:53:09,997", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090f8000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7653 }, { "timestamp": "2026-05-28 22:53:10,012", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7654 }, { "timestamp": "2026-05-28 22:53:10,075", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09109000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7655 }, { "timestamp": "2026-05-28 22:53:10,122", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7656 }, { "timestamp": "2026-05-28 22:53:10,122", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09112000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7657 }, { "timestamp": "2026-05-28 22:53:10,122", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09117000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7658 }, { "timestamp": "2026-05-28 22:53:10,153", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7659 }, { "timestamp": "2026-05-28 22:53:10,247", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0911d000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7660 }, { "timestamp": "2026-05-28 22:53:10,262", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7661 }, { "timestamp": "2026-05-28 22:53:10,325", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09126000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7662 }, { "timestamp": "2026-05-28 22:53:10,325", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7663 }, { "timestamp": "2026-05-28 22:53:10,372", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09137000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7664 }, { "timestamp": "2026-05-28 22:53:10,403", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7665 }, { "timestamp": "2026-05-28 22:53:10,419", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09140000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7666 }, { "timestamp": "2026-05-28 22:53:10,419", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09151000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7667 }, { "timestamp": "2026-05-28 22:53:10,434", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 7668 }, { "timestamp": "2026-05-28 22:53:10,434", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0915a000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7669 }, { "timestamp": "2026-05-28 22:53:10,434", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 11, "id": 7670 }, { "timestamp": "2026-05-28 22:53:10,497", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09163000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7671 }, { "timestamp": "2026-05-28 22:53:10,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7672 }, { "timestamp": "2026-05-28 22:53:10,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7673 }, { "timestamp": "2026-05-28 22:53:10,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7674 }, { "timestamp": "2026-05-28 22:53:10,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7675 }, { "timestamp": "2026-05-28 22:53:10,528", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7676 }, { "timestamp": "2026-05-28 22:53:10,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7677 }, { "timestamp": "2026-05-28 22:53:10,590", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09174000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7678 }, { "timestamp": "2026-05-28 22:53:10,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 7679 }, { "timestamp": "2026-05-28 22:53:10,731", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0917d000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7680 }, { "timestamp": "2026-05-28 22:53:10,747", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7681 }, { "timestamp": "2026-05-28 22:53:10,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09182000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7682 }, { "timestamp": "2026-05-28 22:53:10,778", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7683 }, { "timestamp": "2026-05-28 22:53:10,809", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0918b000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7684 }, { "timestamp": "2026-05-28 22:53:10,840", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7685 }, { "timestamp": "2026-05-28 22:53:10,840", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091ac000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7686 }, { "timestamp": "2026-05-28 22:53:10,872", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7687 }, { "timestamp": "2026-05-28 22:53:10,934", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091b5000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7688 }, { "timestamp": "2026-05-28 22:53:10,965", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7689 }, { "timestamp": "2026-05-28 22:53:10,981", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091be000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7690 }, { "timestamp": "2026-05-28 22:53:10,997", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7691 }, { "timestamp": "2026-05-28 22:53:11,059", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091cf000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7692 }, { "timestamp": "2026-05-28 22:53:11,090", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7693 }, { "timestamp": "2026-05-28 22:53:11,169", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091f0000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7694 }, { "timestamp": "2026-05-28 22:53:11,184", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7695 }, { "timestamp": "2026-05-28 22:53:11,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09201000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7696 }, { "timestamp": "2026-05-28 22:53:11,247", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7697 }, { "timestamp": "2026-05-28 22:53:11,247", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0920a000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7698 }, { "timestamp": "2026-05-28 22:53:11,278", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7699 }, { "timestamp": "2026-05-28 22:53:11,294", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0920f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7700 }, { "timestamp": "2026-05-28 22:53:11,309", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 7701 }, { "timestamp": "2026-05-28 22:53:11,450", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09214000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7702 }, { "timestamp": "2026-05-28 22:53:11,481", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7703 }, { "timestamp": "2026-05-28 22:53:11,528", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0921d000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7704 }, { "timestamp": "2026-05-28 22:53:11,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7705 }, { "timestamp": "2026-05-28 22:53:11,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7706 }, { "timestamp": "2026-05-28 22:53:11,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7707 }, { "timestamp": "2026-05-28 22:53:11,528", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7708 }, { "timestamp": "2026-05-28 22:53:11,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7709 }, { "timestamp": "2026-05-28 22:53:11,606", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0922e000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7710 }, { "timestamp": "2026-05-28 22:53:11,622", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7711 }, { "timestamp": "2026-05-28 22:53:11,637", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0923f000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7712 }, { "timestamp": "2026-05-28 22:53:11,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 7713 }, { "timestamp": "2026-05-28 22:53:11,856", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09260000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7714 }, { "timestamp": "2026-05-28 22:53:11,856", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09260000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7715 }, { "timestamp": "2026-05-28 22:53:11,872", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7716 }, { "timestamp": "2026-05-28 22:53:11,981", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0926b000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7717 }, { "timestamp": "2026-05-28 22:53:11,981", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 69, "id": 7718 }, { "timestamp": "2026-05-28 22:53:12,325", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0928c000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7719 }, { "timestamp": "2026-05-28 22:53:12,340", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7720 }, { "timestamp": "2026-05-28 22:53:12,340", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09295000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7721 }, { "timestamp": "2026-05-28 22:53:12,340", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0929b000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7722 }, { "timestamp": "2026-05-28 22:53:12,372", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7723 }, { "timestamp": "2026-05-28 22:53:12,387", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a0000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7724 }, { "timestamp": "2026-05-28 22:53:12,387", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a5000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7725 }, { "timestamp": "2026-05-28 22:53:12,419", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 22, "id": 7726 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7727 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7728 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7729 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7730 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7731 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7732 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7733 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7734 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7735 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 7736 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7737 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed258e", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 7738 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7739 }, { "timestamp": "2026-05-28 22:53:12,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 7740 }, { "timestamp": "2026-05-28 22:53:12,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7741 }, { "timestamp": "2026-05-28 22:53:12,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7742 }, { "timestamp": "2026-05-28 22:53:12,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7743 }, { "timestamp": "2026-05-28 22:53:12,528", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7744 }, { "timestamp": "2026-05-28 22:53:12,559", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7745 }, { "timestamp": "2026-05-28 22:53:12,606", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092c6000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7746 }, { "timestamp": "2026-05-28 22:53:12,637", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 7747 }, { "timestamp": "2026-05-28 22:53:12,762", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7748 }, { "timestamp": "2026-05-28 22:53:12,778", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d8000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7749 }, { "timestamp": "2026-05-28 22:53:12,840", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092da000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7750 }, { "timestamp": "2026-05-28 22:53:12,919", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092dc000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7751 }, { "timestamp": "2026-05-28 22:53:12,950", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7752 }, { "timestamp": "2026-05-28 22:53:12,981", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092de000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7753 }, { "timestamp": "2026-05-28 22:53:12,981", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 7754 }, { "timestamp": "2026-05-28 22:53:13,090", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092e1000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7755 }, { "timestamp": "2026-05-28 22:53:13,122", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7756 }, { "timestamp": "2026-05-28 22:53:13,169", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092e4000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7757 }, { "timestamp": "2026-05-28 22:53:13,184", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7758 }, { "timestamp": "2026-05-28 22:53:13,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092e6000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7759 }, { "timestamp": "2026-05-28 22:53:13,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092e9000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7760 }, { "timestamp": "2026-05-28 22:53:13,262", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7761 }, { "timestamp": "2026-05-28 22:53:13,278", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092fa000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7762 }, { "timestamp": "2026-05-28 22:53:13,294", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0931b000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7763 }, { "timestamp": "2026-05-28 22:53:13,294", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 7764 }, { "timestamp": "2026-05-28 22:53:13,465", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0932c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7765 }, { "timestamp": "2026-05-28 22:53:13,481", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7766 }, { "timestamp": "2026-05-28 22:53:13,481", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0932f000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7767 }, { "timestamp": "2026-05-28 22:53:13,512", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09350000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7768 }, { "timestamp": "2026-05-28 22:53:13,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7769 }, { "timestamp": "2026-05-28 22:53:13,544", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7770 }, { "timestamp": "2026-05-28 22:53:13,544", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7771 }, { "timestamp": "2026-05-28 22:53:13,544", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7772 }, { "timestamp": "2026-05-28 22:53:13,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 7773 }, { "timestamp": "2026-05-28 22:53:13,544", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7774 }, { "timestamp": "2026-05-28 22:53:13,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 11, "id": 7775 }, { "timestamp": "2026-05-28 22:53:13,575", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09355000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7776 }, { "timestamp": "2026-05-28 22:53:13,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 7777 }, { "timestamp": "2026-05-28 22:53:13,762", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09358000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7778 }, { "timestamp": "2026-05-28 22:53:13,778", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 7779 }, { "timestamp": "2026-05-28 22:53:13,919", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0935d000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7780 }, { "timestamp": "2026-05-28 22:53:13,934", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7781 }, { "timestamp": "2026-05-28 22:53:13,950", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09362000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7782 }, { "timestamp": "2026-05-28 22:53:13,965", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7783 }, { "timestamp": "2026-05-28 22:53:14,044", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09364000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7784 }, { "timestamp": "2026-05-28 22:53:14,044", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09369000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7785 }, { "timestamp": "2026-05-28 22:53:14,059", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7786 }, { "timestamp": "2026-05-28 22:53:14,278", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0938a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7787 }, { "timestamp": "2026-05-28 22:53:14,294", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7788 }, { "timestamp": "2026-05-28 22:53:14,340", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0938c000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7789 }, { "timestamp": "2026-05-28 22:53:14,356", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7790 }, { "timestamp": "2026-05-28 22:53:14,403", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09391000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7791 }, { "timestamp": "2026-05-28 22:53:14,419", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 29, "id": 7792 }, { "timestamp": "2026-05-28 22:53:14,559", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7793 }, { "timestamp": "2026-05-28 22:53:14,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7794 }, { "timestamp": "2026-05-28 22:53:14,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7795 }, { "timestamp": "2026-05-28 22:53:14,559", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7796 }, { "timestamp": "2026-05-28 22:53:14,559", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 11, "id": 7797 }, { "timestamp": "2026-05-28 22:53:14,622", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093a2000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7798 }, { "timestamp": "2026-05-28 22:53:14,637", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 55, "id": 7799 }, { "timestamp": "2026-05-28 22:53:14,872", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093ab000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7800 }, { "timestamp": "2026-05-28 22:53:14,903", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 69, "id": 7801 }, { "timestamp": "2026-05-28 22:53:15,215", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093b0000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7802 }, { "timestamp": "2026-05-28 22:53:15,215", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093b9000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7803 }, { "timestamp": "2026-05-28 22:53:15,262", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7804 }, { "timestamp": "2026-05-28 22:53:15,309", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093da000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7805 }, { "timestamp": "2026-05-28 22:53:15,356", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7806 }, { "timestamp": "2026-05-28 22:53:15,372", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093fb000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7807 }, { "timestamp": "2026-05-28 22:53:15,387", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7808 }, { "timestamp": "2026-05-28 22:53:15,403", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0940c000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7809 }, { "timestamp": "2026-05-28 22:53:15,419", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 7810 }, { "timestamp": "2026-05-28 22:53:15,528", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0941d000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7811 }, { "timestamp": "2026-05-28 22:53:15,559", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7812 }, { "timestamp": "2026-05-28 22:53:15,590", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7813 }, { "timestamp": "2026-05-28 22:53:15,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7814 }, { "timestamp": "2026-05-28 22:53:15,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7815 }, { "timestamp": "2026-05-28 22:53:15,590", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7816 }, { "timestamp": "2026-05-28 22:53:15,590", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09422000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7817 }, { "timestamp": "2026-05-28 22:53:15,590", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7818 }, { "timestamp": "2026-05-28 22:53:15,825", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09424000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7819 }, { "timestamp": "2026-05-28 22:53:15,840", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7820 }, { "timestamp": "2026-05-28 22:53:15,872", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09427000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7821 }, { "timestamp": "2026-05-28 22:53:15,872", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0942d000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7822 }, { "timestamp": "2026-05-28 22:53:15,903", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7823 }, { "timestamp": "2026-05-28 22:53:15,903", "thread_id": "6980", "caller": "0x77b0058c", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a800000" }, { "name": "RegionSize", "value": "0x00800000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7824 }, { "timestamp": "2026-05-28 22:53:15,903", "thread_id": "6980", "caller": "0x77b005eb", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a800000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7825 }, { "timestamp": "2026-05-28 22:53:15,950", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 7826 }, { "timestamp": "2026-05-28 22:53:16,247", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09432000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7827 }, { "timestamp": "2026-05-28 22:53:16,262", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7828 }, { "timestamp": "2026-05-28 22:53:16,465", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09437000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7829 }, { "timestamp": "2026-05-28 22:53:16,497", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7830 }, { "timestamp": "2026-05-28 22:53:16,528", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a822000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7831 }, { "timestamp": "2026-05-28 22:53:16,528", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a82a000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7832 }, { "timestamp": "2026-05-28 22:53:16,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7833 }, { "timestamp": "2026-05-28 22:53:16,590", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7834 }, { "timestamp": "2026-05-28 22:53:16,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7835 }, { "timestamp": "2026-05-28 22:53:16,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7836 }, { "timestamp": "2026-05-28 22:53:16,590", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7837 }, { "timestamp": "2026-05-28 22:53:16,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7838 }, { "timestamp": "2026-05-28 22:53:16,825", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09448000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7839 }, { "timestamp": "2026-05-28 22:53:16,856", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7840 }, { "timestamp": "2026-05-28 22:53:17,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a82d000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7841 }, { "timestamp": "2026-05-28 22:53:17,231", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a86c000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7842 }, { "timestamp": "2026-05-28 22:53:17,247", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7843 }, { "timestamp": "2026-05-28 22:53:17,262", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a870000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7844 }, { "timestamp": "2026-05-28 22:53:17,278", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7845 }, { "timestamp": "2026-05-28 22:53:17,278", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a879000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7846 }, { "timestamp": "2026-05-28 22:53:17,309", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 7847 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7848 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7849 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7850 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7851 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7852 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7853 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7854 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7855 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7856 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x0000077c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7857 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "2" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7858 }, { "timestamp": "2026-05-28 22:53:17,512", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 7859 }, { "timestamp": "2026-05-28 22:53:17,528", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7860 }, { "timestamp": "2026-05-28 22:53:17,606", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7861 }, { "timestamp": "2026-05-28 22:53:17,606", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7862 }, { "timestamp": "2026-05-28 22:53:17,606", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7863 }, { "timestamp": "2026-05-28 22:53:17,622", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7864 }, { "timestamp": "2026-05-28 22:53:17,637", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 7865 }, { "timestamp": "2026-05-28 22:53:17,825", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a882000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7866 }, { "timestamp": "2026-05-28 22:53:17,872", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7867 }, { "timestamp": "2026-05-28 22:53:17,887", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a8a3000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7868 }, { "timestamp": "2026-05-28 22:53:17,903", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7869 }, { "timestamp": "2026-05-28 22:53:17,934", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a8ac000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7870 }, { "timestamp": "2026-05-28 22:53:17,950", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7871 }, { "timestamp": "2026-05-28 22:53:18,028", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a8bd000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7872 }, { "timestamp": "2026-05-28 22:53:18,028", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a8be000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7873 }, { "timestamp": "2026-05-28 22:53:18,075", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7874 }, { "timestamp": "2026-05-28 22:53:18,090", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a8c8000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7875 }, { "timestamp": "2026-05-28 22:53:18,106", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7876 }, { "timestamp": "2026-05-28 22:53:18,200", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a8d9000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7877 }, { "timestamp": "2026-05-28 22:53:18,200", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a912000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7878 }, { "timestamp": "2026-05-28 22:53:18,215", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 83, "id": 7879 }, { "timestamp": "2026-05-28 22:53:18,653", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7880 }, { "timestamp": "2026-05-28 22:53:18,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7881 }, { "timestamp": "2026-05-28 22:53:18,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7882 }, { "timestamp": "2026-05-28 22:53:18,653", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7883 }, { "timestamp": "2026-05-28 22:53:18,653", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7884 }, { "timestamp": "2026-05-28 22:53:18,887", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a91c000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7885 }, { "timestamp": "2026-05-28 22:53:18,919", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 7886 }, { "timestamp": "2026-05-28 22:53:18,981", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a925000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7887 }, { "timestamp": "2026-05-28 22:53:19,012", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 125, "id": 7888 }, { "timestamp": "2026-05-28 22:53:19,653", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7889 }, { "timestamp": "2026-05-28 22:53:19,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7890 }, { "timestamp": "2026-05-28 22:53:19,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7891 }, { "timestamp": "2026-05-28 22:53:19,653", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7892 }, { "timestamp": "2026-05-28 22:53:19,669", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a946000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7893 }, { "timestamp": "2026-05-28 22:53:19,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 7894 }, { "timestamp": "2026-05-28 22:53:19,700", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a94f000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7895 }, { "timestamp": "2026-05-28 22:53:19,715", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 160, "id": 7896 }, { "timestamp": "2026-05-28 22:53:20,512", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a958000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7897 }, { "timestamp": "2026-05-28 22:53:20,528", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7898 }, { "timestamp": "2026-05-28 22:53:20,559", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a961000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7899 }, { "timestamp": "2026-05-28 22:53:20,559", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a99f000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7900 }, { "timestamp": "2026-05-28 22:53:20,590", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 21, "id": 7901 }, { "timestamp": "2026-05-28 22:53:20,700", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7902 }, { "timestamp": "2026-05-28 22:53:20,700", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 7903 }, { "timestamp": "2026-05-28 22:53:20,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7904 }, { "timestamp": "2026-05-28 22:53:20,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7905 }, { "timestamp": "2026-05-28 22:53:20,700", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7906 }, { "timestamp": "2026-05-28 22:53:20,700", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 11, "id": 7907 }, { "timestamp": "2026-05-28 22:53:20,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9a4000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7908 }, { "timestamp": "2026-05-28 22:53:20,762", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 7909 }, { "timestamp": "2026-05-28 22:53:21,059", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9c5000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7910 }, { "timestamp": "2026-05-28 22:53:21,075", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 7911 }, { "timestamp": "2026-05-28 22:53:21,356", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9e6000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7912 }, { "timestamp": "2026-05-28 22:53:21,356", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9eb000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7913 }, { "timestamp": "2026-05-28 22:53:21,387", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 7914 }, { "timestamp": "2026-05-28 22:53:21,559", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9f1000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7915 }, { "timestamp": "2026-05-28 22:53:21,622", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9fa000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7916 }, { "timestamp": "2026-05-28 22:53:21,700", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7917 }, { "timestamp": "2026-05-28 22:53:21,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7918 }, { "timestamp": "2026-05-28 22:53:21,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7919 }, { "timestamp": "2026-05-28 22:53:21,700", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7920 }, { "timestamp": "2026-05-28 22:53:21,747", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 97, "id": 7921 }, { "timestamp": "2026-05-28 22:53:22,215", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa03000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7922 }, { "timestamp": "2026-05-28 22:53:22,215", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa3d000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7923 }, { "timestamp": "2026-05-28 22:53:22,247", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 7924 }, { "timestamp": "2026-05-28 22:53:22,294", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa46000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7925 }, { "timestamp": "2026-05-28 22:53:22,309", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 7926 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7927 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7928 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7929 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7930 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7931 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7932 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7933 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7934 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7935 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000006bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 7936 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "3" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 7937 }, { "timestamp": "2026-05-28 22:53:22,512", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006bc" } ], "repeated": 0, "id": 7938 }, { "timestamp": "2026-05-28 22:53:22,528", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 50, "id": 7939 }, { "timestamp": "2026-05-28 22:53:22,747", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7940 }, { "timestamp": "2026-05-28 22:53:22,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7941 }, { "timestamp": "2026-05-28 22:53:22,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 7942 }, { "timestamp": "2026-05-28 22:53:22,747", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 7943 }, { "timestamp": "2026-05-28 22:53:22,747", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 67, "id": 7944 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00348000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7945 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aeddce", "parentcaller": "0x77b02691", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a86c000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7946 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aeddce", "parentcaller": "0x77b02702", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa3d000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7947 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a82c000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7948 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9fd000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7949 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0932f000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7950 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06709000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7951 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066f8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7952 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093b8000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7953 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09187000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7954 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09262000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7955 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090ce000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7956 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09123000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7957 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08679000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7958 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09079000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 7959 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c40000" }, { "name": "RegionSize", "value": "0x00bbc000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7960 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08200000" }, { "name": "RegionSize", "value": "0x0014f000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7961 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a10000" }, { "name": "RegionSize", "value": "0x002f1000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 7962 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7963 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7964 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xb7A\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7965 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb7A\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7966 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7967 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7968 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7969 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x13B\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7970 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x13B\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7971 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7972 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x7798c899", "parentcaller": "0x69d2aca9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" } ], "repeated": 0, "id": 7973 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x699fcce4", "parentcaller": "0x699ff20b", "category": "network", "api": "WinHttpOpen", "status": true, "return": "0x009d6cb0", "arguments": [ { "name": "UserAgent", "value": "Windows Dlp Manager" }, { "name": "ProxyName", "value": "" }, { "name": "ProxyBypass", "value": "" }, { "name": "AccessType", "value": "0x00000000" }, { "name": "Flags", "value": "0x00000000" } ], "repeated": 0, "id": 7974 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7975 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7976 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xe0B\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7977 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe0B\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7978 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7979 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x7798c899", "parentcaller": "0x69a0935c", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther" } ], "repeated": 0, "id": 7980 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7981 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7982 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09079000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7983 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xd3C\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7984 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd3C\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7985 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7986 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6980", "caller": "0x699fd7fc", "parentcaller": "0x699fdea2", "category": "network", "api": "WinHttpOpen", "status": true, "return": "0x009d6f18", "arguments": [ { "name": "UserAgent", "value": "Windows Dlp Manager" }, { "name": "ProxyName", "value": "" }, { "name": "ProxyBypass", "value": "" }, { "name": "AccessType", "value": "0x00000001" }, { "name": "Flags", "value": "0x00000000" } ], "repeated": 0, "id": 7987 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 7988 }, { "timestamp": "2026-05-28 22:53:23,044", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7989 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 4, "id": 7990 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7991 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6888" } ], "repeated": 0, "id": 7992 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fd87f", "parentcaller": "0x699fdea2", "category": "network", "api": "WinHttpGetIEProxyConfigForCurrentUser", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 7993 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7994 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 7995 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x008D\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7996 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "8D\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7997 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 7998 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7999 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8000 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x99D\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8001 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x99D\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8002 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8003 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x7798ac59", "parentcaller": "0x7279cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8004 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8005 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8006 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fd9a7", "parentcaller": "0x699fdea2", "category": "network", "api": "WinHttpGetProxyForUrl", "status": false, "return": "0x00000000", "arguments": [ { "name": "SessionHandle", "value": "0x009d6cb0" }, { "name": "Url", "value": "https://download.microsoft.com/download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf" } ], "repeated": 0, "id": 8007 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8008 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8009 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00A\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8010 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "A\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8011 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "Buffer", "value": "\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6888" } ], "repeated": 0, "id": 8037 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 200 OK\r\nContent-Length: 204389\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0x4DDA95C546645F2B8EC20AF3698B217910E4FEC21EC1745B5299F496641250E9\"\r\nLast-Modified: Mon, 27 Jan 2025 16:03:46 GMT\r\nX-Ms-ApiVersio" }, { "name": "SequenceNumber", "value": "6" }, { "name": "BufferSize", "value": "561" } ], "repeated": 0, "id": 8038 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8039 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fdcd2", "parentcaller": "0x699fdea2", "category": "network", "api": "WinHttpSendRequest", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x0667b340" }, { "name": "Headers", "value": "" }, { "name": "Optional", "value": "" } ], "repeated": 0, "id": 8040 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fdd06", "parentcaller": "0x699fdea2", "category": "network", "api": "WinHttpReceiveResponse", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x0667b340" } ], "repeated": 1, "id": 8041 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8042 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8043 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00pE\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8044 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "pE\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8045 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8046 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fdf02", "parentcaller": "0x699fe4eb", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x0667b340" } ], "repeated": 0, "id": 8047 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8048 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8049 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xdfE\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8050 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdfE\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8051 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8052 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8053 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8054 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00?F\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8055 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "?F\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8056 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8057 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fdabb", "parentcaller": "0x699fe7e6", "category": "network", "api": "WinHttpConnect", "status": true, "return": "0x009a0768", "arguments": [ { "name": "SessionHandle", "value": "0x009d6f18" }, { "name": "ServerName", "value": "download.microsoft.com" }, { "name": "ServerPort", "value": "443" } ], "repeated": 0, "id": 8058 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fdb05", "parentcaller": "0x699fe7e6", "category": "network", "api": "WinHttpOpenRequest", "status": true, "return": "0x0944ec48", "arguments": [ { "name": "InternetHandle", "value": "0x009a0768" }, { "name": "Verb", "value": "GET" }, { "name": "ObjectName", "value": "/download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf" }, { "name": "Version", "value": "" }, { "name": "Referrer", "value": "" }, { "name": "Flags", "value": "0x00800000" } ], "repeated": 0, "id": 8059 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8060 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8061 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xa4F\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8062 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa4F\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8063 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8064 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6980", "caller": "0x699fdc9b", "parentcaller": "0x699fe7e6", "category": "network", "api": "WinHttpSetTimeouts", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x0944ec48" }, { "name": "ResolveTimeout", "value": "120000" }, { "name": "ConnectTimeout", "value": "120000" }, { "name": "SendTimeout", "value": "120000" }, { "name": "ReceiveTimeout", "value": "120000" } ], "repeated": 0, "id": 8065 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8066 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8067 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x7798ac59", "parentcaller": "0x7279cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8068 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000077c" } ], "repeated": 0, "id": 8069 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000788" } ], "repeated": 0, "id": 8070 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727e5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a8" } ], "repeated": 0, "id": 8071 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727a2629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8072 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727e50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8073 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8074 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x69bb46bc", "parentcaller": "0x69bb463b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8075 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x6d196967", "parentcaller": "0x6d194f89", "category": "network", "api": "SslEncryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "GET /download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-204388\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n" }, { "name": "SequenceNumber", "value": "4" }, { "name": "BufferSize", "value": "209" } ], "repeated": 0, "id": 8076 }, { "timestamp": "2026-05-28 22:53:23,059", "thread_id": "6948", "caller": "0x69bab419", "parentcaller": "0x69baae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1748" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x00\\xe9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04Ez\\xb9\\xdc\\x88\\xc3{\\xe1\\xbby\\xd1\\xc9kO\\xe6\\x10+{f\\x18\\xb7Ig&\\x02Q\\xe7\\xb2\\xf6,\\x01\\xd2\\x04\\x1c@8\\x11i\\xd6\\x0c\\x8a\\xfe\\xdf+\\xd7\\x80\tg\\x8df\\xaaS\\xdcJ\\xd6\\xc1\\xff\\x02Z\\xa5\\x87\\6\\xab\\x1d\\x05mK\\x00<\\x0c\\xfbl\\xa2skL\\x17>U\\xfa\\x16\\xa46\\x85\\x8e\\xb6\\x9c\\xacJ\\x8e\\xf5\\xe6c\\xc2\\xe7\\x96\\xfe\\xd1{\\xd7\\xaf\\x92\\x8fFp\\x16\\xa2\\xe6t\\xa3%\\xb2\\xd4\\xf5\\xa1\\x8b\\x93\\xdcEh\\x80\\x87\\x10\\xb6\\x15\\xf4\\xcev\\x9a'\\xec\\x83\\x0f\\xb3\\xecE\\xeb\\xa9k]A\\xa6\\x9d/7\\x0e\\xed\\xe3\\xc3]\\x00k\\xd3O\\x08\\xb64\\xcbd\\xec\\x90\\x0f\\xeb\\xa4\\xd0\\x9aM\\x19\\x8d\\xeeV)Q\\x96\\x13I\\xc5\\xef\\xe9g\\xb2J\\xf2\t\\x1e<\\xfe\\x8b\\x7f]\\xb4\\xcc\\x86p\\xcev}z\\x01N\\x84m`\\xc4/J\\xf4\\xd5\\x07S\\xcc0E\\xa7\\xc7\\xef%W\\xf6\\x9fj\\xb3Z\\x91" } ], "repeated": 0, "id": 8077 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8078 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "HTTP/1.1 206 Partial Content\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0x4DDA95C546645F2B8EC20AF3698B217910E4FEC21EC1745B5299F496641250E9\"\r\nLast-Modified: Mon, 27 Jan 2025 16:03:46 GMT\r\nX-Ms-ApiVersion: Distribu" }, { "name": "SequenceNumber", "value": "7" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8079 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x699fdcd2", "parentcaller": "0x699fe7e6", "category": "network", "api": "WinHttpSendRequest", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x0944ec48" }, { "name": "Headers", "value": "" }, { "name": "Optional", "value": "" } ], "repeated": 0, "id": 8080 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x699fdd06", "parentcaller": "0x699fe7e6", "category": "network", "api": "WinHttpReceiveResponse", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x0944ec48" } ], "repeated": 1, "id": 8081 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8082 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8083 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x11G\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8084 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x11G\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8085 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8086 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8087 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x779ac253", "parentcaller": "0x699fe892", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x1e\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 8088 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x779749b2", "parentcaller": "0x699fe8c7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "e\\x1e\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8089 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x779749d7", "parentcaller": "0x699fe8c7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "e\\x1e\\x03\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8090 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8091 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8092 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8093 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff40\\deff0\\stshfdbch11\\stshfloch0\\stshfhich0\\stshfbi0\\deflang1033\\deflangfe1033\\themelang1033\\themelangfe2052\\themelangcs1025{\\fonttbl{\\f0\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Ro" }, { "name": "Length", "value": "2895" } ], "repeated": 0, "id": 8094 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8095 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8096 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8097 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8098 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "ma Tur;}{\\f449\\fbidi \\fswiss\\fcharset177\\fprq2 Tahoma (Hebrew);}\r\n{\\f450\\fbidi \\fswiss\\fcharset178\\fprq2 Tahoma (Arabic);}{\\f451\\fbidi \\fswiss\\fcharset186\\fprq2 Tahoma Baltic;}{\\f452\\fbidi \\fswiss\\fcharset163\\fprq2 Tahoma (Vietnamese);}{\\f453\\fbidi \\fswiss" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8099 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8100 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8101 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8102 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8103 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8104 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8105 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "0\\itap0 \\rtlch\\fcs1 \\af0\\afs22\\alang1025 \\ltrch\\fcs0 \\fs22\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext11 \\ssemihidden \\sunhideused Normal Table;}{\\*\r\n\\cs15 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\" }, { "name": "Length", "value": "4685" } ], "repeated": 0, "id": 8106 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8107 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8108 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6216", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8109 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6952", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "af40\\afs19\\alang1025 \\ltrch\\fcs0 \r\n\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext36 Bullet 4;}{\\s37\\ql \\fi-357\\li1792\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1795\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls" }, { "name": "SequenceNumber", "value": "8" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8110 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8111 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8112 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "af40\\afs19\\alang1025 \\ltrch\\fcs0 \r\n\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext36 Bullet 4;}{\\s37\\ql \\fi-357\\li1792\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1795\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8113 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8114 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8115 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8116 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8117 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8118 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": " \\additive \\rtlch\\fcs1 \\af40\\afs20 \\ltrch\\fcs0 \\f40\\fs20 \r\n\\sbasedon10 \\slink68 \\slocked \\ssemihidden Comment Text Char;}{\\*\\cs70 \\additive \\rtlch\\fcs1 \\af0\\afs16 \\ltrch\\fcs0 \\fs16 \\sbasedon10 \\ssemihidden annotation reference;}{\\s71\\ql \\li0\\ri0\\sa160\\sl-2" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8119 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8120 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8121 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8122 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6948", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": " \\sqformat \\spriority34 List Paragraph;}{\r\n\\s114\\ql \\li0\\ri0\\sb100\\sa100\\sbauto1\\saauto1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs24\\alang1025 \\ltrch\\fcs0 \\b\\fs24\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch" }, { "name": "SequenceNumber", "value": "9" }, { "name": "BufferSize", "value": "3257" } ], "repeated": 0, "id": 8123 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6948", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8124 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8125 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8126 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": " \\sqformat \\spriority34 List Paragraph;}{\r\n\\s114\\ql \\li0\\ri0\\sb100\\sa100\\sbauto1\\saauto1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs24\\alang1025 \\ltrch\\fcs0 \\b\\fs24\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch" }, { "name": "Length", "value": "3257" } ], "repeated": 0, "id": 8127 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8128 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8129 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8130 }, { "timestamp": "2026-05-28 22:53:23,075", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066f8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8131 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 8132 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 8133 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8134 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8135 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6888" } ], "repeated": 0, "id": 8136 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8137 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "ive\\levelspace0\\levelindent0\r\n{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\leve" }, { "name": "SequenceNumber", "value": "10" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8138 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8139 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8140 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "ive\\levelspace0\\levelindent0\r\n{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\leve" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8141 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8142 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\r\n\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480" }, { "name": "SequenceNumber", "value": "11" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8143 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8144 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8145 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8146 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8147 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8148 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8149 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "lnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \r\n\\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\l" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8150 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8151 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8152 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8153 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\r\n\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8154 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "in1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\r\n\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\le" }, { "name": "SequenceNumber", "value": "12" }, { "name": "BufferSize", "value": "7952" } ], "repeated": 0, "id": 8155 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8156 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8157 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8158 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8159 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "res0 \\s4\\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc1\\levelnfcn1\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\r\n\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8160 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8161 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "s0 \\fi-360\\li5760\\lin5760 }\r\n{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\li" }, { "name": "SequenceNumber", "value": "13" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8162 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8163 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8164 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8165 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8166 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "in1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\r\n\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\le" }, { "name": "Length", "value": "7952" } ], "repeated": 0, "id": 8167 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8168 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8169 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8170 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8171 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "s0 \\fi-360\\li5760\\lin5760 }\r\n{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\li" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8172 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8173 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\r\n\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx" }, { "name": "SequenceNumber", "value": "14" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8174 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8175 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8176 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8177 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8178 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "ve\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers\r\n;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8179 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8180 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8181 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8182 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8183 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\r\n\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8184 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "istid760681750\\listoverridecount0\\ls29}\r\n{\\listoverride\\listid2091727482\\listoverridecount0\\ls30}{\\listoverride\\listid1182742101\\listoverridecount0\\ls31}{\\listoverride\\listid14618468\\listoverridecount0\\ls32}{\\listoverride\\listid14618468\\listoverridecount0\\" }, { "name": "SequenceNumber", "value": "15" }, { "name": "BufferSize", "value": "7952" } ], "repeated": 0, "id": 8185 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8186 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8187 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8188 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8189 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "rid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\r\n\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid1637229796\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s33\\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8190 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8191 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "{\\sp{\\sn fFilled}{\\sv 1}}{\\sp{\\sn fLine}{\\sv 0}}{\\sp{\\sn alignHR}{\\sv 1}}{\\sp{\\sn dxHeightHR}{\\sv 30}}{\\sp{\\sn fStandardHR}{\\sv 1}}{\\sp{\\sn fHorizRule}{\\sv 1}}{\\sp{\\sn fLayoutInCell}{\\sv 1}}}\r\n\\picscalex1\\picscaley1\\piccropl0\\piccropr0\\piccropt0\\piccropb0\\" }, { "name": "SequenceNumber", "value": "16" }, { "name": "BufferSize", "value": "12216" } ], "repeated": 0, "id": 8192 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8193 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8194 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8195 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8196 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "istid760681750\\listoverridecount0\\ls29}\r\n{\\listoverride\\listid2091727482\\listoverridecount0\\ls30}{\\listoverride\\listid1182742101\\listoverridecount0\\ls31}{\\listoverride\\listid14618468\\listoverridecount0\\ls32}{\\listoverride\\listid14618468\\listoverridecount0\\" }, { "name": "Length", "value": "7952" } ], "repeated": 0, "id": 8197 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8198 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8199 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8200 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8201 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "{\\sp{\\sn fFilled}{\\sv 1}}{\\sp{\\sn fLine}{\\sv 0}}{\\sp{\\sn alignHR}{\\sv 1}}{\\sp{\\sn dxHeightHR}{\\sv 30}}{\\sp{\\sn fStandardHR}{\\sv 1}}{\\sp{\\sn fHorizRule}{\\sv 1}}{\\sp{\\sn fLayoutInCell}{\\sv 1}}}\r\n\\picscalex1\\picscaley1\\piccropl0\\piccropr0\\piccropt0\\piccropb0\\" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8202 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "f11\\loch\\f40 The software may include third party applications that Microsoft, not the third party, licenses to you under this agr\\hich\\af40\\dbch\\af11\\loch\\f40 eement. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \r\n\\insrsid7406168 \\hich\\af40\\dbch\\af11\\loch\\f40 Any inc" }, { "name": "SequenceNumber", "value": "17" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8203 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8204 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8205 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 1, "id": 8206 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8207 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "9\\langfe1033\\langnp9\\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 RIGHTS BELOW.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4067708\\charrsid4067708 \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4067708 \\hich\\af40\\dbch" }, { "name": "Length", "value": "4024" } ], "repeated": 0, "id": 8208 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8209 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8210 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8211 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8212 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "f11\\loch\\f40 The software may include third party applications that Microsoft, not the third party, licenses to you under this agr\\hich\\af40\\dbch\\af11\\loch\\f40 eement. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \r\n\\insrsid7406168 \\hich\\af40\\dbch\\af11\\loch\\f40 Any inc" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8213 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8214 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "tlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 BINDING ARBITRATION AND CLASS ACTION WAIVER}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 .}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\in" }, { "name": "SequenceNumber", "value": "18" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8215 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8216 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 8217 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8218 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8219 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "6888" } ], "repeated": 0, "id": 8220 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8221 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6948", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8222 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8223 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 1, "id": 8224 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8225 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "eer, decompile or disassemble the software;}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid15818407\\charrsid12455646 \r\n\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid16591162\\charrsid12455646 \\hich\\af40\\dbch\\" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8226 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8227 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8228 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 1, "id": 8229 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8230 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "tlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 BINDING ARBITRATION AND CLASS ACTION WAIVER}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 .}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\in" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8231 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "ctual guarantee in relation \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 to the licensed software.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \r\n\\par \\hich\\af40\\dbch\\af11\\loch\\f40 (ii)\\tab Limitation of Liability.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b0\\i" }, { "name": "SequenceNumber", "value": "19" }, { "name": "BufferSize", "value": "7952" } ], "repeated": 0, "id": 8232 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8233 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 0, "id": 8234 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8235 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "h\\af40\\dbch\\af11\\loch\\f40 , except that the }{\r\n\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 FAA }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 governs everything related to arb" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8236 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8237 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "d6596cbcdd8eb28e7c365ecc4ec1ff1460f53fe813d3cc7f5b7f020000ffff0300504b030414000600080000002100a5d6\r\na7e7c0000000360100000b0000005f72656c732f2e72656c73848fcf6ac3300c87ef85bd83d17d51d2c31825762fa590432fa37d00e1287f68221bdb1bebdb4f\r\nc7060abb0884a4eff7a93dfeae" }, { "name": "SequenceNumber", "value": "20" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8238 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8239 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8240 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 1, "id": 8241 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8242 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "ctual guarantee in relation \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 to the licensed software.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \r\n\\par \\hich\\af40\\dbch\\af11\\loch\\f40 (ii)\\tab Limitation of Liability.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b0\\i" }, { "name": "Length", "value": "7952" } ], "repeated": 0, "id": 8243 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8244 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8245 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 1, "id": 8246 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8247 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "d6596cbcdd8eb28e7c365ecc4ec1ff1460f53fe813d3cc7f5b7f020000ffff0300504b030414000600080000002100a5d6\r\na7e7c0000000360100000b0000005f72656c732f2e72656c73848fcf6ac3300c87ef85bd83d17d51d2c31825762fa590432fa37d00e1287f68221bdb1bebdb4f\r\nc7060abb0884a4eff7a93dfeae" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8248 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8249 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "0 \\lsdlocked0 Intense Quote;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 1;\r\n\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 1;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 1;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 1;\\lsdpriority70 \\lsdlocked0" }, { "name": "SequenceNumber", "value": "21" }, { "name": "BufferSize", "value": "16384" } ], "repeated": 0, "id": 8250 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8251 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8252 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 1, "id": 8253 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8254 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "d1 \\lsdlocked0 footer;\r\n\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index heading;\\lsdsemihidden1 \\lsdunhideused1 \\lsdqformat1 \\lsdpriority35 \\lsdlocked0 caption;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 table of figures;\r\n\\lsdsemihidden1 \\lsdunhideused1" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8255 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8256 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8257 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 1, "id": 8258 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8259 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "0 \\lsdlocked0 Intense Quote;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 1;\r\n\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 1;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 1;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 1;\\lsdpriority70 \\lsdlocked0" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8260 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x6d196159", "parentcaller": "0x6d19600a", "category": "network", "api": "SslDecryptPacket", "status": true, "return": "0x00000000", "arguments": [ { "name": "Buffer", "value": "000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d3822207374616e64616c6f6e653d22796573223f3e3c53657373696f6e20786d6c6e733d22687474703a\r\n2f2f736368656d61732e627573696e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f3230" }, { "name": "SequenceNumber", "value": "22" }, { "name": "BufferSize", "value": "1832" } ], "repeated": 0, "id": 8261 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8262 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8263 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 1, "id": 8264 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8265 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "e 6 Colorful Accent 2;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 2;\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 3;\r\n\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 3;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 3;\\lsdpriority49 \\lsdlo" }, { "name": "Length", "value": "8192" } ], "repeated": 0, "id": 8266 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69bace77", "parentcaller": "0x69bac83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 8267 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x72796c2c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8268 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8269 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000794" } ], "repeated": 1, "id": 8270 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000790" } ], "repeated": 0, "id": 8271 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798944c", "parentcaller": "0x699fea34", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d3822207374616e64616c6f6e653d22796573223f3e3c53657373696f6e20786d6c6e733d22687474703a\r\n2f2f736368656d61732e627573696e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f3230" }, { "name": "Length", "value": "1832" } ], "repeated": 0, "id": 8272 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x699e496b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8273 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b591d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8274 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x727b5932", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079c" } ], "repeated": 0, "id": 8275 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8276 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8277 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x80G\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8278 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80G\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8279 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8280 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798c899", "parentcaller": "0x69d32711", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" } ], "repeated": 0, "id": 8281 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8282 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8283 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4G\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8284 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4G\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8285 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8286 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8287 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69eb9c86", "parentcaller": "0x69ea02e9", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083ea" } ], "repeated": 0, "id": 8288 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8289 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8290 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8291 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8292 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00NH\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8293 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "NH\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8294 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8295 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "6980", "caller": "0x69ecf822", "parentcaller": "0x69e9fe38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00000000" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 8296 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xc4H\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8297 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc4H\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8298 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8299 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8300 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8301 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x001I\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8302 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "1I\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8303 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8304 }, { "timestamp": "2026-05-28 22:53:23,090", "thread_id": "2320", "caller": "0x69ed118b", "parentcaller": "0x69ed027c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000401aa" }, { "name": "Message", "value": "0x00008002" } ], "repeated": 0, "id": 8305 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06709000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8306 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 8307 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8308 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8309 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7042" } ], "repeated": 0, "id": 8310 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747dca5a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 5, "id": 8311 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x6b3b112a", "parentcaller": "0x6b3b3337", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 8312 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x75d4c23a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xa8\\xd8\\x06\\x06\\x88\\xa0Q\\x08\\x00\\x00\\x00\\x00\\x08\\xb9\\xf5\\x92\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00a\\x00t\\x00\\x00\\x00\\x00\\x00O\\x00\\xc8 O\\x00 \\x00\\x00\\x00" } ], "repeated": 0, "id": 8313 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c274", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8314 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c287", "parentcaller": "0x75d4c065", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8315 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" } ], "repeated": 0, "id": 8316 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d4ca32", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "ValueName", "value": "ScrollInset" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset" } ], "repeated": 0, "id": 8317 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c0a0", "parentcaller": "0x75d4ca32", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8318 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x75d4c23a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x8d\\xa4\\xad\\xc9(\\xd8\\x06\\x06d\\xffkk\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1\\xa4\\xad\\xc9\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x002\\xca\\xd4u%\\x00\\x00\\x00 \\x00\\x00\\x00" } ], "repeated": 0, "id": 8319 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c274", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8320 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c287", "parentcaller": "0x75d4c065", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8321 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" } ], "repeated": 0, "id": 8322 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d4ca32", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "ValueName", "value": "DragDelay" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay" } ], "repeated": 0, "id": 8323 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c0a0", "parentcaller": "0x75d4ca32", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8324 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x75d4c23a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x8d\\xa4\\xad\\xc9(\\xd8\\x06\\x06d\\xffkk\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1\\xa4\\xad\\xc9\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x002\\xca\\xd4u%\\x00\\x00\\x00 \\x00\\x00\\x00" } ], "repeated": 0, "id": 8325 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c274", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8326 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c287", "parentcaller": "0x75d4c065", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8327 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" } ], "repeated": 0, "id": 8328 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d4ca32", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "ValueName", "value": "DragMinDist" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist" } ], "repeated": 0, "id": 8329 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c0a0", "parentcaller": "0x75d4ca32", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8330 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x75d4c23a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x8d\\xa4\\xad\\xc9(\\xd8\\x06\\x06d\\xffkk\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb1\\xa4\\xad\\xc9\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x002\\xca\\xd4u%\\x00\\x00\\x00 \\x00\\x00\\x00" } ], "repeated": 0, "id": 8331 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c274", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8332 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c287", "parentcaller": "0x75d4c065", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8333 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" } ], "repeated": 0, "id": 8334 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d4ca32", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "ValueName", "value": "ScrollDelay" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay" } ], "repeated": 0, "id": 8335 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c0a0", "parentcaller": "0x75d4ca32", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8336 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x75d4c23a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xd7\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x8d\\xa4\\xad\\x00\\x0b\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00p\\x02\\x8f\\x00\\x7fS\\x9d\\x00\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x00\\xc0\\xee\\x06\\x060\\xaf\\xb3w6\\x8d\\xb7\\x94" } ], "repeated": 0, "id": 8337 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c274", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 8338 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c287", "parentcaller": "0x75d4c065", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8339 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows" } ], "repeated": 0, "id": 8340 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d4ca32", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "ValueName", "value": "ScrollInterval" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval" } ], "repeated": 0, "id": 8341 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4c0a0", "parentcaller": "0x75d4ca32", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8342 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4069b", "parentcaller": "0x75d404d5", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\win.ini" } ], "repeated": 0, "id": 8343 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4076e", "parentcaller": "0x75d404d5", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\win.ini" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8344 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8345 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d407e2", "parentcaller": "0x75d404d5", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "HandleName", "value": "C:\\Windows\\win.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8346 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4082e", "parentcaller": "0x75d404d5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x00101000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8347 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40850", "parentcaller": "0x75d404d5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8348 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40879", "parentcaller": "0x75d404d5", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "HandleName", "value": "C:\\Windows\\win.ini" }, { "name": "Buffer", "value": "; for 16-bit app support\r\n[fonts]\r\n[extensions]\r\n[mci extensions]\r\n[files]\r\n[Mail]\r\nMAPI=1\r\n" }, { "name": "Length", "value": "92" } ], "repeated": 0, "id": 8349 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40a44", "parentcaller": "0x75d40601", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x00101000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 8350 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40a86", "parentcaller": "0x75d40601", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8351 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40c12", "parentcaller": "0x75d40ba2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000007a4" } ], "repeated": 0, "id": 8352 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40c2c", "parentcaller": "0x75d40ba2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8353 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d40c37", "parentcaller": "0x75d40ba2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8354 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x7797498d", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8355 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x6b3b4827", "parentcaller": "0x6b3a5fee", "category": "system", "api": "GetSystemDefaultLangID", "status": true, "return": "0x00900409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00900409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 8356 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8357 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x6b3b112a", "parentcaller": "0x6b36a72c", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 8358 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8359 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8360 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76b30000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8361 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4b284", "parentcaller": "0x75d4b0f4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide" } ], "repeated": 0, "id": 8362 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4b2b6", "parentcaller": "0x75d4b0f4", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000007a4" }, { "name": "ValueName", "value": "PreferExternalManifest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest" } ], "repeated": 0, "id": 8363 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4b2d9", "parentcaller": "0x75d4b0f4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8364 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d5440c", "parentcaller": "0x75d4b1ef", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UxTheme.dll.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8365 }, { "timestamp": "2026-05-28 22:53:23,106", "thread_id": "2320", "caller": "0x75d4af7f", "parentcaller": "0x75d49db4", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8366 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x75d4af7f", "parentcaller": "0x75d49db4", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "2320" }, { "name": "Module", "value": "KERNEL32.DLL" }, { "name": "Return Address", "value": "0x75d5274c" } ], "repeated": 0, "id": 8367 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7042" } ], "repeated": 0, "id": 8368 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x75d4a59b", "parentcaller": "0x75d49db4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8369 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77b22f3f", "parentcaller": "0x77b22b04", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000008", "pretty_value": "KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots" } ], "repeated": 0, "id": 8370 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77b2329d", "parentcaller": "0x77b22beb", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "DesiredAccess", "value": "0x00100020", "pretty_value": "FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 8371 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x75d517c0", "parentcaller": "0x77ae92fd", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ce0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 8372 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77ae9372", "parentcaller": "0x77af2765", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8373 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "HIMAGELIST_QueryInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729cee70" } ], "repeated": 0, "id": 8374 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "DrawShadowText" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x72a38740" } ], "repeated": 0, "id": 8375 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "DrawSizeBox" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729e6db0" } ], "repeated": 0, "id": 8376 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "DrawScrollBar" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729e7780" } ], "repeated": 0, "id": 8377 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "SizeBoxHwnd" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729ea240" } ], "repeated": 0, "id": 8378 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "ScrollBar_MouseMove" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x72a31020" } ], "repeated": 0, "id": 8379 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "ScrollBar_Menu" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x72a30e60" } ], "repeated": 0, "id": 8380 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "HandleScrollCmd" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x72a30dd0" } ], "repeated": 0, "id": 8381 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "DetachScrollBars" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729e6f40" } ], "repeated": 0, "id": 8382 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "AttachScrollBars" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729e6f20" } ], "repeated": 0, "id": 8383 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "CCSetScrollInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729e8190" } ], "repeated": 0, "id": 8384 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "CCGetScrollInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729ec220" } ], "repeated": 0, "id": 8385 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "CCEnableScrollBar" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x729a55f0" } ], "repeated": 0, "id": 8386 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x77991b7a", "parentcaller": "0x747d82a5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x72970000" }, { "name": "FunctionName", "value": "QuerySystemGestureStatus" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x72a30e10" } ], "repeated": 0, "id": 8387 }, { "timestamp": "2026-05-28 22:53:23,122", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747da66a", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 10, "id": 8388 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 8389 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8390 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8391 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7042" } ], "repeated": 0, "id": 8392 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8393 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8394 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8395 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8396 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8397 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8398 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8399 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8400 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8401 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8402 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8403 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8404 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8405 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8406 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8407 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8408 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8409 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8410 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8411 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8412 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8413 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8414 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 8415 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8416 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8417 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7042" } ], "repeated": 0, "id": 8418 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8419 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8420 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8421 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8422 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8423 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8424 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8425 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8426 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77af003d", "parentcaller": "0x69ea4d77", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8427 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8428 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8429 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8430 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8431 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8432 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8433 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8434 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1da1", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8435 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed2d00", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 8436 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecf33b", "parentcaller": "0x69ecf5b0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7" }, { "name": "ClsContext", "value": "0x00000015", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "6E26E776-04F0-495D-80E4-3330352E3169" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8437 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MSAA_*FCFFFFFF00000000" }, { "name": "Atom", "value": "0x0000c043" } ], "repeated": 0, "id": 8438 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 2, "id": 8439 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ed10e9", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000302a8" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 8440 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 3, "id": 8441 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7796e3f2", "parentcaller": "0x6b4c0d61", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 8442 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7796e455", "parentcaller": "0x6b4c0d61", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 8443 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x779ad3de", "parentcaller": "0x7796e474", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 8444 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7796e4aa", "parentcaller": "0x6b4c0d61", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x000007a4" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0x00000000" } ], "repeated": 0, "id": 8445 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7796e4b5", "parentcaller": "0x6b4c0d61", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8446 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77988f9b", "parentcaller": "0x77988a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8447 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x779afb91", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ole32.dll" }, { "name": "BaseAddress", "value": "0x77240000" } ], "repeated": 0, "id": 8448 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x77240000" }, { "name": "FunctionName", "value": "OleInitialize" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77263b10" } ], "repeated": 0, "id": 8449 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798c134", "parentcaller": "0x77269929", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000007b4" } ], "repeated": 0, "id": 8450 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77989e76", "parentcaller": "0x7726994a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8451 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x7726996d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8452 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "OleDropTargetInterface" }, { "name": "Atom", "value": "0x0000c020" } ], "repeated": 0, "id": 8453 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "OleDropTargetMarshalHwnd" }, { "name": "Atom", "value": "0x0000c021" } ], "repeated": 0, "id": 8454 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x77240000" }, { "name": "FunctionName", "value": "RegisterDragDrop" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77263c50" } ], "repeated": 0, "id": 8455 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "OleEndPointID" }, { "name": "Atom", "value": "0x0000c044" } ], "repeated": 0, "id": 8456 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77302000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8457 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77302000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8458 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "Interface\\{00000160-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 8459 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 8460 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xd8\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x000\\xdb\\x06\\x06\\x98\\xd8\\x06\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\xb6\\x07\\x00\\x00" } ], "repeated": 0, "id": 8461 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 8462 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7797fe88", "parentcaller": "0x7797fbda", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000798" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000007b6" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 8463 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b13909", "parentcaller": "0x7797ff24", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd8\\x06\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdb\\x06\\x06h\\xd8\\x06\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xfcJ|\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\x9a\\x07\\x00\\x00" } ], "repeated": 0, "id": 8464 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7797fd75", "parentcaller": "0x7796a934", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 8465 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000079a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 8466 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x773dfea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000079a" } ], "repeated": 0, "id": 8467 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x773dfeb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b6" } ], "repeated": 0, "id": 8468 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b27bb9", "parentcaller": "0x76c222d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8469 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x76c212f8", "parentcaller": "0x76c20561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000007b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 8470 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798c134", "parentcaller": "0x76c21389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000798" } ], "repeated": 0, "id": 8471 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b16a20", "parentcaller": "0x77b19456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8472 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b190c4", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\\\x93c\\x06\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00" } ], "repeated": 0, "id": 8473 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19103", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa8\\xfe\\x95\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0U(\t\\x98\\x93\\x9c\\x00\\x00\\x00rdProperty,\\x00\\x00\\x00" } ], "repeated": 0, "id": 8474 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19120", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8475 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b1915f", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xec.\\x9f\n\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 8476 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19178", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8477 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b191b3", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\r\\x93\n\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 8478 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19240", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00Xr\\x93\n\\x00\\x00#\\x00d\\xdcX\\xdc\\x98\\x07\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0\\x98\\x07\\x00\\x00\\xac\\xdc\\x06\\x06\\xb3\\x91\\xb1w\\x98\\x07\\x00\\x00" } ], "repeated": 0, "id": 8479 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b1926e", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x1c\\xff\\x7f\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8ik\\x8d\\xa0\\xad\\xc9T\\xd7\\x06\\x06\\x98\\x07\\x00\\x00\\x08\\xe6\\x06\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xffd\\xdc\\x06\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 8480 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b16a20", "parentcaller": "0x77b17151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xccw\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xf4\\xcb\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8481 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b190c4", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "l\\x92c\\x06\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00" } ], "repeated": 0, "id": 8482 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19103", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "8\\xfb\\x95\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0U(\t\\x98\\x96\\x9c\\x00\\x00\\x00rdProperty\\x03\\x00\\x00\\x00" } ], "repeated": 0, "id": 8483 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19120", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8484 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b1915f", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb4/\\x9f\n\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 8485 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19178", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8486 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b191b3", "parentcaller": "0x77b16ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x9ck\\x93\n\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 8487 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b19240", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x98k\\x93\n\\x00\\x00#\\x00L\\xda@\\xda\\x98\\x07\\x00\\x00\\xd4\\xeb\\x00\\x00\\x00\\x00\\x8f\\x00#\\x00\\x00\\xc0\\x98\\x07\\x00\\x00\\x94\\xda\\x06\\x06\\xb3\\x91\\xb1w\\x98\\x07\\x00\\x00" } ], "repeated": 0, "id": 8488 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x77b1926e", "parentcaller": "0x77b191c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x1c\\xff\\x7f\\x04\\xd4\\xeby\\x04#\\x00\\x00\\xc0\\xec\\xa8ike\\xa5\\xad\\xc9<\\xd5\\x06\\x06\\x98\\x07\\x00\\x00\\x08\\xe6\\x06\\x06\\xa0\\xe6\\x80k\\xb1\\xdd'\\xa4\\xfe\\xff\\xff\\xffL\\xda\\x06\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk" } ], "repeated": 0, "id": 8489 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x76c213d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b4" } ], "repeated": 0, "id": 8490 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x76c213f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8491 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "OleEndPointID" }, { "name": "Atom", "value": "0x0000c044" } ], "repeated": 0, "id": 8492 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8493 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000798" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Ole\\Extensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions" } ], "repeated": 0, "id": 8494 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000798" }, { "name": "ValueName", "value": "DragDropExtension" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension" } ], "repeated": 0, "id": 8495 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dxgi" }, { "name": "DllBase", "value": "0x70790000" } ], "repeated": 0, "id": 8496 }, { "timestamp": "2026-05-28 22:53:23,137", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\d3d11" }, { "name": "DllBase", "value": "0x705b0000" } ], "repeated": 0, "id": 8497 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcomp" }, { "name": "DllBase", "value": "0x6e690000" } ], "repeated": 0, "id": 8498 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dataexchange" }, { "name": "DllBase", "value": "0x6e800000" } ], "repeated": 0, "id": 8499 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x779afb91", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x76b10000" } ], "repeated": 0, "id": 8500 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798a206", "parentcaller": "0x773f10d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dataexchange.dll" }, { "name": "BaseAddress", "value": "0x6e800000" } ], "repeated": 0, "id": 8501 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77263ec7", "parentcaller": "0x77263dd0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9FC8E510-A27C-4B3B-B9A3-BF65F00256A8" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "043250DB-3B6A-4141-8F21-AA2ED2BE3355" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8502 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x77263ed5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8503 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e82c000" }, { "name": "ModuleName", "value": "dataexchange.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8504 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e82c000" }, { "name": "ModuleName", "value": "dataexchange.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8505 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1109f", "parentcaller": "0x77b0f039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "twinapi.appcore.dll" } ], "repeated": 0, "id": 8506 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1213c", "parentcaller": "0x77b12046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\twinapi.appcore.dll" } ], "repeated": 0, "id": 8507 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1e65c", "parentcaller": "0x77b1e3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\twinapi.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8508 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1e699", "parentcaller": "0x77b1e3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000798" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\twinapi.appcore.dll" } ], "repeated": 0, "id": 8509 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1122c", "parentcaller": "0x77b11397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f920000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00191000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8510 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1000f", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8511 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b100b7", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa90000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8512 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b100e5", "parentcaller": "0x77b10794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa90000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8513 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8514 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b21ea8", "parentcaller": "0x77b21e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77be9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8515 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77af9d5b", "parentcaller": "0x77b0b4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa90000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8516 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1e6ed", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007c0" } ], "repeated": 0, "id": 8517 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b1e6f5", "parentcaller": "0x77b1e3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8518 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b10d10", "parentcaller": "0x77afe4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa90000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8519 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b10eea", "parentcaller": "0x77b10d32", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xb0\\x93\\x000\\x11\\x00\\x00\\x02\\x00\\x00\\x00H\\x8b\\x94\\x00\\xdc\\x0b\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\\x8b\\x94\\x00\\xbc\\x0b\\x00\\x00\\x02\\x00\\x00\\x008\\x8c\\x94\\x00\\xa8\n\\x00\\x00\\x02\\x00\\x00\\x00H\\xc4\\x93\\x00@\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\\xc4\\x93\\x00\\x10\t\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\xe2\\x94\\x00D\\x18\\x00\\x00\\x02\\x00\\x00\\x00\\x08\\xe4\\x94\\x00H\\x18\\x00\\x00\\x02\\x00\\x00\\x00\\x80\\xd5\\x94\\x00L\\x18\\x00\\x00\\x02\\x00\\x00\\x00 \\xdb\\x94\\x00\\xf4\\x1a\\x00\\x00\\x02\\x00\\x00\\x00(\\xaf\\x9c\\x00\\x18\\x1b\\x00\\x00\\x02\\x00\\x00\\x00\\x08\\xb1\\x9c\\x00\\x1c\\x1b\\x00\\x00\\x02\\x00\\x00\\x00\\xe8\\xb2\\x9c\\x00$\\x1b\\x00\\x00\\x02\\x00\\x00\\x00\\xd8\\xb3\\x9c\\x00(\\x1b\\x00\\x00\\x02\\x00\\x00\\x00\\xc8\\xb4\\x9c\\x00<\\x1b\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\\xbc\\x9c\\x00@\\x1b\\x00\\x00\\x02\\x00\\x00\\x008\\xbd\\x9c\\x00D\\x1b\\x00\\x00" } ], "repeated": 0, "id": 8520 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x74d198b1", "parentcaller": "0x74d18c82", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\system32\\twinapi.appcore.dll" } ], "repeated": 0, "id": 8521 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x74d198f0", "parentcaller": "0x74d18c82", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000798" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\twinapi.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8522 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000798" } ], "repeated": 0, "id": 8523 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x74d19991", "parentcaller": "0x74d18c82", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x6f920000" } ], "repeated": 0, "id": 8524 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0dd72", "parentcaller": "0x77b11873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\twinapi.appcore" }, { "name": "BaseAddress", "value": "0x6f920000" }, { "name": "InitRoutine", "value": "0x6f9a3fb0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 8525 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e82c000" }, { "name": "ModuleName", "value": "dataexchange.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8526 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e82c000" }, { "name": "ModuleName", "value": "dataexchange.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8527 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8528 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8529 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8530 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8531 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798c34d", "parentcaller": "0x6f96b024", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "828HWNDInterface:102b8" } ], "repeated": 0, "id": 8532 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798c134", "parentcaller": "0x6f96d19e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000007d8" } ], "repeated": 0, "id": 8533 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77989e76", "parentcaller": "0x6f96d21e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf8GU\\x08`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8534 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6f9a614a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007d8" } ], "repeated": 0, "id": 8535 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798c34d", "parentcaller": "0x6f96f39f", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "828HWNDInterface:102b8" } ], "repeated": 0, "id": 8536 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77989888", "parentcaller": "0x779894ee", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007d8" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "828HWNDInterface:102b8" }, { "name": "FileHandle", "value": "0x00000000" }, { "name": "FileName", "value": "" } ], "repeated": 0, "id": 8537 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x6f96f63f", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "SectionOffset", "value": "0x0606e5e4" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8538 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77999145", "parentcaller": "0x6f96f744", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8539 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0fecf", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8540 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77b0ff04", "parentcaller": "0x77b0fdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6fa94000" }, { "name": "ModuleName", "value": "twinapi.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8541 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798db61", "parentcaller": "0x7760ae0f", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\twinapi.appcore.dll" }, { "name": "ModuleHandle", "value": "0x6f920000" } ], "repeated": 0, "id": 8542 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798c134", "parentcaller": "0x6f96d19e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000007dc" } ], "repeated": 0, "id": 8543 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77989e76", "parentcaller": "0x6f96d21e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " pU\\x08`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8544 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6f9a614a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8545 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798c34d", "parentcaller": "0x6f96f39f", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "828HWNDInterface:102b8" } ], "repeated": 0, "id": 8546 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x779a96ab", "parentcaller": "0x779a95ee", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "SectionOffset", "value": "0x0606e60c" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8547 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77999145", "parentcaller": "0x6f96f5fb", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8548 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6f96f602", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8549 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77989888", "parentcaller": "0x779894ee", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x40000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "828HWNDInterface:102b8" }, { "name": "FileHandle", "value": "0x00000000" }, { "name": "FileName", "value": "" } ], "repeated": 0, "id": 8550 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7799762b", "parentcaller": "0x6f96f63f", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "SectionOffset", "value": "0x0606e634" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8551 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77999145", "parentcaller": "0x6f96f744", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8552 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x6f96ceeb", "parentcaller": "0x6f96f781", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010128", "arguments": [ { "name": "ClassName", "value": "ApplicationManager_DesktopShellWindow" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 8553 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{DADEF92C-227E-46C0-93C0-9FFFA4DC07D9}" }, { "name": "Atom", "value": "0x0000c01f" } ], "repeated": 0, "id": 8554 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x6f96cf27", "parentcaller": "0x6f96f781", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x0000c0c1" } ], "repeated": 0, "id": 8555 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77991c1d", "parentcaller": "0x75d4f804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x77240000" }, { "name": "FunctionName", "value": "RevokeDragDrop" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77263960" } ], "repeated": 0, "id": 8556 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7797f8f1", "parentcaller": "0x7797f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8557 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x779cf5cb", "parentcaller": "0x7797f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000f8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Ole\\Extensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions" } ], "repeated": 0, "id": 8558 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x779cec2a", "parentcaller": "0x7797f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "ValueName", "value": "DragDropExtension" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension" } ], "repeated": 0, "id": 8559 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77263ec7", "parentcaller": "0x77263a36", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9FC8E510-A27C-4B3B-B9A3-BF65F00256A8" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "043250DB-3B6A-4141-8F21-AA2ED2BE3355" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8560 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798040b", "parentcaller": "0x77263ed5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e0" } ], "repeated": 0, "id": 8561 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798c34d", "parentcaller": "0x6f972c08", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007e0" }, { "name": "DesiredAccess", "value": "0x00000002" }, { "name": "ObjectAttributes", "value": "828HWNDInterface:102b8" } ], "repeated": 0, "id": 8562 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x779a96ab", "parentcaller": "0x779a95ee", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000007e0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "SectionOffset", "value": "0x0606e6c4" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8563 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6f972e18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8564 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x77999145", "parentcaller": "0x6f972e39", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06d00000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8565 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x6f96ae71", "parentcaller": "0x6f96ae45", "category": "windows", "api": "FindWindowW", "status": true, "return": "0x00010128", "arguments": [ { "name": "ClassName", "value": "ApplicationManager_DesktopShellWindow" }, { "name": "WindowName", "value": "" } ], "repeated": 0, "id": 8566 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4bc42", "parentcaller": "0x75d4ba23", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "{DADEF92C-227E-46C0-93C0-9FFFA4DC07D9}" }, { "name": "Atom", "value": "0x0000c01f" } ], "repeated": 0, "id": 8567 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x6f96aebf", "parentcaller": "0x6f96ae45", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00010128" }, { "name": "Message", "value": "0x0000c0c2" } ], "repeated": 0, "id": 8568 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6f972edb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e0" } ], "repeated": 0, "id": 8569 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d51165", "parentcaller": "0x75d5113f", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c044" } ], "repeated": 0, "id": 8570 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d86d61", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8571 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8572 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8573 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent" } ], "repeated": 0, "id": 8574 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent" } ], "repeated": 0, "id": 8575 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8576 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8577 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8578 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold" } ], "repeated": 0, "id": 8579 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial Bold" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold" } ], "repeated": 0, "id": 8580 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8581 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8582 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8583 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold,0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0" } ], "repeated": 0, "id": 8584 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold,0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial Bold,178" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0" } ], "repeated": 0, "id": 8585 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8586 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8587 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8588 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent,0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0" } ], "repeated": 0, "id": 8589 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent,0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,178" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0" } ], "repeated": 0, "id": 8590 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8591 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8592 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8593 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Baltic,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186" } ], "repeated": 0, "id": 8594 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Baltic,186" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186" } ], "repeated": 0, "id": 8595 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8596 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8597 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8598 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CE,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238" } ], "repeated": 0, "id": 8599 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CE,238" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238" } ], "repeated": 0, "id": 8600 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8601 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8602 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8603 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CYR,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204" } ], "repeated": 0, "id": 8604 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CYR,204" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204" } ], "repeated": 0, "id": 8605 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8606 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8607 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8608 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Greek,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161" } ], "repeated": 0, "id": 8609 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Greek,161" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161" } ], "repeated": 0, "id": 8610 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8611 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8612 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8613 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial TUR,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162" } ], "repeated": 0, "id": 8614 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial TUR,162" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162" } ], "repeated": 0, "id": 8615 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8616 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8617 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8618 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Baltic,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186" } ], "repeated": 0, "id": 8619 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Baltic,186" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186" } ], "repeated": 0, "id": 8620 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8621 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8622 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8623 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CE,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238" } ], "repeated": 0, "id": 8624 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CE,238" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238" } ], "repeated": 0, "id": 8625 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8626 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8627 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8628 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CYR,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204" } ], "repeated": 0, "id": 8629 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CYR,204" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204" } ], "repeated": 0, "id": 8630 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8631 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8632 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8633 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Greek,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161" } ], "repeated": 0, "id": 8634 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Greek,161" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161" } ], "repeated": 0, "id": 8635 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8636 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8637 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8638 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New TUR,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162" } ], "repeated": 0, "id": 8639 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New TUR,162" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162" } ], "repeated": 0, "id": 8640 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8641 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8642 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8643 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv" } ], "repeated": 0, "id": 8644 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "MS Sans Serif" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv" } ], "repeated": 0, "id": 8645 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8646 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8647 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8648 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helvetica" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica" } ], "repeated": 0, "id": 8649 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helvetica" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica" } ], "repeated": 0, "id": 8650 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8651 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8652 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8653 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "MS Shell Dlg 2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2" } ], "repeated": 0, "id": 8654 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "MS Shell Dlg 2" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Tahoma" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2" } ], "repeated": 0, "id": 8655 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8656 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8657 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8658 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Tahoma Armenian" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian" } ], "repeated": 0, "id": 8659 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Tahoma Armenian" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Tahoma" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian" } ], "repeated": 0, "id": 8660 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8661 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8662 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8663 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times" } ], "repeated": 0, "id": 8664 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times" } ], "repeated": 0, "id": 8665 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8666 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8667 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8668 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman Baltic,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186" } ], "repeated": 0, "id": 8669 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman Baltic,186" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186" } ], "repeated": 0, "id": 8670 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8671 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8672 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8673 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman CE,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238" } ], "repeated": 0, "id": 8674 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman CE,238" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238" } ], "repeated": 0, "id": 8675 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8676 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e31", "parentcaller": "0x75d56d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e0" } ], "repeated": 0, "id": 8677 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d86d61", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8678 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8679 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8680 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent" } ], "repeated": 0, "id": 8681 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent" } ], "repeated": 0, "id": 8682 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8683 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8684 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8685 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold" } ], "repeated": 0, "id": 8686 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial Bold" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold" } ], "repeated": 0, "id": 8687 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8688 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8689 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8690 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold,0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0" } ], "repeated": 0, "id": 8691 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent Bold,0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial Bold,178" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0" } ], "repeated": 0, "id": 8692 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8693 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8694 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8695 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent,0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0" } ], "repeated": 0, "id": 8696 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arabic Transparent,0" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,178" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0" } ], "repeated": 0, "id": 8697 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8698 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8699 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8700 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Baltic,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186" } ], "repeated": 0, "id": 8701 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Baltic,186" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186" } ], "repeated": 0, "id": 8702 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8703 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8704 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8705 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CE,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238" } ], "repeated": 0, "id": 8706 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CE,238" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238" } ], "repeated": 0, "id": 8707 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8708 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8709 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8710 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CYR,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204" } ], "repeated": 0, "id": 8711 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial CYR,204" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204" } ], "repeated": 0, "id": 8712 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8713 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8714 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8715 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Greek,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161" } ], "repeated": 0, "id": 8716 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial Greek,161" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161" } ], "repeated": 0, "id": 8717 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8718 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8719 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8720 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial TUR,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162" } ], "repeated": 0, "id": 8721 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Arial TUR,162" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162" } ], "repeated": 0, "id": 8722 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8723 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8724 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8725 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Baltic,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186" } ], "repeated": 0, "id": 8726 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Baltic,186" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186" } ], "repeated": 0, "id": 8727 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8728 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8729 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8730 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CE,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238" } ], "repeated": 0, "id": 8731 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CE,238" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238" } ], "repeated": 0, "id": 8732 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8733 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8734 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8735 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CYR,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204" } ], "repeated": 0, "id": 8736 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New CYR,204" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204" } ], "repeated": 0, "id": 8737 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8738 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8739 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8740 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Greek,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161" } ], "repeated": 0, "id": 8741 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New Greek,161" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161" } ], "repeated": 0, "id": 8742 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8743 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8744 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8745 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New TUR,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162" } ], "repeated": 0, "id": 8746 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Courier New TUR,162" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Courier New,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162" } ], "repeated": 0, "id": 8747 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8748 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8749 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8750 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv" } ], "repeated": 0, "id": 8751 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "MS Sans Serif" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv" } ], "repeated": 0, "id": 8752 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8753 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8754 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8755 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helvetica" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica" } ], "repeated": 0, "id": 8756 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Helvetica" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Arial" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica" } ], "repeated": 0, "id": 8757 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8758 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8759 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8760 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "MS Shell Dlg 2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2" } ], "repeated": 0, "id": 8761 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "MS Shell Dlg 2" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Tahoma" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2" } ], "repeated": 0, "id": 8762 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8763 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8764 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8765 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Tahoma Armenian" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian" } ], "repeated": 0, "id": 8766 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Tahoma Armenian" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Tahoma" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian" } ], "repeated": 0, "id": 8767 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8768 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8769 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8770 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times" } ], "repeated": 0, "id": 8771 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times" } ], "repeated": 0, "id": 8772 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8773 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8774 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8775 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman Baltic,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186" } ], "repeated": 0, "id": 8776 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman Baltic,186" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,186" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186" } ], "repeated": 0, "id": 8777 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8778 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8779 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8780 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman CE,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238" } ], "repeated": 0, "id": 8781 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman CE,238" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238" } ], "repeated": 0, "id": 8782 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8783 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8784 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8785 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman CYR,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204" } ], "repeated": 0, "id": 8786 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman CYR,204" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204" } ], "repeated": 0, "id": 8787 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8788 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8789 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8790 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman Greek,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161" } ], "repeated": 0, "id": 8791 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman Greek,161" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,161" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161" } ], "repeated": 0, "id": 8792 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8793 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8794 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8795 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman TUR,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162" } ], "repeated": 0, "id": 8796 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Times New Roman TUR,162" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Times New Roman,162" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162" } ], "repeated": 0, "id": 8797 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8798 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "24" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8799 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8800 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Tms Rmn" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn" } ], "repeated": 0, "id": 8801 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "Tms Rmn" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "MS Serif" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn" } ], "repeated": 0, "id": 8802 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8803 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8804 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c37c", "parentcaller": "0x75d4c065", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" } ], "repeated": 0, "id": 8805 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c085", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "MS Shell Dlg" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg" } ], "repeated": 0, "id": 8806 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0ee", "parentcaller": "0x75d86dce", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000007dc" }, { "name": "ValueName", "value": "MS Shell Dlg" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Sans Serif" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg" } ], "repeated": 0, "id": 8807 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d4c0f9", "parentcaller": "0x75d86dce", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 8808 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e07", "parentcaller": "0x75d56d86", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000007e0" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "0" } ], "repeated": 0, "id": 8809 }, { "timestamp": "2026-05-28 22:53:23,153", "thread_id": "2320", "caller": "0x75d86e21", "parentcaller": "0x75d56d86", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e0" } ], "repeated": 0, "id": 8810 }, { "timestamp": "2026-05-28 22:53:23,169", "thread_id": "2320", "caller": "0x7798a90c", "parentcaller": "0x6b4c1895", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007a4" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf" }, { "name": "Buffer", "value": "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff40\\deff0\\stshfdbch11\\stshfloch0\\stshfhich0\\stshfbi0\\deflang1033\\deflangfe1033\\themelang1033\\themelangfe2052\\themelangcs1025{\\fonttbl{\\f0\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Ro" }, { "name": "Length", "value": "204389" } ], "repeated": 0, "id": 8811 }, { "timestamp": "2026-05-28 22:53:23,169", "thread_id": "2320", "caller": "0x7798ab1a", "parentcaller": "0x6b4c1398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007a4" } ], "repeated": 0, "id": 8812 }, { "timestamp": "2026-05-28 22:53:23,169", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed2d00", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 17, "id": 8813 }, { "timestamp": "2026-05-28 22:53:23,200", "thread_id": "2320", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06027000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8814 }, { "timestamp": "2026-05-28 22:53:23,200", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 19, "id": 8815 }, { "timestamp": "2026-05-28 22:53:23,200", "thread_id": "2320", "caller": "0x69ecea37", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000200e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8816 }, { "timestamp": "2026-05-28 22:53:23,200", "thread_id": "2320", "caller": "0x69ecea48", "parentcaller": "0x69ed1cab", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00002010" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 8817 }, { "timestamp": "2026-05-28 22:53:23,200", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 7, "id": 8818 }, { "timestamp": "2026-05-28 22:53:23,747", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8819 }, { "timestamp": "2026-05-28 22:53:23,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8820 }, { "timestamp": "2026-05-28 22:53:23,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 8821 }, { "timestamp": "2026-05-28 22:53:24,747", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8822 }, { "timestamp": "2026-05-28 22:53:24,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8823 }, { "timestamp": "2026-05-28 22:53:24,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 8824 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 8825 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 8826 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x69ea007f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007ac" } ], "repeated": 0, "id": 8827 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x7798ab1a", "parentcaller": "0x69ea0097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007b0" } ], "repeated": 0, "id": 8828 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x747dcadd", "parentcaller": "0x747dc90d", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 8829 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8830 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 8831 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x69eb8f1a", "parentcaller": "0x69ea0328", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e9" } ], "repeated": 0, "id": 8832 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8833 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 8834 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x85I\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8835 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x85I\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8836 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8837 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8838 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8839 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf2I\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8840 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf2I\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8841 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8842 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8843 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8844 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00lJ\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8845 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "lJ\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8846 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8847 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ed118b", "parentcaller": "0x69ed027c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000401aa" }, { "name": "Message", "value": "0x00008002" } ], "repeated": 0, "id": 8848 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xc0J\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8849 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0J\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8850 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8851 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8852 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8853 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ed10e9", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 8854 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00DK\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8855 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 8856 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "DK\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8857 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8858 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8859 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8860 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x9dK\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8861 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 8862 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9dK\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8863 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8864 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8865 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8866 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 8867 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf0K\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8868 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 8869 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf0K\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8870 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 8871 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8872 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8873 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8874 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 8875 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed27c8", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 8876 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00CL\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8877 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "CL\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8878 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 8879 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8880 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 8881 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08679000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8882 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8f\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8883 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8f\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8884 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6980", "caller": "0x00bc2389", "parentcaller": "0x00bc54aa", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" }, { "name": "Buffer", "value": "\r\n \r\n \r\n \r\n \r\n \r\n 19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd\r\n " }, { "name": "Length", "value": "2794793" } ], "repeated": 0, "id": 9004 }, { "timestamp": "2026-05-28 22:53:25,512", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09123000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9005 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9006 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 9007 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9008 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9009 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7728" } ], "repeated": 0, "id": 9010 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x002ad000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9011 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9012 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0896c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9013 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x69d48e3f", "parentcaller": "0x69d5409c", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007dc" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\products.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9014 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09262000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9015 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9fd000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9016 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06e90000" }, { "name": "RegionSize", "value": "0x00088000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9017 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06e90000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9018 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06f17000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9019 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08970000" }, { "name": "RegionSize", "value": "0x0010c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9020 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08970000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9021 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a7b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9022 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 9023 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9024 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9025 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7728" } ], "repeated": 0, "id": 9026 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a80000" }, { "name": "RegionSize", "value": "0x0020e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9027 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a80000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9028 }, { "timestamp": "2026-05-28 22:53:25,528", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08c8d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9029 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09480000" }, { "name": "RegionSize", "value": "0x00408000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9030 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09480000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9031 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09887000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9032 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090ce000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9033 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c40000" }, { "name": "RegionSize", "value": "0x00406000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9034 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c40000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9035 }, { "timestamp": "2026-05-28 22:53:25,544", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a045000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9036 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9037 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09187000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9038 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 9039 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9040 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9041 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7924" } ], "repeated": 0, "id": 9042 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 9043 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9044 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9045 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7924" } ], "repeated": 0, "id": 9046 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a050000" }, { "name": "RegionSize", "value": "0x00404000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9047 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a050000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9048 }, { "timestamp": "2026-05-28 22:53:25,559", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a453000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9049 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09890000" }, { "name": "RegionSize", "value": "0x00394000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9050 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09890000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9051 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c23000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9052 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a050000" }, { "name": "RegionSize", "value": "0x00404000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9053 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09c40000" }, { "name": "RegionSize", "value": "0x00406000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9054 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09480000" }, { "name": "RegionSize", "value": "0x00408000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9055 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a80000" }, { "name": "RegionSize", "value": "0x0020e000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9056 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08970000" }, { "name": "RegionSize", "value": "0x0010c000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9057 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06e90000" }, { "name": "RegionSize", "value": "0x00088000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9058 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9fd000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9059 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09262000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9060 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0918f000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9061 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09123000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9062 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084e1000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9063 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066d3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9064 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090d2000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9065 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9066 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066f8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9067 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090db000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9068 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084f7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9069 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09082000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9070 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06707000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9071 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0864e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9072 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08508000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9073 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09087000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9074 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066e2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9075 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066ea000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9076 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x002ad000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9077 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00344000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9078 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9079 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a03000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9080 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066f8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9081 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a10000" }, { "name": "RegionSize", "value": "0x002f4000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9082 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a10000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9083 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08d03000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9084 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08d10000" }, { "name": "RegionSize", "value": "0x00154000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9085 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08d10000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9086 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08e63000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9087 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77b47b75", "parentcaller": "0x77b08aa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b000000" }, { "name": "RegionSize", "value": "0x00bc9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9088 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47b90", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b000000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9089 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b47bb5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bbc8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9090 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09890000" }, { "name": "RegionSize", "value": "0x00394000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9091 }, { "timestamp": "2026-05-28 22:53:25,575", "thread_id": "6980", "caller": "0x69d48b3d", "parentcaller": "0x69cec1d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 9092 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9093 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08200000" }, { "name": "RegionSize", "value": "0x002b3000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9094 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0664e000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9095 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09262000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9096 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08508000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9097 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0864e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9098 }, { "timestamp": "2026-05-28 22:53:25,590", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06707000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9099 }, { "timestamp": "2026-05-28 22:53:25,606", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09082000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9100 }, { "timestamp": "2026-05-28 22:53:25,606", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084f7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9101 }, { "timestamp": "2026-05-28 22:53:25,606", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090d2000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9102 }, { "timestamp": "2026-05-28 22:53:25,606", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090db000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9103 }, { "timestamp": "2026-05-28 22:53:25,622", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9104 }, { "timestamp": "2026-05-28 22:53:25,622", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066d3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9105 }, { "timestamp": "2026-05-28 22:53:25,653", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9106 }, { "timestamp": "2026-05-28 22:53:25,653", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084e1000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9107 }, { "timestamp": "2026-05-28 22:53:25,684", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 9108 }, { "timestamp": "2026-05-28 22:53:25,715", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09123000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9109 }, { "timestamp": "2026-05-28 22:53:25,731", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0918f000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9110 }, { "timestamp": "2026-05-28 22:53:25,809", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093b8000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9111 }, { "timestamp": "2026-05-28 22:53:25,840", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa4f000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9112 }, { "timestamp": "2026-05-28 22:53:25,840", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa8f000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9113 }, { "timestamp": "2026-05-28 22:53:25,840", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aa92000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9114 }, { "timestamp": "2026-05-28 22:53:25,840", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aad1000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9115 }, { "timestamp": "2026-05-28 22:53:25,872", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0932f000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9116 }, { "timestamp": "2026-05-28 22:53:25,903", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9117 }, { "timestamp": "2026-05-28 22:53:25,965", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a9fd000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9118 }, { "timestamp": "2026-05-28 22:53:25,997", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9119 }, { "timestamp": "2026-05-28 22:53:25,997", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a82c000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9120 }, { "timestamp": "2026-05-28 22:53:26,028", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 97, "id": 9121 }, { "timestamp": "2026-05-28 22:53:26,450", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aad5000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9122 }, { "timestamp": "2026-05-28 22:53:26,465", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9123 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 9124 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9125 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9126 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4R\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9127 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 9128 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9129 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9130 }, { "timestamp": "2026-05-28 22:53:26,559", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9131 }, { "timestamp": "2026-05-28 22:53:26,575", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 9132 }, { "timestamp": "2026-05-28 22:53:26,825", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aae6000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9133 }, { "timestamp": "2026-05-28 22:53:26,840", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 9134 }, { "timestamp": "2026-05-28 22:53:27,153", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aaf7000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9135 }, { "timestamp": "2026-05-28 22:53:27,153", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ab37000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9136 }, { "timestamp": "2026-05-28 22:53:27,169", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9137 }, { "timestamp": "2026-05-28 22:53:27,247", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ab3a000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9138 }, { "timestamp": "2026-05-28 22:53:27,294", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 9139 }, { "timestamp": "2026-05-28 22:53:27,325", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ab4b000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9140 }, { "timestamp": "2026-05-28 22:53:27,356", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9141 }, { "timestamp": "2026-05-28 22:53:27,465", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ab50000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9142 }, { "timestamp": "2026-05-28 22:53:27,465", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ab8d000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9143 }, { "timestamp": "2026-05-28 22:53:27,465", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9144 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000007e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9145 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 9146 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" } ], "repeated": 0, "id": 9147 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 9148 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9149 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9150 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" } ], "repeated": 0, "id": 9151 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9152 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9153 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9154 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" } ], "repeated": 0, "id": 9155 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 9156 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9157 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "4" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9158 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007e4" } ], "repeated": 0, "id": 9159 }, { "timestamp": "2026-05-28 22:53:27,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 9160 }, { "timestamp": "2026-05-28 22:53:27,528", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ab93000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9161 }, { "timestamp": "2026-05-28 22:53:27,544", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0abb4000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9162 }, { "timestamp": "2026-05-28 22:53:27,544", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 9163 }, { "timestamp": "2026-05-28 22:53:27,590", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9164 }, { "timestamp": "2026-05-28 22:53:27,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9165 }, { "timestamp": "2026-05-28 22:53:27,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9166 }, { "timestamp": "2026-05-28 22:53:27,590", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9167 }, { "timestamp": "2026-05-28 22:53:27,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 9168 }, { "timestamp": "2026-05-28 22:53:27,653", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0abbd000" }, { "name": "RegionSize", "value": "0x00023000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9169 }, { "timestamp": "2026-05-28 22:53:27,653", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0abd7000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9170 }, { "timestamp": "2026-05-28 22:53:27,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9171 }, { "timestamp": "2026-05-28 22:53:27,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0abe0000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9172 }, { "timestamp": "2026-05-28 22:53:27,762", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac01000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9173 }, { "timestamp": "2026-05-28 22:53:27,778", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 9174 }, { "timestamp": "2026-05-28 22:53:27,903", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac12000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9175 }, { "timestamp": "2026-05-28 22:53:27,934", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 134, "id": 9176 }, { "timestamp": "2026-05-28 22:53:28,606", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9177 }, { "timestamp": "2026-05-28 22:53:28,606", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9178 }, { "timestamp": "2026-05-28 22:53:28,606", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9179 }, { "timestamp": "2026-05-28 22:53:28,606", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9180 }, { "timestamp": "2026-05-28 22:53:28,606", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 25, "id": 9181 }, { "timestamp": "2026-05-28 22:53:28,747", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac33000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9182 }, { "timestamp": "2026-05-28 22:53:28,747", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 9183 }, { "timestamp": "2026-05-28 22:53:28,950", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac3c000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9184 }, { "timestamp": "2026-05-28 22:53:28,950", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 9185 }, { "timestamp": "2026-05-28 22:53:29,247", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac5d000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9186 }, { "timestamp": "2026-05-28 22:53:29,247", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac61000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9187 }, { "timestamp": "2026-05-28 22:53:29,278", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9188 }, { "timestamp": "2026-05-28 22:53:29,372", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac68000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9189 }, { "timestamp": "2026-05-28 22:53:29,387", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9190 }, { "timestamp": "2026-05-28 22:53:29,481", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac71000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9191 }, { "timestamp": "2026-05-28 22:53:29,497", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 9192 }, { "timestamp": "2026-05-28 22:53:29,637", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9193 }, { "timestamp": "2026-05-28 22:53:29,637", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9194 }, { "timestamp": "2026-05-28 22:53:29,637", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9195 }, { "timestamp": "2026-05-28 22:53:29,637", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9196 }, { "timestamp": "2026-05-28 22:53:29,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 9197 }, { "timestamp": "2026-05-28 22:53:29,794", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac82000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9198 }, { "timestamp": "2026-05-28 22:53:29,794", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0acbb000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9199 }, { "timestamp": "2026-05-28 22:53:29,809", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 9200 }, { "timestamp": "2026-05-28 22:53:30,278", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0acc5000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9201 }, { "timestamp": "2026-05-28 22:53:30,294", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 9202 }, { "timestamp": "2026-05-28 22:53:30,403", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0acce000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9203 }, { "timestamp": "2026-05-28 22:53:30,450", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9204 }, { "timestamp": "2026-05-28 22:53:30,512", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0acef000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9205 }, { "timestamp": "2026-05-28 22:53:30,512", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad2d000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9206 }, { "timestamp": "2026-05-28 22:53:30,575", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9207 }, { "timestamp": "2026-05-28 22:53:30,653", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9208 }, { "timestamp": "2026-05-28 22:53:30,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9209 }, { "timestamp": "2026-05-28 22:53:30,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9210 }, { "timestamp": "2026-05-28 22:53:30,653", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9211 }, { "timestamp": "2026-05-28 22:53:30,669", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9212 }, { "timestamp": "2026-05-28 22:53:30,669", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad32000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9213 }, { "timestamp": "2026-05-28 22:53:30,700", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9214 }, { "timestamp": "2026-05-28 22:53:30,715", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad53000" }, { "name": "RegionSize", "value": "0x00023000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9215 }, { "timestamp": "2026-05-28 22:53:30,715", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad6f000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9216 }, { "timestamp": "2026-05-28 22:53:30,747", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9217 }, { "timestamp": "2026-05-28 22:53:30,809", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad76000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9218 }, { "timestamp": "2026-05-28 22:53:30,840", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 27, "id": 9219 }, { "timestamp": "2026-05-28 22:53:30,965", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad7f000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9220 }, { "timestamp": "2026-05-28 22:53:30,981", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 76, "id": 9221 }, { "timestamp": "2026-05-28 22:53:31,387", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad90000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9222 }, { "timestamp": "2026-05-28 22:53:31,387", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 9223 }, { "timestamp": "2026-05-28 22:53:31,450", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ad99000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9224 }, { "timestamp": "2026-05-28 22:53:31,465", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 9225 }, { "timestamp": "2026-05-28 22:53:31,653", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9226 }, { "timestamp": "2026-05-28 22:53:31,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9227 }, { "timestamp": "2026-05-28 22:53:31,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9228 }, { "timestamp": "2026-05-28 22:53:31,653", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9229 }, { "timestamp": "2026-05-28 22:53:31,684", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 9230 }, { "timestamp": "2026-05-28 22:53:31,840", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0adba000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9231 }, { "timestamp": "2026-05-28 22:53:31,872", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 20, "id": 9232 }, { "timestamp": "2026-05-28 22:53:31,950", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0adcb000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9233 }, { "timestamp": "2026-05-28 22:53:31,981", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 9234 }, { "timestamp": "2026-05-28 22:53:32,153", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0addc000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9235 }, { "timestamp": "2026-05-28 22:53:32,169", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 76, "id": 9236 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000007dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9237 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 9238 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 1, "id": 9239 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9240 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9241 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 9242 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9243 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9244 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9245 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 9246 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9247 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed1660", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 9248 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "5" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9249 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007dc" } ], "repeated": 0, "id": 9250 }, { "timestamp": "2026-05-28 22:53:32,512", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ed258e", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 38, "id": 9251 }, { "timestamp": "2026-05-28 22:53:32,684", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9252 }, { "timestamp": "2026-05-28 22:53:32,684", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9253 }, { "timestamp": "2026-05-28 22:53:32,684", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9254 }, { "timestamp": "2026-05-28 22:53:32,684", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9255 }, { "timestamp": "2026-05-28 22:53:32,700", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 97, "id": 9256 }, { "timestamp": "2026-05-28 22:53:33,153", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0adfd000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9257 }, { "timestamp": "2026-05-28 22:53:33,169", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 48, "id": 9258 }, { "timestamp": "2026-05-28 22:53:33,403", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae0e000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9259 }, { "timestamp": "2026-05-28 22:53:33,403", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae4d000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9260 }, { "timestamp": "2026-05-28 22:53:33,419", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 62, "id": 9261 }, { "timestamp": "2026-05-28 22:53:33,700", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9262 }, { "timestamp": "2026-05-28 22:53:33,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9263 }, { "timestamp": "2026-05-28 22:53:33,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9264 }, { "timestamp": "2026-05-28 22:53:33,700", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9265 }, { "timestamp": "2026-05-28 22:53:33,731", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 76, "id": 9266 }, { "timestamp": "2026-05-28 22:53:34,106", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae51000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9267 }, { "timestamp": "2026-05-28 22:53:34,106", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae8f000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9268 }, { "timestamp": "2026-05-28 22:53:34,137", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 83, "id": 9269 }, { "timestamp": "2026-05-28 22:53:34,731", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9270 }, { "timestamp": "2026-05-28 22:53:34,731", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9271 }, { "timestamp": "2026-05-28 22:53:34,731", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9272 }, { "timestamp": "2026-05-28 22:53:34,731", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9273 }, { "timestamp": "2026-05-28 22:53:34,731", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 69, "id": 9274 }, { "timestamp": "2026-05-28 22:53:35,075", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae94000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9275 }, { "timestamp": "2026-05-28 22:53:35,075", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aed1000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9276 }, { "timestamp": "2026-05-28 22:53:35,106", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 6, "id": 9277 }, { "timestamp": "2026-05-28 22:53:35,137", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aed7000" }, { "name": "RegionSize", "value": "0x00023000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9278 }, { "timestamp": "2026-05-28 22:53:35,137", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aef3000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9279 }, { "timestamp": "2026-05-28 22:53:35,137", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 34, "id": 9280 }, { "timestamp": "2026-05-28 22:53:35,325", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aefa000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9281 }, { "timestamp": "2026-05-28 22:53:35,325", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af35000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9282 }, { "timestamp": "2026-05-28 22:53:35,325", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 41, "id": 9283 }, { "timestamp": "2026-05-28 22:53:35,512", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af3d000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9284 }, { "timestamp": "2026-05-28 22:53:35,559", "thread_id": "2320", "caller": "0x69ecf66d", "parentcaller": "0x69ece3d5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 13, "id": 9285 }, { "timestamp": "2026-05-28 22:53:35,747", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9286 }, { "timestamp": "2026-05-28 22:53:35,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9287 }, { "timestamp": "2026-05-28 22:53:35,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9288 }, { "timestamp": "2026-05-28 22:53:35,747", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9289 }, { "timestamp": "2026-05-28 22:53:36,403", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af46000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9290 }, { "timestamp": "2026-05-28 22:53:36,653", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af57000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9291 }, { "timestamp": "2026-05-28 22:53:36,653", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af95000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9292 }, { "timestamp": "2026-05-28 22:53:36,794", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9293 }, { "timestamp": "2026-05-28 22:53:36,794", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9294 }, { "timestamp": "2026-05-28 22:53:36,794", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9295 }, { "timestamp": "2026-05-28 22:53:36,794", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9296 }, { "timestamp": "2026-05-28 22:53:37,450", "thread_id": "6220", "caller": "0x77af2586", "parentcaller": "0x77af6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9297 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9298 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9299 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9300 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9301 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9302 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9303 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9304 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9305 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9306 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9307 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "6" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9308 }, { "timestamp": "2026-05-28 22:53:37,528", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9309 }, { "timestamp": "2026-05-28 22:53:37,840", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9310 }, { "timestamp": "2026-05-28 22:53:37,840", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9311 }, { "timestamp": "2026-05-28 22:53:37,840", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9312 }, { "timestamp": "2026-05-28 22:53:37,840", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9313 }, { "timestamp": "2026-05-28 22:53:38,325", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af9a000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9314 }, { "timestamp": "2026-05-28 22:53:38,481", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0afa3000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9315 }, { "timestamp": "2026-05-28 22:53:38,481", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0afdf000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9316 }, { "timestamp": "2026-05-28 22:53:38,544", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0afe6000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9317 }, { "timestamp": "2026-05-28 22:53:38,872", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9318 }, { "timestamp": "2026-05-28 22:53:38,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9319 }, { "timestamp": "2026-05-28 22:53:38,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9320 }, { "timestamp": "2026-05-28 22:53:38,872", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ebb03c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020180" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9321 }, { "timestamp": "2026-05-28 22:53:38,981", "thread_id": "6980", "caller": "0x77b0058c", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bbd0000" }, { "name": "RegionSize", "value": "0x00fd0000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9322 }, { "timestamp": "2026-05-28 22:53:38,981", "thread_id": "6980", "caller": "0x77b005eb", "parentcaller": "0x77b07ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bbd0000" }, { "name": "RegionSize", "value": "0x00044000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9323 }, { "timestamp": "2026-05-28 22:53:38,981", "thread_id": "6980", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc11000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9324 }, { "timestamp": "2026-05-28 22:53:39,231", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc14000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9325 }, { "timestamp": "2026-05-28 22:53:39,356", "thread_id": "6980", "caller": "0x77b007c7", "parentcaller": "0x77b004cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc1d000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9326 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00344000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9327 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aeddce", "parentcaller": "0x77b02691", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae8f000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9328 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aeddce", "parentcaller": "0x77b02702", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc11000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9329 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ae4f000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9330 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bbd1000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9331 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0accd000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9332 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0add9000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9333 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0abd9000" }, { "name": "RegionSize", "value": "0x0001e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9334 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac39000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9335 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084ef000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9336 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090ce000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9337 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091a3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9338 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093d4000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9339 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc23000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9340 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aff5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9341 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066d7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9342 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77aef7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08591000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 9343 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aef655", "parentcaller": "0x77b046e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066d7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9344 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0b000000" }, { "name": "RegionSize", "value": "0x00bc9000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9345 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08d10000" }, { "name": "RegionSize", "value": "0x00154000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9346 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x77aefaf4", "parentcaller": "0x77b04f7e", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08a10000" }, { "name": "RegionSize", "value": "0x002f4000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 9347 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9348 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9349 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00=S\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9350 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "=S\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9351 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 9352 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6980", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9353 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9354 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9355 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xa4S\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9356 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa4S\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9357 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 9358 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9359 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9360 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x11T\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9361 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x11T\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9362 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 9363 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x69ed118b", "parentcaller": "0x69ed027c", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000401aa" }, { "name": "Message", "value": "0x00008002" } ], "repeated": 0, "id": 9364 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08591000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9365 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b046e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09087000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9366 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 9367 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x066e2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9368 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "2320", "caller": "0x69ecf822", "parentcaller": "0x69ed10e9", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020132" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9369 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x090ce000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9370 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x084ef000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9371 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0aff5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9372 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc23000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9373 }, { "timestamp": "2026-05-28 22:53:39,794", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x093d4000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9374 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ac39000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9375 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x77aef655", "parentcaller": "0x77b07a14", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x091a3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9376 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x77b00349", "parentcaller": "0x77b037d5", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09272000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9377 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x77aeddce", "parentcaller": "0x77b02702", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09272000" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9378 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e40c8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 9379 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9380 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e40e5", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9381 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e410c", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7924" } ], "repeated": 0, "id": 9382 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x69eb9c86", "parentcaller": "0x69ea02e9", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083ea" } ], "repeated": 0, "id": 9383 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x00bc03e1", "parentcaller": "0x00bc0a7c", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9384 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x00bc51b9", "parentcaller": "0x00bc0ad6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9385 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00eT\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9386 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x00bc2338", "parentcaller": "0x00bc542f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ec" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "eT\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9387 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x00bc229e", "parentcaller": "0x00bc51d3", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 9388 }, { "timestamp": "2026-05-28 22:53:39,809", "thread_id": "6980", "caller": "0x69ecf822", "parentcaller": "0x69e9fe38", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020132" }, { "name": "Message", "value": "0x00008001" } ], "repeated": 0, "id": 9389 }, { "timestamp": "2026-05-28 22:53:39,825", "thread_id": "6936", "caller": "0x779ac253", "parentcaller": "0x699e414a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 9390 }, { "timestamp": "2026-05-28 22:53:39,825", "thread_id": "6936", "caller": "0x779749b2", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9391 }, { "timestamp": "2026-05-28 22:53:39,825", "thread_id": "6936", "caller": "0x779749d7", "parentcaller": "0x699e4163", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9392 }, { "timestamp": "2026-05-28 22:53:39,825", "thread_id": "6936", "caller": "0x7798948c", "parentcaller": "0x699e4186", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000664" }, { "name": "HandleName", "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" }, { "name": "Buffer", "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00" }, { "name": "Length", "value": "7924" } ], "repeated": 0, "id": 9393 }, { "timestamp": "2026-05-28 22:53:39,872", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9394 }, { "timestamp": "2026-05-28 22:53:39,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9395 }, { "timestamp": "2026-05-28 22:53:39,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9396 }, { "timestamp": "2026-05-28 22:53:40,887", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9397 }, { "timestamp": "2026-05-28 22:53:40,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9398 }, { "timestamp": "2026-05-28 22:53:40,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9399 }, { "timestamp": "2026-05-28 22:53:41,325", "thread_id": "2320", "caller": "0x76e32cb5", "parentcaller": "0x7760a5a6", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 9400 }, { "timestamp": "2026-05-28 22:53:41,887", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9401 }, { "timestamp": "2026-05-28 22:53:41,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9402 }, { "timestamp": "2026-05-28 22:53:41,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9403 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9404 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9405 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9406 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9407 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9408 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9409 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9410 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9411 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9412 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9413 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "7" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9414 }, { "timestamp": "2026-05-28 22:53:42,544", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9415 }, { "timestamp": "2026-05-28 22:53:42,903", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9416 }, { "timestamp": "2026-05-28 22:53:42,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9417 }, { "timestamp": "2026-05-28 22:53:42,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9418 }, { "timestamp": "2026-05-28 22:53:43,903", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9419 }, { "timestamp": "2026-05-28 22:53:43,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9420 }, { "timestamp": "2026-05-28 22:53:43,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9421 }, { "timestamp": "2026-05-28 22:53:44,903", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9422 }, { "timestamp": "2026-05-28 22:53:44,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9423 }, { "timestamp": "2026-05-28 22:53:44,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9424 }, { "timestamp": "2026-05-28 22:53:45,919", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9425 }, { "timestamp": "2026-05-28 22:53:45,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9426 }, { "timestamp": "2026-05-28 22:53:45,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9427 }, { "timestamp": "2026-05-28 22:53:46,919", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9428 }, { "timestamp": "2026-05-28 22:53:46,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9429 }, { "timestamp": "2026-05-28 22:53:46,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9430 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9431 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9432 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9433 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9434 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9435 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9436 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9437 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "7" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9438 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9439 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000007f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9440 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "8" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9441 }, { "timestamp": "2026-05-28 22:53:47,559", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000007f0" } ], "repeated": 0, "id": 9442 }, { "timestamp": "2026-05-28 22:53:47,919", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9443 }, { "timestamp": "2026-05-28 22:53:47,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9444 }, { "timestamp": "2026-05-28 22:53:47,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9445 }, { "timestamp": "2026-05-28 22:53:48,919", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9446 }, { "timestamp": "2026-05-28 22:53:48,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9447 }, { "timestamp": "2026-05-28 22:53:48,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9448 }, { "timestamp": "2026-05-28 22:53:49,934", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9449 }, { "timestamp": "2026-05-28 22:53:49,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9450 }, { "timestamp": "2026-05-28 22:53:49,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9451 }, { "timestamp": "2026-05-28 22:53:50,934", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9452 }, { "timestamp": "2026-05-28 22:53:50,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9453 }, { "timestamp": "2026-05-28 22:53:50,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9454 }, { "timestamp": "2026-05-28 22:53:51,934", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9455 }, { "timestamp": "2026-05-28 22:53:51,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9456 }, { "timestamp": "2026-05-28 22:53:51,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9457 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9458 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9459 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9460 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9461 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9462 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9463 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9464 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9465 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9466 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9467 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "9" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9468 }, { "timestamp": "2026-05-28 22:53:52,606", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9469 }, { "timestamp": "2026-05-28 22:53:52,934", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9470 }, { "timestamp": "2026-05-28 22:53:52,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9471 }, { "timestamp": "2026-05-28 22:53:52,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9472 }, { "timestamp": "2026-05-28 22:53:53,934", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9473 }, { "timestamp": "2026-05-28 22:53:53,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9474 }, { "timestamp": "2026-05-28 22:53:53,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9475 }, { "timestamp": "2026-05-28 22:53:54,950", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9476 }, { "timestamp": "2026-05-28 22:53:54,950", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9477 }, { "timestamp": "2026-05-28 22:53:54,950", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9478 }, { "timestamp": "2026-05-28 22:53:55,965", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9479 }, { "timestamp": "2026-05-28 22:53:55,965", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9480 }, { "timestamp": "2026-05-28 22:53:55,965", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9481 }, { "timestamp": "2026-05-28 22:53:56,965", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9482 }, { "timestamp": "2026-05-28 22:53:56,965", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9483 }, { "timestamp": "2026-05-28 22:53:56,965", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9484 }, { "timestamp": "2026-05-28 22:53:57,512", "thread_id": "6952", "caller": "0x69b9ec3a", "parentcaller": "0x69b9ebfd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9485 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9486 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9487 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9488 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9489 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9490 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9491 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9492 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9493 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9494 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9495 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "10" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9496 }, { "timestamp": "2026-05-28 22:53:57,622", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9497 }, { "timestamp": "2026-05-28 22:53:57,981", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9498 }, { "timestamp": "2026-05-28 22:53:57,981", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9499 }, { "timestamp": "2026-05-28 22:53:57,981", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9500 }, { "timestamp": "2026-05-28 22:53:58,997", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9501 }, { "timestamp": "2026-05-28 22:53:58,997", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9502 }, { "timestamp": "2026-05-28 22:53:58,997", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9503 }, { "timestamp": "2026-05-28 22:54:00,012", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9504 }, { "timestamp": "2026-05-28 22:54:00,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9505 }, { "timestamp": "2026-05-28 22:54:00,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9506 }, { "timestamp": "2026-05-28 22:54:00,606", "thread_id": "3052", "caller": "0x77b2b6b6", "parentcaller": "0x77af607c", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3052" } ], "repeated": 0, "id": 9507 }, { "timestamp": "2026-05-28 22:54:00,606", "thread_id": "3052", "caller": "0x77b2b6d9", "parentcaller": "0x77af607c", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 9508 }, { "timestamp": "2026-05-28 22:54:00,606", "thread_id": "2016", "caller": "0x77b2b6b6", "parentcaller": "0x77af607c", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2016" } ], "repeated": 0, "id": 9509 }, { "timestamp": "2026-05-28 22:54:00,606", "thread_id": "2016", "caller": "0x77b2b6d9", "parentcaller": "0x77af607c", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 9510 }, { "timestamp": "2026-05-28 22:54:00,653", "thread_id": "6952", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 9511 }, { "timestamp": "2026-05-28 22:54:00,653", "thread_id": "6952", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 9512 }, { "timestamp": "2026-05-28 22:54:00,653", "thread_id": "6952", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9513 }, { "timestamp": "2026-05-28 22:54:00,653", "thread_id": "6952", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 9514 }, { "timestamp": "2026-05-28 22:54:01,012", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9515 }, { "timestamp": "2026-05-28 22:54:01,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9516 }, { "timestamp": "2026-05-28 22:54:01,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9517 }, { "timestamp": "2026-05-28 22:54:02,012", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9518 }, { "timestamp": "2026-05-28 22:54:02,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9519 }, { "timestamp": "2026-05-28 22:54:02,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9520 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9521 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 9522 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9523 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9524 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 9525 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9526 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9527 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9528 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 9529 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9530 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "11" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9531 }, { "timestamp": "2026-05-28 22:54:02,622", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 9532 }, { "timestamp": "2026-05-28 22:54:03,028", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9533 }, { "timestamp": "2026-05-28 22:54:03,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9534 }, { "timestamp": "2026-05-28 22:54:03,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9535 }, { "timestamp": "2026-05-28 22:54:04,028", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9536 }, { "timestamp": "2026-05-28 22:54:04,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9537 }, { "timestamp": "2026-05-28 22:54:04,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9538 }, { "timestamp": "2026-05-28 22:54:05,028", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9539 }, { "timestamp": "2026-05-28 22:54:05,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9540 }, { "timestamp": "2026-05-28 22:54:05,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9541 }, { "timestamp": "2026-05-28 22:54:06,059", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9542 }, { "timestamp": "2026-05-28 22:54:06,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9543 }, { "timestamp": "2026-05-28 22:54:06,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9544 }, { "timestamp": "2026-05-28 22:54:07,059", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9545 }, { "timestamp": "2026-05-28 22:54:07,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9546 }, { "timestamp": "2026-05-28 22:54:07,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9547 }, { "timestamp": "2026-05-28 22:54:07,465", "thread_id": "6952", "caller": "0x7798ac59", "parentcaller": "0x7798abb2", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9548 }, { "timestamp": "2026-05-28 22:54:07,465", "thread_id": "6952", "caller": "0x7798ab1a", "parentcaller": "0x69b9e5e1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" } ], "repeated": 0, "id": 9549 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9550 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9551 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9552 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9553 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9554 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9555 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9556 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9557 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9558 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9559 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "12" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9560 }, { "timestamp": "2026-05-28 22:54:07,637", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9561 }, { "timestamp": "2026-05-28 22:54:08,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9562 }, { "timestamp": "2026-05-28 22:54:08,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9563 }, { "timestamp": "2026-05-28 22:54:08,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9564 }, { "timestamp": "2026-05-28 22:54:09,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9565 }, { "timestamp": "2026-05-28 22:54:09,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9566 }, { "timestamp": "2026-05-28 22:54:09,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9567 }, { "timestamp": "2026-05-28 22:54:09,903", "thread_id": "6212", "caller": "0x77999924", "parentcaller": "0x76c1c2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9568 }, { "timestamp": "2026-05-28 22:54:10,090", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9569 }, { "timestamp": "2026-05-28 22:54:10,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9570 }, { "timestamp": "2026-05-28 22:54:10,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9571 }, { "timestamp": "2026-05-28 22:54:11,106", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9572 }, { "timestamp": "2026-05-28 22:54:11,106", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9573 }, { "timestamp": "2026-05-28 22:54:11,106", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9574 }, { "timestamp": "2026-05-28 22:54:12,122", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9575 }, { "timestamp": "2026-05-28 22:54:12,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9576 }, { "timestamp": "2026-05-28 22:54:12,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9577 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9578 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9579 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9580 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9581 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9582 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9583 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9584 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "12" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9585 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9586 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9587 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "13" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9588 }, { "timestamp": "2026-05-28 22:54:12,637", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9589 }, { "timestamp": "2026-05-28 22:54:13,059", "thread_id": "6952", "caller": "0x69b9ec3a", "parentcaller": "0x69b9ebfd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 9590 }, { "timestamp": "2026-05-28 22:54:13,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9591 }, { "timestamp": "2026-05-28 22:54:13,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9592 }, { "timestamp": "2026-05-28 22:54:14,122", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9593 }, { "timestamp": "2026-05-28 22:54:14,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9594 }, { "timestamp": "2026-05-28 22:54:14,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9595 }, { "timestamp": "2026-05-28 22:54:15,122", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9596 }, { "timestamp": "2026-05-28 22:54:15,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9597 }, { "timestamp": "2026-05-28 22:54:15,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9598 }, { "timestamp": "2026-05-28 22:54:16,137", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9599 }, { "timestamp": "2026-05-28 22:54:16,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9600 }, { "timestamp": "2026-05-28 22:54:16,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9601 }, { "timestamp": "2026-05-28 22:54:17,137", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9602 }, { "timestamp": "2026-05-28 22:54:17,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9603 }, { "timestamp": "2026-05-28 22:54:17,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9604 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9605 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9606 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9607 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9608 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9609 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9610 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9611 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "13" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9612 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9613 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000478" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9614 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "14" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9615 }, { "timestamp": "2026-05-28 22:54:17,669", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 9616 }, { "timestamp": "2026-05-28 22:54:18,153", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9617 }, { "timestamp": "2026-05-28 22:54:18,153", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9618 }, { "timestamp": "2026-05-28 22:54:18,153", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9619 }, { "timestamp": "2026-05-28 22:54:19,153", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9620 }, { "timestamp": "2026-05-28 22:54:19,153", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9621 }, { "timestamp": "2026-05-28 22:54:19,153", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9622 }, { "timestamp": "2026-05-28 22:54:20,169", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9623 }, { "timestamp": "2026-05-28 22:54:20,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9624 }, { "timestamp": "2026-05-28 22:54:20,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9625 }, { "timestamp": "2026-05-28 22:54:21,169", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9626 }, { "timestamp": "2026-05-28 22:54:21,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9627 }, { "timestamp": "2026-05-28 22:54:21,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9628 }, { "timestamp": "2026-05-28 22:54:22,169", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9629 }, { "timestamp": "2026-05-28 22:54:22,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9630 }, { "timestamp": "2026-05-28 22:54:22,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9631 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9632 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9633 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9634 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9635 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9636 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9637 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9638 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9639 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9640 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9641 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "15" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9642 }, { "timestamp": "2026-05-28 22:54:22,669", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9643 }, { "timestamp": "2026-05-28 22:54:23,169", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9644 }, { "timestamp": "2026-05-28 22:54:23,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9645 }, { "timestamp": "2026-05-28 22:54:23,169", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9646 }, { "timestamp": "2026-05-28 22:54:24,184", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9647 }, { "timestamp": "2026-05-28 22:54:24,184", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9648 }, { "timestamp": "2026-05-28 22:54:24,184", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9649 }, { "timestamp": "2026-05-28 22:54:25,184", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9650 }, { "timestamp": "2026-05-28 22:54:25,184", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9651 }, { "timestamp": "2026-05-28 22:54:25,184", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9652 }, { "timestamp": "2026-05-28 22:54:26,184", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9653 }, { "timestamp": "2026-05-28 22:54:26,184", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9654 }, { "timestamp": "2026-05-28 22:54:26,184", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9655 }, { "timestamp": "2026-05-28 22:54:27,200", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9656 }, { "timestamp": "2026-05-28 22:54:27,200", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9657 }, { "timestamp": "2026-05-28 22:54:27,200", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9658 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9659 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9660 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9661 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9662 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9663 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9664 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9665 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "15" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9666 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9667 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9668 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9669 }, { "timestamp": "2026-05-28 22:54:27,669", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9670 }, { "timestamp": "2026-05-28 22:54:28,215", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9671 }, { "timestamp": "2026-05-28 22:54:28,215", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9672 }, { "timestamp": "2026-05-28 22:54:28,215", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9673 }, { "timestamp": "2026-05-28 22:54:29,231", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9674 }, { "timestamp": "2026-05-28 22:54:29,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9675 }, { "timestamp": "2026-05-28 22:54:29,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9676 }, { "timestamp": "2026-05-28 22:54:30,231", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9677 }, { "timestamp": "2026-05-28 22:54:30,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9678 }, { "timestamp": "2026-05-28 22:54:30,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9679 }, { "timestamp": "2026-05-28 22:54:31,231", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9680 }, { "timestamp": "2026-05-28 22:54:31,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9681 }, { "timestamp": "2026-05-28 22:54:31,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9682 }, { "timestamp": "2026-05-28 22:54:32,231", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9683 }, { "timestamp": "2026-05-28 22:54:32,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9684 }, { "timestamp": "2026-05-28 22:54:32,231", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9685 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9686 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9687 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9688 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9689 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9690 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9691 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9692 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "16" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9693 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9694 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9695 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "17" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9696 }, { "timestamp": "2026-05-28 22:54:32,669", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9697 }, { "timestamp": "2026-05-28 22:54:33,247", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9698 }, { "timestamp": "2026-05-28 22:54:33,247", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9699 }, { "timestamp": "2026-05-28 22:54:33,247", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9700 }, { "timestamp": "2026-05-28 22:54:34,247", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9701 }, { "timestamp": "2026-05-28 22:54:34,247", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9702 }, { "timestamp": "2026-05-28 22:54:34,247", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9703 }, { "timestamp": "2026-05-28 22:54:35,262", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9704 }, { "timestamp": "2026-05-28 22:54:35,262", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9705 }, { "timestamp": "2026-05-28 22:54:35,262", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9706 }, { "timestamp": "2026-05-28 22:54:36,278", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9707 }, { "timestamp": "2026-05-28 22:54:36,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9708 }, { "timestamp": "2026-05-28 22:54:36,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9709 }, { "timestamp": "2026-05-28 22:54:37,278", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9710 }, { "timestamp": "2026-05-28 22:54:37,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9711 }, { "timestamp": "2026-05-28 22:54:37,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9712 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9713 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9714 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9715 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9716 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9717 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9718 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9719 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "17" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9720 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9721 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9722 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "18" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9723 }, { "timestamp": "2026-05-28 22:54:37,669", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9724 }, { "timestamp": "2026-05-28 22:54:38,278", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9725 }, { "timestamp": "2026-05-28 22:54:38,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9726 }, { "timestamp": "2026-05-28 22:54:38,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9727 }, { "timestamp": "2026-05-28 22:54:39,278", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9728 }, { "timestamp": "2026-05-28 22:54:39,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9729 }, { "timestamp": "2026-05-28 22:54:39,278", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9730 }, { "timestamp": "2026-05-28 22:54:39,903", "thread_id": "6952", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 9731 }, { "timestamp": "2026-05-28 22:54:39,903", "thread_id": "6952", "caller": "0x76c1fc08", "parentcaller": "0x76c1fabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9732 }, { "timestamp": "2026-05-28 22:54:40,294", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9733 }, { "timestamp": "2026-05-28 22:54:40,294", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9734 }, { "timestamp": "2026-05-28 22:54:40,294", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9735 }, { "timestamp": "2026-05-28 22:54:41,309", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9736 }, { "timestamp": "2026-05-28 22:54:41,309", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9737 }, { "timestamp": "2026-05-28 22:54:41,309", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9738 }, { "timestamp": "2026-05-28 22:54:42,309", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9739 }, { "timestamp": "2026-05-28 22:54:42,309", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9740 }, { "timestamp": "2026-05-28 22:54:42,309", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9741 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9742 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9743 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9744 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9745 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9746 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9747 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9748 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "18" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9749 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9750 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9751 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "19" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9752 }, { "timestamp": "2026-05-28 22:54:42,669", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9753 }, { "timestamp": "2026-05-28 22:54:43,325", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9754 }, { "timestamp": "2026-05-28 22:54:43,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9755 }, { "timestamp": "2026-05-28 22:54:43,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9756 }, { "timestamp": "2026-05-28 22:54:44,325", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9757 }, { "timestamp": "2026-05-28 22:54:44,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9758 }, { "timestamp": "2026-05-28 22:54:44,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9759 }, { "timestamp": "2026-05-28 22:54:45,325", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9760 }, { "timestamp": "2026-05-28 22:54:45,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9761 }, { "timestamp": "2026-05-28 22:54:45,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9762 }, { "timestamp": "2026-05-28 22:54:46,325", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9763 }, { "timestamp": "2026-05-28 22:54:46,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9764 }, { "timestamp": "2026-05-28 22:54:46,325", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9765 }, { "timestamp": "2026-05-28 22:54:47,340", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9766 }, { "timestamp": "2026-05-28 22:54:47,340", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9767 }, { "timestamp": "2026-05-28 22:54:47,340", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9768 }, { "timestamp": "2026-05-28 22:54:47,512", "thread_id": "6952", "caller": "0x69b9ec3a", "parentcaller": "0x69b9ebfd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9769 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9770 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9771 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9772 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9773 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9774 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9775 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9776 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "19" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9777 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9778 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9779 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "20" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9780 }, { "timestamp": "2026-05-28 22:54:47,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9781 }, { "timestamp": "2026-05-28 22:54:48,356", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9782 }, { "timestamp": "2026-05-28 22:54:48,356", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9783 }, { "timestamp": "2026-05-28 22:54:48,356", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9784 }, { "timestamp": "2026-05-28 22:54:49,356", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9785 }, { "timestamp": "2026-05-28 22:54:49,356", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9786 }, { "timestamp": "2026-05-28 22:54:49,356", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9787 }, { "timestamp": "2026-05-28 22:54:50,372", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9788 }, { "timestamp": "2026-05-28 22:54:50,372", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9789 }, { "timestamp": "2026-05-28 22:54:50,372", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9790 }, { "timestamp": "2026-05-28 22:54:51,387", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9791 }, { "timestamp": "2026-05-28 22:54:51,387", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9792 }, { "timestamp": "2026-05-28 22:54:51,387", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9793 }, { "timestamp": "2026-05-28 22:54:52,387", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9794 }, { "timestamp": "2026-05-28 22:54:52,387", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9795 }, { "timestamp": "2026-05-28 22:54:52,387", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9796 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9797 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9798 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9799 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9800 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9801 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9802 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9803 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "20" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9804 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9805 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000318" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9806 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "21" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9807 }, { "timestamp": "2026-05-28 22:54:52,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 9808 }, { "timestamp": "2026-05-28 22:54:53,403", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9809 }, { "timestamp": "2026-05-28 22:54:53,403", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9810 }, { "timestamp": "2026-05-28 22:54:53,403", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9811 }, { "timestamp": "2026-05-28 22:54:54,403", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9812 }, { "timestamp": "2026-05-28 22:54:54,403", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9813 }, { "timestamp": "2026-05-28 22:54:54,403", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9814 }, { "timestamp": "2026-05-28 22:54:55,403", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9815 }, { "timestamp": "2026-05-28 22:54:55,403", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9816 }, { "timestamp": "2026-05-28 22:54:55,403", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9817 }, { "timestamp": "2026-05-28 22:54:56,419", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9818 }, { "timestamp": "2026-05-28 22:54:56,419", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9819 }, { "timestamp": "2026-05-28 22:54:56,419", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9820 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6952", "caller": "0x69b9b181", "parentcaller": "0x69b9b062", "category": "network", "api": "shutdown", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" }, { "name": "how", "value": "1" } ], "repeated": 0, "id": 9821 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6952", "caller": "0x69b9b188", "parentcaller": "0x69b9b062", "category": "network", "api": "closesocket", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1720" } ], "repeated": 0, "id": 9822 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6952", "caller": "0x69b9b181", "parentcaller": "0x69b9b062", "category": "network", "api": "shutdown", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" }, { "name": "how", "value": "1" } ], "repeated": 0, "id": 9823 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6952", "caller": "0x69b9b188", "parentcaller": "0x69b9b062", "category": "network", "api": "closesocket", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1748" } ], "repeated": 0, "id": 9824 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6952", "caller": "0x69b9b181", "parentcaller": "0x69b9b062", "category": "network", "api": "shutdown", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" }, { "name": "how", "value": "1" } ], "repeated": 0, "id": 9825 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6952", "caller": "0x69b9b188", "parentcaller": "0x69b9b062", "category": "network", "api": "closesocket", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1396" } ], "repeated": 0, "id": 9826 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6220", "caller": "0x74d98526", "parentcaller": "0x74da2dca", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`t\\x00(\\x08\\x00\\x00L\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6220" } ], "repeated": 0, "id": 9827 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6948", "caller": "0x74d98526", "parentcaller": "0x74da2dca", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 u\\x00(\\x08\\x00\\x00$\\x1b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6948" } ], "repeated": 0, "id": 9828 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6216", "caller": "0x74d9788f", "parentcaller": "0x74da1c3f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x000t\\x00(\\x08\\x00\\x00H\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6216" } ], "repeated": 0, "id": 9829 }, { "timestamp": "2026-05-28 22:54:56,887", "thread_id": "6216", "caller": "0x74d98526", "parentcaller": "0x74da2dca", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x000t\\x00(\\x08\\x00\\x00H\\x18\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6216" } ], "repeated": 0, "id": 9830 }, { "timestamp": "2026-05-28 22:54:57,434", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9831 }, { "timestamp": "2026-05-28 22:54:57,434", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9832 }, { "timestamp": "2026-05-28 22:54:57,434", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9833 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9834 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9835 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9836 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9837 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9838 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9839 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9840 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "21" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9841 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9842 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9843 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "22" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9844 }, { "timestamp": "2026-05-28 22:54:57,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9845 }, { "timestamp": "2026-05-28 22:54:58,450", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9846 }, { "timestamp": "2026-05-28 22:54:58,450", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9847 }, { "timestamp": "2026-05-28 22:54:58,450", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9848 }, { "timestamp": "2026-05-28 22:54:59,465", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9849 }, { "timestamp": "2026-05-28 22:54:59,465", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9850 }, { "timestamp": "2026-05-28 22:54:59,465", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9851 }, { "timestamp": "2026-05-28 22:55:00,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9852 }, { "timestamp": "2026-05-28 22:55:00,481", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9853 }, { "timestamp": "2026-05-28 22:55:00,481", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9854 }, { "timestamp": "2026-05-28 22:55:01,481", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9855 }, { "timestamp": "2026-05-28 22:55:01,481", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9856 }, { "timestamp": "2026-05-28 22:55:01,481", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9857 }, { "timestamp": "2026-05-28 22:55:02,497", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9858 }, { "timestamp": "2026-05-28 22:55:02,497", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9859 }, { "timestamp": "2026-05-28 22:55:02,497", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9860 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9861 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9862 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9863 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9864 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9865 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9866 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9867 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "22" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9868 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9869 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9870 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "23" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9871 }, { "timestamp": "2026-05-28 22:55:02,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9872 }, { "timestamp": "2026-05-28 22:55:03,059", "thread_id": "6216", "caller": "0x69b9ec3a", "parentcaller": "0x69b9ebfd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 9873 }, { "timestamp": "2026-05-28 22:55:03,497", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9874 }, { "timestamp": "2026-05-28 22:55:03,497", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9875 }, { "timestamp": "2026-05-28 22:55:04,512", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9876 }, { "timestamp": "2026-05-28 22:55:04,512", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9877 }, { "timestamp": "2026-05-28 22:55:04,512", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9878 }, { "timestamp": "2026-05-28 22:55:05,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9879 }, { "timestamp": "2026-05-28 22:55:05,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9880 }, { "timestamp": "2026-05-28 22:55:05,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9881 }, { "timestamp": "2026-05-28 22:55:06,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9882 }, { "timestamp": "2026-05-28 22:55:06,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9883 }, { "timestamp": "2026-05-28 22:55:06,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9884 }, { "timestamp": "2026-05-28 22:55:07,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9885 }, { "timestamp": "2026-05-28 22:55:07,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9886 }, { "timestamp": "2026-05-28 22:55:07,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9887 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9888 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9889 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9890 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9891 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9892 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9893 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9894 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "23" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9895 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9896 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9897 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "24" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9898 }, { "timestamp": "2026-05-28 22:55:07,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9899 }, { "timestamp": "2026-05-28 22:55:08,528", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9900 }, { "timestamp": "2026-05-28 22:55:08,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9901 }, { "timestamp": "2026-05-28 22:55:08,528", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9902 }, { "timestamp": "2026-05-28 22:55:09,544", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9903 }, { "timestamp": "2026-05-28 22:55:09,544", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9904 }, { "timestamp": "2026-05-28 22:55:09,544", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9905 }, { "timestamp": "2026-05-28 22:55:10,559", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9906 }, { "timestamp": "2026-05-28 22:55:10,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9907 }, { "timestamp": "2026-05-28 22:55:10,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9908 }, { "timestamp": "2026-05-28 22:55:11,559", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9909 }, { "timestamp": "2026-05-28 22:55:11,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9910 }, { "timestamp": "2026-05-28 22:55:11,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9911 }, { "timestamp": "2026-05-28 22:55:12,559", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9912 }, { "timestamp": "2026-05-28 22:55:12,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9913 }, { "timestamp": "2026-05-28 22:55:12,559", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9914 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9915 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9916 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9917 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9918 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9919 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9920 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9921 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "24" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9922 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9923 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9924 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "25" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9925 }, { "timestamp": "2026-05-28 22:55:12,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9926 }, { "timestamp": "2026-05-28 22:55:13,575", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9927 }, { "timestamp": "2026-05-28 22:55:13,575", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9928 }, { "timestamp": "2026-05-28 22:55:13,575", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9929 }, { "timestamp": "2026-05-28 22:55:14,590", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9930 }, { "timestamp": "2026-05-28 22:55:14,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9931 }, { "timestamp": "2026-05-28 22:55:14,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9932 }, { "timestamp": "2026-05-28 22:55:15,590", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9933 }, { "timestamp": "2026-05-28 22:55:15,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9934 }, { "timestamp": "2026-05-28 22:55:15,590", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9935 }, { "timestamp": "2026-05-28 22:55:16,606", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9936 }, { "timestamp": "2026-05-28 22:55:16,606", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9937 }, { "timestamp": "2026-05-28 22:55:16,606", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9938 }, { "timestamp": "2026-05-28 22:55:17,622", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9939 }, { "timestamp": "2026-05-28 22:55:17,622", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9940 }, { "timestamp": "2026-05-28 22:55:17,622", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9941 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9942 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9943 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9944 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9945 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9946 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9947 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9948 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "25" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9949 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9950 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9951 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "26" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9952 }, { "timestamp": "2026-05-28 22:55:17,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9953 }, { "timestamp": "2026-05-28 22:55:18,622", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9954 }, { "timestamp": "2026-05-28 22:55:18,622", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9955 }, { "timestamp": "2026-05-28 22:55:18,622", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9956 }, { "timestamp": "2026-05-28 22:55:19,637", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9957 }, { "timestamp": "2026-05-28 22:55:19,637", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9958 }, { "timestamp": "2026-05-28 22:55:19,637", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9959 }, { "timestamp": "2026-05-28 22:55:20,637", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9960 }, { "timestamp": "2026-05-28 22:55:20,637", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9961 }, { "timestamp": "2026-05-28 22:55:20,637", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9962 }, { "timestamp": "2026-05-28 22:55:21,653", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9963 }, { "timestamp": "2026-05-28 22:55:21,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9964 }, { "timestamp": "2026-05-28 22:55:21,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9965 }, { "timestamp": "2026-05-28 22:55:22,653", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9966 }, { "timestamp": "2026-05-28 22:55:22,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9967 }, { "timestamp": "2026-05-28 22:55:22,653", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9968 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9969 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9970 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9971 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9972 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9973 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9974 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9975 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "26" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9976 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9977 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9978 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "27" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9979 }, { "timestamp": "2026-05-28 22:55:22,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 9980 }, { "timestamp": "2026-05-28 22:55:23,669", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9981 }, { "timestamp": "2026-05-28 22:55:23,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9982 }, { "timestamp": "2026-05-28 22:55:23,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9983 }, { "timestamp": "2026-05-28 22:55:24,669", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9984 }, { "timestamp": "2026-05-28 22:55:24,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9985 }, { "timestamp": "2026-05-28 22:55:24,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9986 }, { "timestamp": "2026-05-28 22:55:25,669", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9987 }, { "timestamp": "2026-05-28 22:55:25,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9988 }, { "timestamp": "2026-05-28 22:55:25,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9989 }, { "timestamp": "2026-05-28 22:55:26,669", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9990 }, { "timestamp": "2026-05-28 22:55:26,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 9991 }, { "timestamp": "2026-05-28 22:55:26,669", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 9992 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 9993 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9994 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9995 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9996 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 9997 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 9998 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 9999 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "27" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10000 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10001 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10002 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "28" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10003 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10004 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10005 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10006 }, { "timestamp": "2026-05-28 22:55:27,684", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10007 }, { "timestamp": "2026-05-28 22:55:28,700", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10008 }, { "timestamp": "2026-05-28 22:55:28,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10009 }, { "timestamp": "2026-05-28 22:55:28,700", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10010 }, { "timestamp": "2026-05-28 22:55:29,715", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10011 }, { "timestamp": "2026-05-28 22:55:29,715", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10012 }, { "timestamp": "2026-05-28 22:55:29,715", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10013 }, { "timestamp": "2026-05-28 22:55:30,715", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10014 }, { "timestamp": "2026-05-28 22:55:30,715", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10015 }, { "timestamp": "2026-05-28 22:55:30,715", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10016 }, { "timestamp": "2026-05-28 22:55:31,731", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10017 }, { "timestamp": "2026-05-28 22:55:31,731", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10018 }, { "timestamp": "2026-05-28 22:55:31,731", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10019 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10020 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10021 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10022 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10023 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10024 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10025 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10026 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "28" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10027 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10028 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10029 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "29" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10030 }, { "timestamp": "2026-05-28 22:55:32,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10031 }, { "timestamp": "2026-05-28 22:55:32,731", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10032 }, { "timestamp": "2026-05-28 22:55:32,731", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10033 }, { "timestamp": "2026-05-28 22:55:32,731", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10034 }, { "timestamp": "2026-05-28 22:55:33,747", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10035 }, { "timestamp": "2026-05-28 22:55:33,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10036 }, { "timestamp": "2026-05-28 22:55:33,747", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10037 }, { "timestamp": "2026-05-28 22:55:34,762", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10038 }, { "timestamp": "2026-05-28 22:55:34,762", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10039 }, { "timestamp": "2026-05-28 22:55:34,762", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10040 }, { "timestamp": "2026-05-28 22:55:35,778", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10041 }, { "timestamp": "2026-05-28 22:55:35,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10042 }, { "timestamp": "2026-05-28 22:55:35,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10043 }, { "timestamp": "2026-05-28 22:55:36,778", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10044 }, { "timestamp": "2026-05-28 22:55:36,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10045 }, { "timestamp": "2026-05-28 22:55:36,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10046 }, { "timestamp": "2026-05-28 22:55:37,512", "thread_id": "6216", "caller": "0x69b9ec3a", "parentcaller": "0x69b9ebfd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10047 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10048 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10049 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10050 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10051 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10052 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10053 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10054 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "29" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10055 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10056 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10057 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "30" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10058 }, { "timestamp": "2026-05-28 22:55:37,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10059 }, { "timestamp": "2026-05-28 22:55:37,778", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10060 }, { "timestamp": "2026-05-28 22:55:37,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10061 }, { "timestamp": "2026-05-28 22:55:37,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10062 }, { "timestamp": "2026-05-28 22:55:38,778", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10063 }, { "timestamp": "2026-05-28 22:55:38,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10064 }, { "timestamp": "2026-05-28 22:55:38,778", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10065 }, { "timestamp": "2026-05-28 22:55:39,794", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10066 }, { "timestamp": "2026-05-28 22:55:39,794", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10067 }, { "timestamp": "2026-05-28 22:55:39,794", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10068 }, { "timestamp": "2026-05-28 22:55:40,809", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10069 }, { "timestamp": "2026-05-28 22:55:40,809", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10070 }, { "timestamp": "2026-05-28 22:55:40,809", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10071 }, { "timestamp": "2026-05-28 22:55:41,809", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10072 }, { "timestamp": "2026-05-28 22:55:41,809", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10073 }, { "timestamp": "2026-05-28 22:55:41,809", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10074 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10075 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10076 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10077 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10078 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10079 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10080 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10081 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "30" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10082 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10083 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10084 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "31" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10085 }, { "timestamp": "2026-05-28 22:55:42,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10086 }, { "timestamp": "2026-05-28 22:55:42,825", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10087 }, { "timestamp": "2026-05-28 22:55:42,825", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10088 }, { "timestamp": "2026-05-28 22:55:42,825", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10089 }, { "timestamp": "2026-05-28 22:55:43,825", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10090 }, { "timestamp": "2026-05-28 22:55:43,825", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10091 }, { "timestamp": "2026-05-28 22:55:43,825", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10092 }, { "timestamp": "2026-05-28 22:55:44,840", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10093 }, { "timestamp": "2026-05-28 22:55:44,840", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10094 }, { "timestamp": "2026-05-28 22:55:44,840", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10095 }, { "timestamp": "2026-05-28 22:55:45,856", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10096 }, { "timestamp": "2026-05-28 22:55:45,856", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10097 }, { "timestamp": "2026-05-28 22:55:45,856", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10098 }, { "timestamp": "2026-05-28 22:55:46,872", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10099 }, { "timestamp": "2026-05-28 22:55:46,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10100 }, { "timestamp": "2026-05-28 22:55:46,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10101 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10102 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10103 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10104 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10105 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10106 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10107 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10108 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "31" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10109 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10110 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10111 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "32" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10112 }, { "timestamp": "2026-05-28 22:55:47,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10113 }, { "timestamp": "2026-05-28 22:55:47,872", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10114 }, { "timestamp": "2026-05-28 22:55:47,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10115 }, { "timestamp": "2026-05-28 22:55:47,872", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10116 }, { "timestamp": "2026-05-28 22:55:48,887", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10117 }, { "timestamp": "2026-05-28 22:55:48,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10118 }, { "timestamp": "2026-05-28 22:55:48,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10119 }, { "timestamp": "2026-05-28 22:55:49,887", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10120 }, { "timestamp": "2026-05-28 22:55:49,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10121 }, { "timestamp": "2026-05-28 22:55:49,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10122 }, { "timestamp": "2026-05-28 22:55:50,887", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10123 }, { "timestamp": "2026-05-28 22:55:50,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10124 }, { "timestamp": "2026-05-28 22:55:50,887", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10125 }, { "timestamp": "2026-05-28 22:55:51,903", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10126 }, { "timestamp": "2026-05-28 22:55:51,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10127 }, { "timestamp": "2026-05-28 22:55:51,903", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10128 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10129 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10130 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10131 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10132 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10133 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10134 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10135 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10136 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10137 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10138 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "33" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10139 }, { "timestamp": "2026-05-28 22:55:52,684", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10140 }, { "timestamp": "2026-05-28 22:55:52,919", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10141 }, { "timestamp": "2026-05-28 22:55:52,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10142 }, { "timestamp": "2026-05-28 22:55:52,919", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10143 }, { "timestamp": "2026-05-28 22:55:53,075", "thread_id": "6216", "caller": "0x69b9ec3a", "parentcaller": "0x69b9ebfd", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 10144 }, { "timestamp": "2026-05-28 22:55:53,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10145 }, { "timestamp": "2026-05-28 22:55:53,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10146 }, { "timestamp": "2026-05-28 22:55:54,934", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10147 }, { "timestamp": "2026-05-28 22:55:54,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10148 }, { "timestamp": "2026-05-28 22:55:54,934", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10149 }, { "timestamp": "2026-05-28 22:55:55,950", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10150 }, { "timestamp": "2026-05-28 22:55:55,950", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10151 }, { "timestamp": "2026-05-28 22:55:55,950", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10152 }, { "timestamp": "2026-05-28 22:55:56,950", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10153 }, { "timestamp": "2026-05-28 22:55:56,950", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10154 }, { "timestamp": "2026-05-28 22:55:56,950", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10155 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10156 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10157 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10158 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10159 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10160 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10161 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10162 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "33" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10163 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10164 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10165 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "34" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10166 }, { "timestamp": "2026-05-28 22:55:57,700", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10167 }, { "timestamp": "2026-05-28 22:55:57,965", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10168 }, { "timestamp": "2026-05-28 22:55:57,965", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10169 }, { "timestamp": "2026-05-28 22:55:57,965", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10170 }, { "timestamp": "2026-05-28 22:55:58,981", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10171 }, { "timestamp": "2026-05-28 22:55:58,981", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10172 }, { "timestamp": "2026-05-28 22:55:58,981", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10173 }, { "timestamp": "2026-05-28 22:55:59,997", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10174 }, { "timestamp": "2026-05-28 22:55:59,997", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10175 }, { "timestamp": "2026-05-28 22:55:59,997", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10176 }, { "timestamp": "2026-05-28 22:56:00,997", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10177 }, { "timestamp": "2026-05-28 22:56:00,997", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10178 }, { "timestamp": "2026-05-28 22:56:00,997", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10179 }, { "timestamp": "2026-05-28 22:56:02,012", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10180 }, { "timestamp": "2026-05-28 22:56:02,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10181 }, { "timestamp": "2026-05-28 22:56:02,012", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10182 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10183 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10184 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10185 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10186 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10187 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10188 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10189 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "34" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10190 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10191 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10192 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "35" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10193 }, { "timestamp": "2026-05-28 22:56:02,700", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10194 }, { "timestamp": "2026-05-28 22:56:03,028", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10195 }, { "timestamp": "2026-05-28 22:56:03,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10196 }, { "timestamp": "2026-05-28 22:56:03,028", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10197 }, { "timestamp": "2026-05-28 22:56:04,044", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10198 }, { "timestamp": "2026-05-28 22:56:04,044", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10199 }, { "timestamp": "2026-05-28 22:56:04,044", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10200 }, { "timestamp": "2026-05-28 22:56:05,059", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10201 }, { "timestamp": "2026-05-28 22:56:05,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10202 }, { "timestamp": "2026-05-28 22:56:05,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10203 }, { "timestamp": "2026-05-28 22:56:06,059", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10204 }, { "timestamp": "2026-05-28 22:56:06,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10205 }, { "timestamp": "2026-05-28 22:56:06,059", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10206 }, { "timestamp": "2026-05-28 22:56:07,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10207 }, { "timestamp": "2026-05-28 22:56:07,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10208 }, { "timestamp": "2026-05-28 22:56:07,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10209 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10210 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10211 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10212 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10213 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10214 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10215 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10216 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "35" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10217 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10218 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10219 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "36" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10220 }, { "timestamp": "2026-05-28 22:56:07,700", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 10221 }, { "timestamp": "2026-05-28 22:56:08,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10222 }, { "timestamp": "2026-05-28 22:56:08,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10223 }, { "timestamp": "2026-05-28 22:56:08,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10224 }, { "timestamp": "2026-05-28 22:56:09,075", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10225 }, { "timestamp": "2026-05-28 22:56:09,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10226 }, { "timestamp": "2026-05-28 22:56:09,075", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10227 }, { "timestamp": "2026-05-28 22:56:10,090", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10228 }, { "timestamp": "2026-05-28 22:56:10,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10229 }, { "timestamp": "2026-05-28 22:56:10,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10230 }, { "timestamp": "2026-05-28 22:56:11,090", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10231 }, { "timestamp": "2026-05-28 22:56:11,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10232 }, { "timestamp": "2026-05-28 22:56:11,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10233 }, { "timestamp": "2026-05-28 22:56:12,090", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10234 }, { "timestamp": "2026-05-28 22:56:12,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10235 }, { "timestamp": "2026-05-28 22:56:12,090", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10236 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10237 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10238 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10239 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10240 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10241 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10242 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10243 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "36" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10244 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10245 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10246 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "37" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10247 }, { "timestamp": "2026-05-28 22:56:12,700", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10248 }, { "timestamp": "2026-05-28 22:56:13,106", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10249 }, { "timestamp": "2026-05-28 22:56:13,106", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10250 }, { "timestamp": "2026-05-28 22:56:13,106", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10251 }, { "timestamp": "2026-05-28 22:56:14,106", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10252 }, { "timestamp": "2026-05-28 22:56:14,106", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10253 }, { "timestamp": "2026-05-28 22:56:14,106", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10254 }, { "timestamp": "2026-05-28 22:56:15,122", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10255 }, { "timestamp": "2026-05-28 22:56:15,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10256 }, { "timestamp": "2026-05-28 22:56:15,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10257 }, { "timestamp": "2026-05-28 22:56:16,122", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10258 }, { "timestamp": "2026-05-28 22:56:16,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10259 }, { "timestamp": "2026-05-28 22:56:16,122", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10260 }, { "timestamp": "2026-05-28 22:56:17,137", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10261 }, { "timestamp": "2026-05-28 22:56:17,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10262 }, { "timestamp": "2026-05-28 22:56:17,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10263 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7d2ac", "parentcaller": "0x00b7b503", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 10264 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7b57c", "parentcaller": "0x00b78bf9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10265 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7c664", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10266 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7c68e", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10267 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7c6cb", "parentcaller": "0x00b788ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10268 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b40e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10269 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10270 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7b436", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Data", "value": "37" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10271 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7b4d4", "parentcaller": "0x00b788c8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10272 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7d114", "parentcaller": "0x00b7b38b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\Setup\\MoSetup\\Volatile" }, { "name": "Handle", "value": "0x00000574" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } ], "repeated": 0, "id": 10273 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7b3b1", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "InstallTicks" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "38" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks" } ], "repeated": 0, "id": 10274 }, { "timestamp": "2026-05-28 22:56:17,762", "thread_id": "6940", "caller": "0x00b7b3e6", "parentcaller": "0x00b78bd2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 10275 }, { "timestamp": "2026-05-28 22:56:18,137", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10276 }, { "timestamp": "2026-05-28 22:56:18,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10277 }, { "timestamp": "2026-05-28 22:56:18,137", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10278 }, { "timestamp": "2026-05-28 22:56:19,153", "thread_id": "4400", "caller": "0x00b693a0", "parentcaller": "0x00b70327", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10279 }, { "timestamp": "2026-05-28 22:56:19,153", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 10280 }, { "timestamp": "2026-05-28 22:56:19,153", "thread_id": "4400", "caller": "0x00b6d8d5", "parentcaller": "0x00b693a0", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000501da" }, { "name": "Message", "value": "0x000083e8" } ], "repeated": 0, "id": 10281 } ], "threads": [ "4400", "64", "2728", "3004", "3036", "2320", "6212", "6216", "6220", "6900", "6936", "6940", "6948", "6952", "6972", "6976", "6980", "3052", "2016" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00b40000", "MainExeSize": "0x000ae000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 760, "process_name": "svchost.exe", "parent_id": 616, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-28 22:53:02,394", "calls": [ { "timestamp": "2026-05-28 22:53:06,644", "thread_id": "856", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\vdsldr.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 22:53:06,644", "thread_id": "856", "caller": "0x7ffcf900c386", "parentcaller": "0x7ffcf900c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18dd8d50000" }, { "name": "SectionOffset", "value": "0x7b627fdcd0" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 22:53:06,644", "thread_id": "856", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014c4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\vdsldr.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 22:53:06,644", "thread_id": "856", "caller": "0x7ffcf900c386", "parentcaller": "0x7ffcf900c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18dd8d50000" }, { "name": "SectionOffset", "value": "0x7b627fdcd0" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 22:53:06,644", "thread_id": "856", "caller": "0x7ffcf8ffc5f2", "parentcaller": "0x7ffcf8ff89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000014d8" }, { "name": "ThreadHandle", "value": "0x000014d4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\System32\\vdsldr.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\System32\\vdsldr.exe -Embedding" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140720308492724" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 22:53:06,660", "thread_id": "856", "caller": "0x7ffcf8ff89f3", "parentcaller": "0x7ffcfabdde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "C:\\Windows\\System32\\vdsldr.exe -Embedding" }, { "name": "CreationFlags", "value": "0x00000410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT" }, { "name": "ProcessId", "value": "6580" }, { "name": "ThreadId", "value": "6584" }, { "name": "ProcessHandle", "value": "0x000014d8" }, { "name": "ThreadHandle", "value": "0x000014d4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 22:53:11,691", "thread_id": "972", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014d8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 22:53:20,144", "thread_id": "1160", "caller": "0x7ffcf93c50aa", "parentcaller": "0x7ffcf93c52e2", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000065c" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\Dev\\Query" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 22:53:20,144", "thread_id": "1160", "caller": "0x7ffcfb425ebd", "parentcaller": "0x7ffcfb425dd8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000065c" }, { "name": "HandleName", "value": "\\Device\\DeviceApi" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x8a\\xf3\\xd8\\x8d\\x01\\x00\\x00" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 22:53:21,738", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000694" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 22:53:25,019", "thread_id": "944", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcf951ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001010" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 22:53:25,097", "thread_id": "972", "caller": "0x7ffcf68a999a", "parentcaller": "0x7ffcf68a975c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000818" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000e7c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 22:53:25,269", "thread_id": "856", "caller": "0x7ffcf68a999a", "parentcaller": "0x7ffcf68a975c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001098" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000fb0" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 22:53:31,675", "thread_id": "856", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 13 }, { "timestamp": "2026-05-28 22:53:51,675", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 22:54:01,691", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 22:54:11,691", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 22:54:21,691", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 22:54:22,253", "thread_id": "972", "caller": "0x7ffcf69a22bd", "parentcaller": "0x7ffcf68ace49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001448" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000818" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 22:54:22,285", "thread_id": "972", "caller": "0x7ffcf69a22bd", "parentcaller": "0x7ffcf68ace49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000014c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000014dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 22:54:22,691", "thread_id": "972", "caller": "0x7ffcf69a22bd", "parentcaller": "0x7ffcf68ace49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000a60" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000a5c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 22:54:22,722", "thread_id": "716", "caller": "0x7ffcf69a22bd", "parentcaller": "0x7ffcf68ace49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000014ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000014f0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 22:54:23,128", "thread_id": "716", "caller": "0x7ffcf69a22bd", "parentcaller": "0x7ffcf68ace49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000137c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000065c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 22:54:23,269", "thread_id": "856", "caller": "0x7ffcf69a22bd", "parentcaller": "0x7ffcf68ace49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001500" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001504" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 22:54:31,691", "thread_id": "856", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001508" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 22:54:41,675", "thread_id": "856", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000013a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 25 }, { "timestamp": "2026-05-28 22:55:01,675", "thread_id": "972", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 22:55:11,675", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000013a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 2, "id": 27 }, { "timestamp": "2026-05-28 22:55:41,691", "thread_id": "716", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 28 }, { "timestamp": "2026-05-28 22:56:01,675", "thread_id": "856", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000df4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 29 } ], "threads": [ "856", "972", "1160", "716", "944" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6cca40000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 5648, "process_name": "svchost.exe", "parent_id": 616, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-28 22:53:04,481", "calls": [ { "timestamp": "2026-05-28 22:53:06,544", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 22:53:06,544", "thread_id": "4908", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 22:53:06,544", "thread_id": "4908", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 22:53:06,559", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 22:53:06,559", "thread_id": "4908", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 22:53:06,559", "thread_id": "4908", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 22:53:06,559", "thread_id": "4908", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 6 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 10 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000548" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000544" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcd8d6dd6a", "parentcaller": "0x7ffcd8d6d989", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 8, "id": 12 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcd8d77e1d", "parentcaller": "0x7ffcd8d77a50", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "81166F58-DD98-11D3-A120-00105A1F515A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x05\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0\\x05\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "4264", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 22:53:06,575", "thread_id": "4484", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 21 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000568" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000554" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000568" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000598" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4484", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 28 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4484", "caller": "0x7ffcd8d72823", "parentcaller": "0x7ffcd8d7978f", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4484", "caller": "0x7ffcd8f5a85f", "parentcaller": "0x7ffcd8f5a778", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4264", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4264", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4590F812-1D3A-11D0-891F-00AA004B2E24" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 39 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x0c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x05\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4908", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 22:53:06,590", "thread_id": "4484", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 46 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x07\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000005ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000568" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000005ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000594" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 54 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcd8d72823", "parentcaller": "0x7ffcd8d7978f", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcd8f5a85f", "parentcaller": "0x7ffcd8f5a778", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4590F812-1D3A-11D0-891F-00AA004B2E24" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 65 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4264", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 70 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000005c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000005c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "5080", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 77 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcd8d72823", "parentcaller": "0x7ffcd8d6ffb3", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4484", "caller": "0x7ffcd8f5a85f", "parentcaller": "0x7ffcd8f5a778", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 22:53:06,606", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4590F812-1D3A-11D0-891F-00AA004B2E24" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x8b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 89 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x04\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 96 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000059c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000568" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x9a\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000554" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000570" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "5080", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@@\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f3d5b5", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 22:53:06,622", "thread_id": "4908", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 22:53:36,653", "thread_id": "4908", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcf9b76d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000558" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 22:53:54,387", "thread_id": "5640", "caller": "0x7ff6cca44340", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 22:53:54,387", "thread_id": "5640", "caller": "0x7ff6cca44340", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 22:53:54,387", "thread_id": "5640", "caller": "0x7ff6cca44340", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 22:53:57,747", "thread_id": "5636", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcf951ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000030c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 22:54:06,715", "thread_id": "5640", "caller": "0x7ff6cca44340", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ES" }, { "name": "DllBase", "value": "0x7ffcf1520000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 22:54:06,715", "thread_id": "5640", "caller": "0x7ff6cca44340", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf1520000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4488", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcef1b46f4", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000498", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcef1b4a00" }, { "name": "Parameter", "value": "0x2b0b22a0970" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7064" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4488", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcef1b46f4", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000004b8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcef1b4a00" }, { "name": "Parameter", "value": "0x2b0b22a0790" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7068" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0 \\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x1d\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0\\x14\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7068", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd906c946", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000444", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd906d7c0" }, { "name": "Parameter", "value": "0x2b0b22a0d80" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "4484" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf8ff4448", "parentcaller": "0x7ffce265041d", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2b0b1ff0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x93\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 ;\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000464" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000448" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7068", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd906c946", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000570", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd906d7c0" }, { "name": "Parameter", "value": "0x2b0b22e4f60" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "5380" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcd8cd4e5e", "parentcaller": "0x7ffcd8cb8ca7", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "A57BE31E-EFE3-11D0-AD71-00C04FD8FDFF" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcef1b46f4", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000568", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcef1b4a00" }, { "name": "Parameter", "value": "0x2b0b22e4b00" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "5456" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcef1b46f4", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000005ac", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcef1b4a00" }, { "name": "Parameter", "value": "0x2b0b22e4ce0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7080" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7064", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd906c946", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000590", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd906d7c0" }, { "name": "Parameter", "value": "0x2b0b22e52d0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "5244" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000424" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000464" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7068", "caller": "0x7ffcd8cc85a4", "parentcaller": "0x7ffcd8cc829c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "7068", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000598" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000424" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x00\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 22:54:18,934", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x11\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\xf8\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5380", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000053c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000548" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\"\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x96\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x14\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x91\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 (\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\xbb\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "7068", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00!\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\xcb\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "7068", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "7068", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 148 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x10\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x17\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000478" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x1d\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000480" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000042c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000480" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000484" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000480" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000470" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd906c946", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000055c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd906d7c0" }, { "name": "Parameter", "value": "0x2b0b2393690" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "3728" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000480" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5244", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd906c946", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000564", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd906d7c0" }, { "name": "Parameter", "value": "0x2b0b22e5e10" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7084" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 '\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "7068", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcef1afcc4", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000578", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcef1af6d0" }, { "name": "Parameter", "value": "0x2b0b2211960" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7088" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x84\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@%\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x0e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc06\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x87\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x02\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0%\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x98\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x1d\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x10\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "7064", "caller": "0x7ffcd8cc85a4", "parentcaller": "0x7ffcd8cc829c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4" }, { "name": "ProgID", "value": "" } ], "repeated": 51, "id": 175 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@%\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000005d4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000678" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 22:54:18,950", "thread_id": "5380", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000044c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000680" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@!\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "5456", "caller": "0x7ffcd8cc85a4", "parentcaller": "0x7ffcd8cc829c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x16\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x11\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "5456", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 185 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "5456", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "5456", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "5456", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 188 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000470" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000484" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000678" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000678" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000680" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000678" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000694" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000678" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000698" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 196 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000540" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000530" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcd8d6dd6a", "parentcaller": "0x7ffcd8d6d989", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 8, "id": 198 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcd8d77e1d", "parentcaller": "0x7ffcd8d77a50", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "81166F58-DD98-11D3-A120-00105A1F515A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x08\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x8f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x1c\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x0e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x86\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0?\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x94\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80&\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcd8cc85a4", "parentcaller": "0x7ffcd8cc829c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000698" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000694" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000698" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000680" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000698" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000698" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000530" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "7064", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-28 22:54:18,965", "thread_id": "4484", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 218 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d79ec9", "parentcaller": "0x7ffcd8d69afd", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8BEBCE8B-1AF0-4323-8B4D-36994567CAE1" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6cae0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 220 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d6410f", "parentcaller": "0x7ffcd8d6cc36", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d79ec9", "parentcaller": "0x7ffcd8d79d5b", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcdc132508", "parentcaller": "0x7ffcdc134a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 223 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcf9ba6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wbem\\ncprov" }, { "name": "DllBase", "value": "0x7ffcf4570000" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcf9ba6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\NCProv.dll" }, { "name": "BaseAddress", "value": "0x7ffcf4570000" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d62b67", "parentcaller": "0x7ffcd8d629af", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "29F06F0C-FB7F-44A5-83CD-D41705D5C525" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "NCProv.NCProvider.1" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d79ec9", "parentcaller": "0x7ffcd8d79d5b", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcd8f58cba", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000694" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000478" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d79ec9", "parentcaller": "0x7ffcd8d79d5b", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcd8f58cba", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000694" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000698" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d72823", "parentcaller": "0x7ffcd8d7a647", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 231 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcd8f58cba", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000694" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000053c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d72823", "parentcaller": "0x7ffcd8d63e1c", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 233 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcd8f58cba", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000053c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000694" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x8b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x11\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x10\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 %\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x18\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xe0\\x12\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0\\x89\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00 \\x12\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcd8d72823", "parentcaller": "0x7ffcd8d63c7c", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E" }, { "name": "ClsContext", "value": "0x00000005", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 248 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcd8f58cba", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000053c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "7064", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcf4574423", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000694", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcf4572e40" }, { "name": "Parameter", "value": "0x2b0b2218cd0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1768" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "3816", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x1001200120000" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 9, "id": 251 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "3816", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd8d4488a", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000540", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd8d43ca0" }, { "name": "Parameter", "value": "0x2b0b229e060" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1788" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "3908", "caller": "0x7ffcf8fd6579", "parentcaller": "0x7ffcf8fd5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x1000d000d0000" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 9, "id": 253 }, { "timestamp": "2026-05-28 22:54:18,981", "thread_id": "3908", "caller": "0x7ffcfabdb8ed", "parentcaller": "0x7ffcd8d4488a", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000484", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcd8d43ca0" }, { "name": "Parameter", "value": "0x2b0b229b7d0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1776" }, { "name": "ProcessId", "value": "5648" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4908", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4908", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4908", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4264", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 258 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4264", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4264", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-28 22:54:23,450", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 264 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5380", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80@\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4908", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f3d5b5", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4264", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5848", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f3d5b5", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5848", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5848", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f3d5b5", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5848", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5848", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f3d5b5", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5848", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcef23359f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll" }, { "name": "BaseAddress", "value": "0x7ffcd9040000" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcef2335f7", "parentcaller": "0x7ffcf9b8b20e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 278 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x80(\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcf900befb", "parentcaller": "0x7ffcd8eba158", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00@\\x01\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5888", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f5a195", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 283 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd8cf677f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5380", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5380", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000678" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "7064", "caller": "0x7ffcd8cc85a4", "parentcaller": "0x7ffcd8cc829c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "7064", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "7064", "caller": "0x7ffcd8d73a1a", "parentcaller": "0x7ffcd9058f9b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "7064", "caller": "0x7ffcef1b2c1e", "parentcaller": "0x7ffcd9059057", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "7064", "caller": "0x7ffcd9056b2d", "parentcaller": "0x7ffcd8d6f3e9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 294 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5380", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006f0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "5244", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-28 22:54:23,465", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-28 22:54:23,481", "thread_id": "5888", "caller": "0x7ffcd8f5a4f0", "parentcaller": "0x7ffcd8f3d5b5", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E7D35CFA-348B-485E-B524-252725D697CA" }, { "name": "ClsContext", "value": "0x80000001", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL" }, { "name": "riid", "value": "D5F569D0-593B-101A-B569-08002B2DBF7A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-28 22:54:23,481", "thread_id": "4484", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcef1ab50c", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-28 22:54:23,481", "thread_id": "5888", "caller": "0x7ffcd9058250", "parentcaller": "0x7ffcf956b583", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "368732C2-80D8-403E-854B-1B2BAFB9842C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-28 22:56:02,325", "thread_id": "5888", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcf9b76d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 304 } ], "threads": [ "4908", "5080", "4484", "4264", "5640", "5636", "4488", "7064", "7068", "5380", "5244", "5456", "3816", "3908", "5848", "5888" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6cca40000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 6580, "process_name": "vdsldr.exe", "parent_id": 760, "module_path": "C:\\Windows\\System32\\vdsldr.exe", "first_seen": "2026-05-28 22:53:06,689", "calls": [ { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ffcfb41c2c7", "parentcaller": "0x7ffcfb41c05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\atl" }, { "name": "BaseAddress", "value": "0x7ffcd8650000" }, { "name": "InitRoutine", "value": "0x7ffcd8651d50" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ffcfb41c2c7", "parentcaller": "0x7ffcfb41c05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcd" }, { "name": "BaseAddress", "value": "0x7ffcd85f0000" }, { "name": "InitRoutine", "value": "0x7ffcd8604cd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ffcd8621dbe", "parentcaller": "0x7ffcf9faa553", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Services\\vds\\DebugLog" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\vds\\DebugLog" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ffcd8621dbe", "parentcaller": "0x7ffcf9faa553", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\vdsutil" }, { "name": "BaseAddress", "value": "0x7ffcd8620000" }, { "name": "InitRoutine", "value": "0x7ffcd8632070" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff608c53c60" }, { "name": "Parameter", "value": "0x1912b1d000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6700", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6700", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffcd8771ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6692", "caller": "0x7ffcfb40eb32", "parentcaller": "0x7ffcfb3c77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 8 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6696", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6696", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffcd8772030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6692", "caller": "0x7ffcfb3be715", "parentcaller": "0x7ffcfb3be37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e74c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6692", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6692", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffcd8771e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6688", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6688", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffcd8771a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c53d41", "parentcaller": "0x7ff608c53ab8", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff608c53cf0" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c539de", "parentcaller": "0x7ff608c53afd", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e74d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c539de", "parentcaller": "0x7ff608c53afd", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x16130207000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c5144c", "parentcaller": "0x7ff608c53bb9", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1612e722376", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\System32\\vdsldr.exe -Embedding" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c514af", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "52" }, { "name": "ProcessInformation", "value": "\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c514ca", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "52" }, { "name": "ProcessInformation", "value": "\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c514e5", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "52" }, { "name": "ProcessInformation", "value": "\t\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51503", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "52" }, { "name": "ProcessInformation", "value": "\n\\x00\\x00\\x00\\x03\\x00\\x00\\x00" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6584" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000244" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000248" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6970000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf697f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6975000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6975000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6975000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6975000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6975000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf6975000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 22:53:06,736", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7ffcf6970000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7ffcf6970000" }, { "name": "InitRoutine", "value": "0x7ffcf6973f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000020c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8d60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8dc7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8dc7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8dc7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8dc7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8dc7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf8dc7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7ffcf8d60000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000200" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000200" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "z\\xb3q\\xe4IH\\x96\\xc1\\xaf;\\x93F\\xf5\\xfa\\x92\\xf5 \\x8d'\\x18\\xa4\\x98\\x85\\x02\\xd9'\\xe5s\\xc9r\\x9e\\xde\\x03q\\x1b\\x9d\"(\\x1b\\x9c\\x8c|Kr\\x0ftr\\xc6" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7ffcf8d60000" }, { "name": "InitRoutine", "value": "0x7ffcf8d98b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf960e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf960e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51513", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e74e000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51626", "parentcaller": "0x7ff608c53bb9", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000248" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff608c51070" }, { "name": "Parameter", "value": "0x7ff608c57680" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6772" }, { "name": "ProcessId", "value": "6580" }, { "name": "Module", "value": "vdsldr.exe" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51626", "parentcaller": "0x7ff608c53bb9", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000248", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff608c51070" }, { "name": "Parameter", "value": "0x7ff608c57680" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6772" }, { "name": "ProcessId", "value": "6580" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5163d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51232", "parentcaller": "0x7ff608c5165c", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 77 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6772", "caller": "0x7ffcfb3be715", "parentcaller": "0x7ffcfb3be37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e754000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6772", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6772", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff608c51070" }, { "name": "Parameter", "value": "0x7ff608c57680" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6772", "caller": "0x7ff608c5108a", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb3b93b0" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb44fc40" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb3f2460" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb40cbd0" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb3b93b0" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb44fc40" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb3f2460" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb42fa30" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb40cbd0" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e756000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000250" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000250" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000250" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xeb\\x8b\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xbd\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x90\\xec\\x8b\\x12\\x19\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x95\\xd8" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "AppID\\vdsldr.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\vdsldr.exe" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddress", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlWow64GetCurrentMachine" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb400d90" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetProcedureAddress", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlWow64IsWowGuestMachineSupported" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb42c670" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "AppID\\vdsldr.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\vdsldr.exe" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xf0\\x8b\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C\\xfd\\xf8\\xfc\\x7f\\x00\\x00\\xf1\\x89\\x96\\xc1~\\xca\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c5172d", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51743", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7ffcfab10000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51743", "parentcaller": "0x7ff608c53bb9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcd8668000" }, { "name": "ModuleName", "value": "ATL.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcd8668000" }, { "name": "ModuleName", "value": "ATL.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}" }, { "name": "Handle", "value": "0x00000286" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\xb0\\xe3\\x8b\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000286" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000286" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000286" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000286" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Virtual Disk Service Loader" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000286" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocServer32" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xe1\\x8b\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000286" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xe1\\x8b\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000286" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000286" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000286" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x000019b4" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.6580" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e75c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000292" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000292" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000296" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000296" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000292" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x88\\xbfs.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90\\xc2s.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\x8fu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8\\xbfs.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\xa1\\xb9\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00`\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00X\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00(\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00H\\xe4\\x8b\\x12" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbfs.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H\\xc0s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0\\xc0s.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(\\x8cu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8\\xc2s.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\x01\\xba\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xc0\\xe0\\x8b\\x12\\x19\\x00\\x00\\x00\\xb8\\xe0\\x8b\\x12\\x19\\x00\\x00\\x00\\x88\\xe0\\x8b\\x12\\x19\\x00\\x00\\x00\\xa8\\xe0\\x8b\\x12" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc2s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xde\\x8b\\x12\\x19\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e75e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffcf9bf2d30" }, { "name": "Parameter", "value": "0x1612e747550" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6780" }, { "name": "ProcessId", "value": "6580" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000298", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffcf9bf2d30" }, { "name": "Parameter", "value": "0x1612e747550" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6780" }, { "name": "ProcessId", "value": "6580" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002ac" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8\\xc2s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xc0s.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\x8bu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xa8\\xc0s.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\xf1\\xbd\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x000\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00(\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00\\xf8\\xe7\\x8b\\x12\\x19\\x00\\x00\\x00\\x18\\xe8\\x8b\\x12" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc0s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\x8b\\x12\\x19\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8\\xc3s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\x96\\xf8\\xfc\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc9s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e760000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90\\x07v.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\x89u.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\x06v.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00Q\\xbe\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x90\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00\\x88\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00X\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00x\\xe4\\x8b\\x12" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x06v.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000298" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8\\xc2s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xc0s.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x8fu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xa8\\xc0s.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\xf1\\xbd\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x000\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00(\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00\\xf8\\xe7\\x8b\\x12\\x19\\x00\\x00\\x00\\x18\\xe8\\x8b\\x12" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc0s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\x8b\\x12\\x19\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8\\xc3s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\x96\\xf8\\xfc\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc9s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x06v.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x8cu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "(\nv.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00Q\\xbe\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x90\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00\\x88\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00X\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00x\\xe4\\x8b\\x12" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \nv.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002ac" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H\\xc0s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0\\xc0s.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x8fu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8\\xc2s.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\xf1\\xbd\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x000\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00(\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00\\xf8\\xe7\\x8b\\x12\\x19\\x00\\x00\\x00\\x18\\xe8\\x8b\\x12" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc2s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\x8b\\x12\\x19\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8\\xc3s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\x96\\xf8\\xfc\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc9s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0\\xfcu.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x89u.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x88\\x01v.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00Q\\xbe\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x90\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00\\x88\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00X\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00x\\xe4\\x8b\\x12" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x01v.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000298" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8\\xc3s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\x96\\xf8\\xfc\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc9s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xc0s.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\x8cu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xa8\\xc0s.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\xf1\\xbd\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x000\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00(\\xe8\\x8b\\x12\\x19\\x00\\x00\\x00\\xf8\\xe7\\x8b\\x12\\x19\\x00\\x00\\x00\\x18\\xe8\\x8b\\x12" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xc0s.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\x8b\\x12\\x19\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8\\xc2s.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x06v.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8\\x8eu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\x03v.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00Q\\xbe\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x90\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00\\x88\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00X\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00x\\xe4\\x8b\\x12" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x03v.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb3be715", "parentcaller": "0x7ffcfb3be37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e762000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffcfb402b30" }, { "name": "Parameter", "value": "0x1612e720b50" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9006f4c", "parentcaller": "0x7ffcf951ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb3be715", "parentcaller": "0x7ffcfb3be37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e763000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e765000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e766000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6788", "caller": "0x7ffcfb42507d", "parentcaller": "0x7ffcfb424c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6788", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffcfb402b30" }, { "name": "Parameter", "value": "0x1612e720b50" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b8" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18Zv.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00Sv.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\x8fu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8Vv.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\x81\\xbf\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00@\\xe6\\x8b\\x12\\x19\\x00\\x00\\x008\\xe6\\x8b\\x12\\x19\\x00\\x00\\x00\\x08\\xe6\\x8b\\x12\\x19\\x00\\x00\\x00(\\xe6\\x8b\\x12" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0Vv.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xe4\\x8b\\x12\\x19\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8Wv.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\v.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x8cu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "XVv.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00a\\xb8\\x96\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\x98\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00h\\xe2\\x8b\\x12\\x19\\x00\\x00\\x00\\x88\\xe2\\x8b\\x12" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PVv.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe0\\x8b\\x12\\x19\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b8" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6584", "caller": "0x7ff608c51765", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd54eb", "parentcaller": "0x7ffcf9b78ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "3\\xcb\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd6785", "parentcaller": "0x7ffcf9b78c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb3be715", "parentcaller": "0x7ffcfb3be37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e768000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c242bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9bcb0b0" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c242e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9bc8b50" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c24313", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9bf9780" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c2433d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9c02e80" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c24367", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9c01b70" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c24391", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9b7a420" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9c243bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9b7e790" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9c241cf", "parentcaller": "0x7ffcfb3f38c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd54eb", "parentcaller": "0x7ffcf9bab0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9bc92b9", "parentcaller": "0x7ffcf9c0224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fc30ce", "parentcaller": "0x7ffcf9c02cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fc30ce", "parentcaller": "0x7ffcf9c02cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ff608c51a25", "parentcaller": "0x7ff608c51cd8", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 338 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9b822bf", "parentcaller": "0x7ffcf9bffbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "Handle", "value": "0x000002ba" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9bffa51", "parentcaller": "0x7ffcf9bc42ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ba" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002b6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9bffa8c", "parentcaller": "0x7ffcf9bc42ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9bffad3", "parentcaller": "0x7ffcf9bc42ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9bffae4", "parentcaller": "0x7ffcf9bc42ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9b87b74", "parentcaller": "0x7ffcf9b853d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "Handle", "value": "0x000002ba" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xbc\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\xbd\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9c122e1", "parentcaller": "0x7ffcf9b87c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b881f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b887bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "VDS ProxyStub" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9b88485", "parentcaller": "0x7ffcf9b8829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ba" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002b6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8ff4aa9", "parentcaller": "0x7ffcf8fd31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\System32\\vds_ps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)" } ], "repeated": 1, "id": 358 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b88d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf9b8855f", "parentcaller": "0x7ffcf9b8829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xba\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x90\\xbb\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xba\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x90\\xbb\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-28 22:53:06,752", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b88010", "parentcaller": "0x7ffcf9b853d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fc30ce", "parentcaller": "0x7ffcf9c02cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fc30ce", "parentcaller": "0x7ffcf9c02cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b87b74", "parentcaller": "0x7ffcf9b853d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "Handle", "value": "0x000002ba" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xb8\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\xc0\\xb9\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9c122e1", "parentcaller": "0x7ffcf9b87c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b881f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b887bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "VDS ProxyStub" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b88485", "parentcaller": "0x7ffcf9b8829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ba" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002b6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8ff4aa9", "parentcaller": "0x7ffcf8fd31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\System32\\vds_ps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)" } ], "repeated": 1, "id": 390 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b88d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b8855f", "parentcaller": "0x7ffcf9b8829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb7\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00P\\xb8\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb7\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00P\\xb8\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b8ab08", "parentcaller": "0x7ffcf9b8a7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ba" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer32" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2e92", "parentcaller": "0x7ffcf9b8a825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ba" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd45a7", "parentcaller": "0x7ffcf8fd0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd2314", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3e6c8b", "parentcaller": "0x7ffcf8fd23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xb6\\xff\\x12\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x95\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x90\\xb7\\xff\\x12\\x19\\x00\\x00\\x00" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd24a8", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd40c4", "parentcaller": "0x7ffcf8fd25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd25e2", "parentcaller": "0x7ffcf8fd0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ba" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b8ad16", "parentcaller": "0x7ffcf9b883b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025e" }, { "name": "SubKey", "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "Handle", "value": "0x000002b6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b8ad4d", "parentcaller": "0x7ffcf9b883b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002b6" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\Elevation" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b8adb1", "parentcaller": "0x7ffcf9b883b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b6" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b88010", "parentcaller": "0x7ffcf9b853d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b822bf", "parentcaller": "0x7ffcf9b825e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" }, { "name": "Handle", "value": "0x000002ba" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9bff8f8", "parentcaller": "0x7ffcf9b8213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ba" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9b82160", "parentcaller": "0x7ffcf9b79277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ba" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fc30ce", "parentcaller": "0x7ffcf9c02cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fc30ce", "parentcaller": "0x7ffcf9c02cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcf9ba6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\vds_ps" }, { "name": "DllBase", "value": "0x7ffcd85d0000" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcf9ba6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\vds_ps.dll" }, { "name": "BaseAddress", "value": "0x7ffcd85d0000" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd56b2", "parentcaller": "0x7ffcf9ba6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffcd85d0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\vds_ps.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9ba6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "vds_ps.dll" }, { "name": "ModuleHandle", "value": "0x7ffcd85d0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcd85d11d0" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9ba6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "vds_ps.dll" }, { "name": "ModuleHandle", "value": "0x7ffcd85d0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9ba6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "vds_ps.dll" }, { "name": "ModuleHandle", "value": "0x7ffcd85d0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcd85d1220" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3f3f7a", "parentcaller": "0x7ffcf9500ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf9500cd1", "parentcaller": "0x7ffcf94ff28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf901026b", "parentcaller": "0x7ffcf9500daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b4" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3e8cde", "parentcaller": "0x7ffcfb429c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416e46", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8_v.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04\\x00\\x00\\x00\\xb4@\\x00\\x00\\xf0\\x00r.a\\x01\\x00\\x00\\xf0\\x00r.a\\x01\\x00\\x00`\\x00r.a\\x01\\x00\\x00`\\x00r.a\\x01\\x00\\x00\\x00`v.a\\x01\\x00\\x00\\x00\\x90\\x0b\\x00" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416e9b", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0Zv.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416ec0", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416f0e", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\x8eu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416f37", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416f8f", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98[v.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb417048", "parentcaller": "0x7ffcfb416fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00\\x91\\xa3\\xe2\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00P\\xca\\xff\\x12\\x19\\x00\\x00\\x00H\\xca\\xff\\x12\\x19\\x00\\x00\\x00\\x18\\xca\\xff\\x12\\x19\\x00\\x00\\x008\\xca\\xff\\x12" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb41707b", "parentcaller": "0x7ffcfb416fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90[v.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc8\\xff\\x12\\x19\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3e8cde", "parentcaller": "0x7ffcfb3e953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x81\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xfe\\x9c\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416e46", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98Xv.a\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416e9b", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " Wv.a\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416ec0", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416f0e", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(\\x8cu.a\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416f37", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb416f8f", "parentcaller": "0x7ffcfb3e8d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8Rv.a\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb417048", "parentcaller": "0x7ffcfb416fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x99\\xd8\\xfc\\x7f\\x00\\x00\\xebPq\\xd8\\xfc\\x7f\\x00\\x00q\\xdc\\xe2\\xc1~\\xca\\x00\\x00(N\\x95\\xd8\\xfc\\x7f\\x00\\x00\\xb0\\xc6\\xff\\x12\\x19\\x00\\x00\\x00\\xa8\\xc6\\xff\\x12\\x19\\x00\\x00\\x00x\\xc6\\xff\\x12\\x19\\x00\\x00\\x00\\x98\\xc6\\xff\\x12" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb41707b", "parentcaller": "0x7ffcfb416fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0Rv.a\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8r\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc4\\xff\\x12\\x19\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x95\\xd8" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd6785", "parentcaller": "0x7ffcf9500e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fd6785", "parentcaller": "0x7ffcf9500e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fce76a", "parentcaller": "0x7ffcf9b90e64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9b90e82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9bbc590" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9b90e9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9bcb0b0" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9b90ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9bc8b50" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcf8fdac31", "parentcaller": "0x7ffcf9b90ed9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffcf9b50000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcf9b7e790" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ffcfb3be715", "parentcaller": "0x7ffcfb3be37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e76b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6784", "caller": "0x7ff608c51f15", "parentcaller": "0x7ff608c51c2d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 457 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6772", "caller": "0x7ff608c510a9", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-28 22:53:06,767", "thread_id": "6772", "caller": "0x7ff608c510a9", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-28 22:53:11,799", "thread_id": "6772", "caller": "0x7ff608c510ea", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-28 22:53:11,799", "thread_id": "6772", "caller": "0x7ff608c51106", "parentcaller": "0x00000000", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "6580" }, { "name": "ThreadId", "value": "6584" }, { "name": "Message", "value": "18" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-28 22:53:11,799", "thread_id": "6772", "caller": "0x7ffcfb40467e", "parentcaller": "0x7ffcfabd734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6772" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-28 22:53:11,799", "thread_id": "6584", "caller": "0x7ff608c517d0", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-28 22:53:11,799", "thread_id": "6772", "caller": "0x7ffcfa0415b8", "parentcaller": "0x7ffcfb3c9a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-28 22:53:11,799", "thread_id": "6772", "caller": "0x7ffcfb40469e", "parentcaller": "0x7ffcfabd734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e6f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025e" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\vds_ps" }, { "name": "DllBase", "value": "0x7ffcd85d0000" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcd85d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfad50000" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c51815", "parentcaller": "0x7ff608c53bb9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcf9e81000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x100001a74" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-28 22:53:12,799", "thread_id": "6784", "caller": "0x7ffcf953bf07", "parentcaller": "0x7ffcf953be66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1612e700000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000228" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb413410" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcfa191000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffcfa191000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb413410" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e8" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e4" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000080" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000084" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ac" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b0" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b4" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000b4" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b4" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000b4" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b4" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb413410" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000009c" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000098" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb413410" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d0" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffcfb3b0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffcfb413410" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000064" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000044" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000005c" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000060" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-28 22:53:12,814", "thread_id": "6584", "caller": "0x7ff608c53bd0", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 575 } ], "threads": [ "6584", "6700", "6692", "6696", "6688", "6772", "6784", "6788" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\System32\\vdsldr.exe -Embedding", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff608c50000", "MainExeSize": "0x0000b000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "MediaCreationTool_22H2.exe", "pid": 6024, "parent_id": 3932, "module_path": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe", "children": [ { "name": "SetupHost.Exe", "pid": 2088, "parent_id": 6024, "module_path": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe", "children": [], "threads": [ "4400", "64", "2728", "3004", "3036", "2320", "6212", "6216", "6220", "6900", "6936", "6940", "6948", "6952", "6972", "6976", "6980", "3052", "2016" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00b40000", "MainExeSize": "0x000ae000", "Bitness": "32-bit" } } ], "threads": [ "5012", "5932", "5956", "5936", "5948", "5172", "5900", "5916", "1856", "5532" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00c50000", "MainExeSize": "0x00b0a000", "Bitness": "32-bit" } }, { "name": "svchost.exe", "pid": 760, "parent_id": 616, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [ { "name": "vdsldr.exe", "pid": 6580, "parent_id": 760, "module_path": "C:\\Windows\\System32\\vdsldr.exe", "children": [], "threads": [ "6584", "6700", "6692", "6696", "6688", "6772", "6784", "6788" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\System32\\vdsldr.exe -Embedding", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff608c50000", "MainExeSize": "0x0000b000", "Bitness": "64-bit" } } ], "threads": [ "856", "972", "1160", "716", "944" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6cca40000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } }, { "name": "svchost.exe", "pid": 5648, "parent_id": 616, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [], "threads": [ "4908", "5080", "4484", "4264", "5640", "5636", "4488", "7064", "7068", "5380", "5244", "5456", "3816", "3908", "5848", "5888" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-HGH2VBT", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "12bc-0026", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6cca40000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } } ], "summary": { "files": [ "C:\\Windows\\System32\\en-US\\mfc42u.dll.mui", "C:\\Windows\\sysnative\\en-US\\mfc42u.dll.mui", "C:\\Windows\\System32\\MFC42LOC.DLL", "C:\\Windows\\System32\\MFC42LOC.DLL.DLL", "C:\\Windows\\sysnative\\MFC42LOC.DLL", "C:\\Windows\\sysnative\\MFC42LOC.DLL.DLL", "C:\\Windows\\Logs\\MoSetup", "C:\\Users\\admin\\AppData\\Local\\Temp", "C:\\Windows", "C:\\Windows\\Logs", "C:\\Windows\\Logs\\MoSetup\\BlueBox.log", "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Windows\\System32\\tzres.dll", "C:\\Windows\\System32\\en-US\\tzres.dll.mui", "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui", "C:\\Users\\admin\\AppData\\Local\\Temp\\Lang.ini", "C:\\$Windows.~WS\\Sources", "C:\\$Windows.~WS", "C:\\Windows\\SystemResources\\USER32.dll.mun", "C:\\Windows\\SystemResources\\mfc42u.dll.mun", "C:\\Windows\\System32\\kernel.appcore.dll", "\\Device\\CNG", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Users\\admin\\AppData\\Local\\Temp\\TextShaping.dll", "C:\\Windows\\System32\\TextShaping.dll", "C:\\$Windows.~LS", "C:\\Windows\\System32\\textinputframework.dll", "C:\\Windows\\System32\\coreuicomponents.dll", "C:\\Windows\\System32\\coremessaging.dll", "C:\\Windows\\System32\\ntmarta.dll", "C:\\Windows\\System32\\WinTypes.dll", "C:\\$Windows.~WS\\Sources\\Panther", "C:\\$Windows.~WS\\Sources\\Rollback", "\\??\\MountPointManager", "C:\\$Windows.~WS\\*", "C:\\$Windows.~WS\\Sources\\*", "C:\\$Windows.~WS\\Sources\\", "C:\\$Windows.~WS\\Sources\\DU.dll", "C:\\$Windows.~WS\\Sources\\DiagTrack.dll", "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe", "C:\\$Windows.~WS\\Sources\\Diager.dll", "C:\\$Windows.~WS\\Sources\\setupplatform.cfg", "C:\\$Windows.~WS\\Sources\\setupplatform.dll", "C:\\$Windows.~WS\\Sources\\unbcl.dll", "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll", "C:\\$Windows.~WS\\Sources\\wdscore.dll", "C:\\$Windows.~WS\\Sources\\wdscsl.dll", "C:\\$Windows.~WS\\Sources\\wdsimage.dll", "C:\\$Windows.~WS\\Sources\\wdstptc.dll", "C:\\$Windows.~WS\\Sources\\wdsutil.dll", "C:\\$Windows.~WS\\Sources\\wpx.dll", "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll", "C:\\$Windows.~WS\\Sources\\SetupCore.dll", "C:\\$Windows.~WS\\Sources\\SetupHost.exe", "C:\\$Windows.~WS\\Sources\\SetupMgr.dll", "C:\\$Windows.~WS\\Sources\\WinDlp.dll", "C:\\$Windows.~WS\\Sources\\pidgenx.dll", "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms", "C:\\Users\\admin\\AppData\\Local\\Temp\\products.cab", "C:\\Users\\admin\\AppData\\Local\\Temp\\DUDownload", "C:\\$Windows.~WS\\DUDownload\\Cab", "C:\\$Windows.~WS\\DUDownload\\Setup", "\\Device\\NamedPipe\\", "C:\\Windows\\System32\\bcryptPrimitives.dll", "C:\\$Windows.~WS\\Sources\\inf\\setup.cfg", "C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll", "C:\\Windows\\Branding\\Basebrd\\basebrd.dll", "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui", "C:\\$Windows.~WS\\Sources\\SetupHost.Exe", "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log", "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml", "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml", "C:\\$Windows.~WS\\Sources\\Panther\\setuplog.cfg", "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log", "C:\\$Windows.~WS\\Sources\\Lang.ini", "C:\\Windows\\System32\\msctf.dll", "C:\\$WINDOWS.~BT\\Sources\\Panther\\SetupAct.log", "C:\\Windows\\setuplog.cfg", "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll", "C:\\$Windows.~WS\\Sources\\diagtrack.dll", "C:\\$Windows.~WS\\Sources\\diagtrackrunner.exe", "C:\\$Windows.~WS\\Sources\\reagent.admx", "C:\\$Windows.~WS\\Sources\\dismapi.dll", "C:\\$Windows.~WS\\Sources\\cmi2migxml.dll", "C:\\Windows\\System32\\kernel32.dll", "C:\\Windows\\Panther", "C:\\$Windows.~WS\\Sources\\Autounattend.xml", "C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat", "C:\\$Windows.~WS\\", "C:", "C:\\$WINDOWS.~BT", "C:\\$WINDOWS.~BT\\", "C:\\", "C:\\$WINDOWS.~BT\\Sources", "C:\\$WINDOWS.~BT\\Sources\\Panther", "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log", "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml", "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml", "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log", "C:\\$Windows.~WS\\Sources\\WINSTA.dll", "C:\\Windows\\System32\\winsta.dll", "C:\\Windows\\System32\\mswsock.dll", "C:\\Windows\\System32\\en-US\\mswsock.dll.mui", "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui", "C:\\Windows\\System32\\wshqos.dll", "C:\\Windows\\System32\\en-US\\wshqos.dll.mui", "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui", "C:\\$Windows.~WS\\Sources\\ncrypt.dll", "C:\\Windows\\System32\\ncrypt.dll", "C:\\Windows\\System32\\dnsapi.dll", "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "C:\\Windows\\System32\\en-US\\CRYPT32.dll.mui", "C:\\Windows\\sysnative\\en-US\\CRYPT32.dll.mui", "C:\\$Windows.~WS\\Sources\\DPAPI.DLL", "C:\\Windows\\System32\\dpapi.dll", "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml", "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml", "C:\\$Windows.~WS\\Sources\\Sources\\ws.dat", "C:\\$Windows.~WS\\Sources\\Panther\\LegacyInterrupt.dat", "C:\\$Windows.~WS\\Sources\\products.cab", "\\Device\\RasAcd", "C:\\Windows\\System32\\devrtl.dll", "C:\\Windows\\INF\\", "C:\\$Windows.~WS\\Sources\\products.xml", "C:\\Windows\\System32\\en-US\\USER32.dll.mui", "C:\\$Windows.~WS\\SystemResources\\MediaSetupUIMgr.dll.mun", "C:\\Windows\\SystemResources\\MFC42u.dll.mun", "C:\\Windows\\System32\\CoreUIComponents.dll", "C:\\Windows\\System32\\CoreMessaging.dll", "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf", "C:\\Windows\\win.ini", "C:\\Windows\\System32\\UxTheme.dll.Config", "C:\\Windows\\System32\\uxtheme.dll", "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db", "C:\\Windows\\System32\\twinapi.appcore.dll", "C:\\Windows\\System32\\vdsldr.exe", "\\??\\PhysicalDrive0", "\\Device\\DeviceApi\\Dev\\Query", "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM", "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER" ], "read_files": [], "write_files": [ "C:\\Windows\\Logs\\MoSetup\\BlueBox.log", "C:\\$Windows.~WS\\Sources\\DU.dll", "C:\\$Windows.~WS\\Sources\\DiagTrack.dll", "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe", "C:\\$Windows.~WS\\Sources\\Diager.dll", "C:\\$Windows.~WS\\Sources\\setupplatform.cfg", "C:\\$Windows.~WS\\Sources\\setupplatform.dll", "C:\\$Windows.~WS\\Sources\\unbcl.dll", "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll", "C:\\$Windows.~WS\\Sources\\wdscore.dll", "C:\\$Windows.~WS\\Sources\\wdscsl.dll", "C:\\$Windows.~WS\\Sources\\wdsimage.dll", "C:\\$Windows.~WS\\Sources\\wdstptc.dll", "C:\\$Windows.~WS\\Sources\\wdsutil.dll", "C:\\$Windows.~WS\\Sources\\wpx.dll", "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll", "C:\\$Windows.~WS\\Sources\\SetupCore.dll", "C:\\$Windows.~WS\\Sources\\SetupHost.exe", "C:\\$Windows.~WS\\Sources\\SetupMgr.dll", "C:\\$Windows.~WS\\Sources\\WinDlp.dll", "C:\\$Windows.~WS\\Sources\\pidgenx.dll", "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms", "C:\\$Windows.~WS\\Sources\\Panther", "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log", "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml", "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml", "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log", "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log", "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml", "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml", "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log", "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml", "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml", "\\Device\\RasAcd", "C:\\$Windows.~WS\\Sources\\products.cab", "C:\\$Windows.~WS\\Sources\\products.xml", "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf", "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM", "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER" ], "delete_files": [ "C:\\$Windows.~WS\\Sources", "C:\\$Windows.~WS" ], "keys": [ "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode", "HKEY_CURRENT_USER", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Tahoma", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI Light", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_CURRENT_USER\\Software\\Classes", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\SetupHost.Exe", "HKEY_LOCAL_MACHINE\\Software\\Classes\\AppID\\SetupHost.Exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Sysprep", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Panther", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupPlatform", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AMSI\\Providers", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId", "HKEY_LOCAL_MACHINE\\System\\Setup", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\#16", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\Ldap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllOpenStoreProv", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime", "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter", "HKEY_CURRENT_USER\\Control Panel\\International\\Geo", "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\ProductOptions", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Tracking", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob", "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Setup", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\vds\\DebugLog", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\vdsldr.exe", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\Elevation", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "write_keys": [ "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase" ], "delete_keys": [], "executed_commands": [ "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web", "C:\\Windows\\System32\\vdsldr.exe -Embedding" ], "resolved_apis": [ "ntdll.dll.RtlWow64GetCurrentMachine", "ntdll.dll.RtlWow64IsWowGuestMachineSupported" ], "mutexes": [ "Local\\SM0:6024:168:WilStaging_02", "Global\\Microsoft.Windows.Websetup", "Local\\MSCTF.Asm.MutexDefault1", "CicLoadWinStaWinSta0", "Local\\SM0:2088:168:WilStaging_02", "Global\\WdsSetupLogInit", "Global\\SetupLog", "Global\\OneSettingQueryMutex+WSD+Setup360", "Local\\MSCTF.CtfMonitorInstMutexDefault1", "Local\\SM0:2088:64:WilError_03" ], "created_services": [], "started_services": [] }, "enhanced": [ { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,272", "eid": 1, "data": { "file": "MSVCRT.DLL", "pathtofile": null, "moduleaddress": "0x76d70000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,272", "eid": 2, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,272", "eid": 3, "data": { "file": "KERNELBASE.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,272", "eid": 4, "data": { "file": "api-ms-win-core-guard-l1-1-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,272", "eid": 5, "data": { "file": "LPK.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,272", "eid": 6, "data": { "file": "KERNEL32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,272", "eid": 7, "data": { "file": "imm32.dll", "pathtofile": null, "moduleaddress": "0x76e30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,350", "eid": 8, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,350", "eid": 9, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:52:59,350", "eid": 10, "data": { "file": "C:\\Windows\\Logs\\MoSetup" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,350", "eid": 11, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,350", "eid": 12, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,350", "eid": 13, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,350", "eid": 14, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,381", "eid": 15, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,381", "eid": 16, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,381", "eid": 17, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,397", "eid": 18, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,397", "eid": 19, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,397", "eid": 20, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,397", "eid": 21, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,413", "eid": 22, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 23, "data": { "file": "RICHED32.DLL", "pathtofile": null, "moduleaddress": "0x6cd10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 24, "data": { "file": "COMCTL32.DLL", "pathtofile": null, "moduleaddress": "0x6b5c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 25, "data": { "file": "COMCTL32.DLL", "pathtofile": null, "moduleaddress": "0x6b5c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 26, "data": { "file": "COMCTL32.DLL", "pathtofile": null, "moduleaddress": "0x6b5c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 27, "data": { "file": "COMCTL32.DLL", "pathtofile": null, "moduleaddress": "0x6b5c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 28, "data": { "file": "COMCTL32.DLL", "pathtofile": null, "moduleaddress": "0x6b5c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 29, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x747b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 30, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:52:59,475", "eid": 31, "data": { "file": "C:\\$Windows.~WS\\Sources" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:52:59,475", "eid": 32, "data": { "file": "C:\\$Windows.~WS" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,475", "eid": 33, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 34, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,475", "eid": 35, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,491", "eid": 36, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,491", "eid": 37, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,491", "eid": 38, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,491", "eid": 39, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,491", "eid": 40, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,491", "eid": 41, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,491", "eid": 42, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath", "content": "C:\\Windows\\Fonts\\staticcache.dat" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,491", "eid": 43, "data": { "file": "C:\\Windows\\Fonts\\StaticCache.dat" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,491", "eid": 44, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,506", "eid": 45, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,506", "eid": 46, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,506", "eid": 47, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 48, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 49, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2", "content": "SimSun-ExtB" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 50, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 51, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 52, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 53, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 54, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 55, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 56, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 57, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 58, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 59, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 60, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 61, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 62, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,522", "eid": 63, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,522", "eid": 64, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,538", "eid": 65, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,538", "eid": 66, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,538", "eid": 67, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,538", "eid": 68, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,538", "eid": 69, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,538", "eid": 70, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,538", "eid": 71, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,538", "eid": 72, "data": { "file": "USER32", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,553", "eid": 73, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,553", "eid": 74, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,553", "eid": 75, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,553", "eid": 76, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,569", "eid": 77, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:52:59,569", "eid": 78, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,569", "eid": 79, "data": { "file": "USER32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,569", "eid": 80, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,569", "eid": 81, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:52:59,569", "eid": 82, "data": { "file": "C:\\$Windows.~WS" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,569", "eid": 83, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:52:59,569", "eid": 84, "data": { "file": "C:\\$Windows.~WS\\Sources" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,569", "eid": 85, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,584", "eid": 86, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,584", "eid": 87, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,584", "eid": 88, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,584", "eid": 89, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,600", "eid": 90, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,600", "eid": 91, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,600", "eid": 92, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:52:59,600", "eid": 93, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x76ba0000" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,600", "eid": 94, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 95, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 96, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 97, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 98, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 99, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 100, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 101, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 102, "data": { "file": "C:\\$Windows.~WS\\Sources\\DU.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 103, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 104, "data": { "file": "C:\\$Windows.~WS\\Sources\\DU.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 105, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 106, "data": { "file": "C:\\$Windows.~WS\\Sources\\DU.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 107, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 108, "data": { "file": "C:\\$Windows.~WS\\Sources\\DU.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 109, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,616", "eid": 110, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 111, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 112, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 113, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 114, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 115, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 116, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 117, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 118, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 119, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 120, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 121, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 122, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 123, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 124, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 125, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 126, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 127, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 128, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 129, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 130, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 131, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 132, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 133, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 134, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 135, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 136, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 137, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 138, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 139, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 140, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 141, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 142, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 143, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 144, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 145, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 146, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 147, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 148, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 149, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 150, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 151, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 152, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 153, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 154, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 155, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 156, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 157, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,631", "eid": 158, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 159, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 160, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 161, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 162, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 163, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 164, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 165, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 166, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 167, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 168, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 169, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 170, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 171, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 172, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 173, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 174, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 175, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 176, "data": { "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 177, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 178, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 179, "data": { "file": "C:\\$Windows.~WS\\Sources\\Diager.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 180, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 181, "data": { "file": "C:\\$Windows.~WS\\Sources\\Diager.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 182, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,647", "eid": 183, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 184, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 185, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 186, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 187, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 188, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 189, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 190, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 191, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 192, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 193, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 194, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 195, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 196, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 197, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 198, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 199, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 200, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 201, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 202, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 203, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 204, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 205, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 206, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 207, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 208, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 209, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 210, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 211, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 212, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 213, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 214, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 215, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 216, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 217, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 218, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 219, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 220, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 221, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 222, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 223, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 224, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 225, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,663", "eid": 226, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 227, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 228, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 229, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 230, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 231, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 232, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 233, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 234, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 235, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 236, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 237, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 238, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 239, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 240, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 241, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 242, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 243, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 244, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 245, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 246, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 247, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,678", "eid": 248, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 249, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 250, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 251, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 252, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 253, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 254, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 255, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 256, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 257, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 258, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,756", "eid": 259, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 260, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 261, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 262, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 263, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 264, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 265, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 266, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 267, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 268, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 269, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 270, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 271, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 272, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 273, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 274, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 275, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 276, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 277, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 278, "data": { "file": "C:\\$Windows.~WS\\Sources\\unbcl.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 279, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 280, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 281, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 282, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 283, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 284, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 285, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 286, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 287, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 288, "data": { "file": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,772", "eid": 289, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 290, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 291, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 292, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 293, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 294, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 295, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 296, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 297, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 298, "data": { "file": "C:\\$Windows.~WS\\Sources\\wdscore.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 299, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 300, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 301, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 302, "data": { "file": "C:\\$Windows.~WS\\Sources\\wdscsl.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 303, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 304, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 305, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 306, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 307, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 308, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 309, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 310, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 311, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 312, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 313, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,788", "eid": 314, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 315, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 316, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 317, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 318, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 319, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 320, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 321, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 322, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 323, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 324, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 325, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 326, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 327, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 328, "data": { "file": "C:\\$Windows.~WS\\Sources\\wdsimage.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 329, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 330, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 331, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 332, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 333, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 334, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 335, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 336, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 337, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,803", "eid": 338, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 339, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 340, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 341, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 342, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 343, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 344, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 345, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 346, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 347, "data": { "file": "C:\\$Windows.~WS\\Sources\\wdstptc.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 348, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 349, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 350, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 351, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 352, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 353, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 354, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 355, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 356, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 357, "data": { "file": "C:\\$Windows.~WS\\Sources\\wdsutil.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 358, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 359, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 360, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 361, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 362, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 363, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 364, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 365, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 366, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 367, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 368, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 369, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 370, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 371, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 372, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 373, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 374, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 375, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 376, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 377, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 378, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 379, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 380, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 381, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,819", "eid": 382, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 383, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 384, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 385, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 386, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 387, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 388, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 389, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 390, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 391, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 392, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 393, "data": { "file": "C:\\$Windows.~WS\\Sources\\wpx.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 394, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 395, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 396, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 397, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 398, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 399, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 400, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 401, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 402, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 403, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 404, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 405, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 406, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 407, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 408, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 409, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 410, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 411, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 412, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 413, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,834", "eid": 414, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 415, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 416, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 417, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 418, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 419, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 420, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 421, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 422, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 423, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 424, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 425, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 426, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 427, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 428, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 429, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 430, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 431, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 432, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 433, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 434, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 435, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 436, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 437, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 438, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 439, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 440, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 441, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 442, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 443, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,850", "eid": 444, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 445, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 446, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 447, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 448, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 449, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 450, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 451, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 452, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 453, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 454, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 455, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 456, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 457, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 458, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 459, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 460, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 461, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 462, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 463, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 464, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 465, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 466, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,959", "eid": 467, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 468, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 469, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 470, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 471, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 472, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 473, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 474, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 475, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 476, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 477, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 478, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 479, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 480, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 481, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 482, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 483, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 484, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 485, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 486, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 487, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 488, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 489, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 490, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 491, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 492, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 493, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 494, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 495, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,975", "eid": 496, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 497, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 498, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 499, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 500, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 501, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 502, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 503, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 504, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 505, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 506, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 507, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 508, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 509, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 510, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 511, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 512, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 513, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 514, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 515, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 516, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 517, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 518, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 519, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 520, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 521, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 522, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupHost.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 523, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 524, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 525, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 526, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 527, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 528, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 529, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 530, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:52:59,991", "eid": 531, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 532, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 533, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 534, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 535, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 536, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 537, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 538, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 539, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 540, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 541, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 542, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 543, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 544, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 545, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 546, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 547, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 548, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 549, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 550, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 551, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 552, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 553, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 554, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 555, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 556, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 557, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 558, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 559, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 560, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 561, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 562, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 563, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 564, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 565, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 566, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 567, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 568, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 569, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,006", "eid": 570, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 571, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 572, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 573, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 574, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 575, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 576, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 577, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 578, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 579, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 580, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 581, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 582, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 583, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 584, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 585, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 586, "data": { "file": "C:\\$Windows.~WS\\Sources\\WinDlp.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 587, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 588, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 589, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 590, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 591, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 592, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 593, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 594, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 595, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 596, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 597, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 598, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 599, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 600, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 601, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 602, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 603, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 604, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 605, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 606, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 607, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,022", "eid": 608, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 609, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 610, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 611, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 612, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 613, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 614, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 615, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 616, "data": { "file": "C:\\$Windows.~WS\\Sources\\pidgenx.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 617, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 618, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 619, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 620, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 621, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 622, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 623, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 624, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 625, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 626, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 627, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 628, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 629, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 630, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 631, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 632, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 633, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 634, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 635, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 636, "data": { "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,038", "eid": 637, "data": { "file": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,038", "eid": 638, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,038", "eid": 639, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:00,038", "eid": 640, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,038", "eid": 641, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,256", "eid": 642, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,272", "eid": 643, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:00,272", "eid": 644, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,272", "eid": 645, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,538", "eid": 646, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,538", "eid": 647, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,538", "eid": 648, "data": { "file": "C:\\Windows\\System32\\apphelp.dll", "pathtofile": null, "moduleaddress": "0x74cf0000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 22:53:00,538", "eid": 649, "data": { "file": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,538", "eid": 650, "data": { "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,637", "eid": 651, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,637", "eid": 652, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 653, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 654, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 655, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,637", "eid": 656, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 657, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 658, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 659, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,637", "eid": 660, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 661, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 662, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 663, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 664, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 665, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 666, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 667, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:53:00,637", "eid": 668, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 669, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 670, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId", "content": "0e9cfb40-0d63-45be-b169-515d335337a8" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,637", "eid": 671, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,637", "eid": 672, "data": { "file": "winbrand.dll", "pathtofile": null, "moduleaddress": "0x6af00000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,637", "eid": 673, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 674, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x75310000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 675, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 676, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 677, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 678, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 679, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 680, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 681, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 682, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 683, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:00,653", "eid": 684, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector", "content": "JmmmUsfwaU6RoNLc.0" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 685, "data": { "file": "api-ms-win-eventing-provider-l1-1-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 686, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 687, "data": { "file": "api-ms-win-core-processthreads-l1-1-2.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 688, "data": { "file": "api-ms-win-core-file-l1-2-1.dll", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 689, "data": { "file": "C:\\Windows\\System32\\dbghelp.dll", "pathtofile": null, "moduleaddress": "0x6ada0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 690, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,653", "eid": 691, "data": { "file": "api-ms-win-core-processthreads-l1-1-2.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,653", "eid": 692, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,653", "eid": 693, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 694, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 695, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 696, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 697, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 698, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 699, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 700, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 701, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,669", "eid": 702, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 703, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 704, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 705, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 706, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 707, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 708, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 709, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 710, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 711, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 712, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 713, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 714, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": "Client" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 715, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": "Professional" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 716, "data": { "file": "winbrand.dll", "pathtofile": null, "moduleaddress": "0x6ad40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 717, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 718, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x75310000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 719, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 720, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 721, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 722, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 723, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": "Professional" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 724, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 725, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": "Client" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 726, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 727, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": "Client" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 728, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 729, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": "Professional" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 730, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 731, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": "Client" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:00,684", "eid": 732, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 733, "data": { "file": "SLC.DLL", "pathtofile": null, "moduleaddress": "0x6bba0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:00,684", "eid": 734, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:00,684", "eid": 735, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 736, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 737, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 738, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 739, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 740, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 741, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:01,059", "eid": 742, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:01,059", "eid": 743, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "content": "19041.1.amd64fre.vb_release.191206-1406" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 744, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 745, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,059", "eid": 746, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,856", "eid": 747, "data": { "file": "MSVCRT.DLL", "pathtofile": null, "moduleaddress": "0x76d70000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,856", "eid": 748, "data": { "file": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll", "pathtofile": null, "moduleaddress": "0x69e80000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,856", "eid": 749, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,856", "eid": 750, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,872", "eid": 751, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,872", "eid": 752, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,872", "eid": 753, "data": { "file": "RICHED32.DLL", "pathtofile": null, "moduleaddress": "0x6cd10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,872", "eid": 754, "data": { "file": "MediaSetupUIMgr.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,872", "eid": 755, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,872", "eid": 756, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,872", "eid": 757, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,872", "eid": 758, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,887", "eid": 759, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x747b0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:01,887", "eid": 760, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,997", "eid": 761, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupCore.dll", "pathtofile": null, "moduleaddress": "0x69c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,997", "eid": 762, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,997", "eid": 763, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,997", "eid": 764, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,997", "eid": 765, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupCore.dll", "pathtofile": null, "moduleaddress": "0x69c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:01,997", "eid": 766, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,997", "eid": 767, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:01,997", "eid": 768, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,215", "eid": 769, "data": { "file": "api-ms-win-core-processthreads-l1-1-2.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,215", "eid": 770, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll", "pathtofile": null, "moduleaddress": "0x69520000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,215", "eid": 771, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,215", "eid": 772, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,215", "eid": 773, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,231", "eid": 774, "data": { "file": "api-ms-win-core-processthreads-l1-1-2.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,231", "eid": 775, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll", "pathtofile": null, "moduleaddress": "0x69520000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,231", "eid": 776, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,231", "eid": 777, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,231", "eid": 778, "data": { "file": "C:\\Windows\\System32\\dbghelp.dll", "pathtofile": null, "moduleaddress": "0x6ada0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:02,231", "eid": 779, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,528", "eid": 780, "data": { "file": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,528", "eid": 781, "data": { "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll", "pathtofile": null, "moduleaddress": "0x69430000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,544", "eid": 782, "data": { "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll", "pathtofile": null, "moduleaddress": "0x693b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 783, "data": { "file": "C:\\Windows\\System32\\wbem\\fastprox.dll", "pathtofile": null, "moduleaddress": "0x692e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 784, "data": { "file": "api-ms-win-core-localization-l1-2-0.dll", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 785, "data": { "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 786, "data": { "file": "amsi.dll", "pathtofile": null, "moduleaddress": "0x692c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 787, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 788, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 789, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 790, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,559", "eid": 791, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x77870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,575", "eid": 792, "data": { "file": "C:\\Windows\\System32\\version.dll", "pathtofile": null, "moduleaddress": "0x750a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,575", "eid": 793, "data": { "file": "C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll", "pathtofile": null, "moduleaddress": "0x69280000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 794, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)", "content": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 795, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 796, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 797, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)", "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 798, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 799, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 800, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\wbem\\fastprox.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 801, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\wbem\\fastprox.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 802, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 803, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 804, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 805, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)", "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 806, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 807, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 808, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\wbem\\fastprox.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 809, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\wbem\\fastprox.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 810, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 811, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 812, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "content": "{7C857801-7381-11CF-884D-00AA004B2E24}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,575", "eid": 813, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "content": "{7C857801-7381-11CF-884D-00AA004B2E24}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,606", "eid": 814, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,606", "eid": 815, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,622", "eid": 816, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": "DESKTOP-HGH2VBT" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,622", "eid": 817, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,622", "eid": 818, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": "DESKTOP-HGH2VBT" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,622", "eid": 819, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,622", "eid": 820, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": "DESKTOP-HGH2VBT" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,622", "eid": 821, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "content": "" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,622", "eid": 822, "data": { "file": "SetupPlatform.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 823, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 824, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 825, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 826, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 827, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 828, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 829, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 830, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 831, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 832, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 833, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,622", "eid": 834, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,637", "eid": 835, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,637", "eid": 836, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 22:53:06,637", "eid": 837, "data": { "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 838, "data": { "file": "C:\\$Windows.~WS\\Sources\\migcore.dll", "pathtofile": null, "moduleaddress": "0x00000000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 839, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 840, "data": { "file": "api-ms-win-eventing-provider-l1-1-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 841, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 842, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 843, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 844, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 845, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 846, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 847, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 848, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x691f0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 849, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 850, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 851, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 852, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 853, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 854, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 855, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 856, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 857, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 858, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 859, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 860, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 861, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 862, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 863, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 864, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 865, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 866, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 867, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 868, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 869, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,637", "eid": 870, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 871, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 872, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "content": "19041.1.amd64fre.vb_release.191206-1406" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 873, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,637", "eid": 874, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,653", "eid": 875, "data": { "file": "SetupPlatform.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,762", "eid": 876, "data": { "file": "C:\\Windows\\System32\\vds_ps.dll", "pathtofile": null, "moduleaddress": "0x69270000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,762", "eid": 877, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,762", "eid": 878, "data": { "file": "SetupPlatform.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,762", "eid": 879, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,762", "eid": 880, "data": { "file": "SetupPlatform.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:53:06,778", "eid": 881, "data": { "file": "C:\\$WINDOWS.~BT" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:53:06,778", "eid": 882, "data": { "file": "C:\\$WINDOWS.~BT\\Sources" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-28 22:53:06,778", "eid": 883, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,778", "eid": 884, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,778", "eid": 885, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 886, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 887, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 888, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 889, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 890, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 891, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 892, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 893, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 894, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 895, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 896, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 897, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,794", "eid": 898, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 899, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 900, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 901, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 902, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 903, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 904, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 905, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 906, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 907, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 908, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 909, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 910, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 911, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 912, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 913, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 914, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 915, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 916, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 917, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 918, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 919, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 920, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 921, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 922, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 923, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 924, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 925, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 926, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 927, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 928, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 929, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 930, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 931, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 932, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 933, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 934, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,809", "eid": 935, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 936, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 937, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 938, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 939, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 940, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 941, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 942, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 943, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,825", "eid": 944, "data": { "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,840", "eid": 945, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 946, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 947, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 948, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 949, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 950, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 951, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 952, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 953, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x69b80000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 954, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 955, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 956, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 957, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 958, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 959, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 960, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 961, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 962, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 963, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 964, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 965, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 966, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 967, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 968, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 969, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 970, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 971, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 972, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 973, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 974, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 975, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 976, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 977, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 978, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 979, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 980, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 981, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 982, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "content": "19041.1.amd64fre.vb_release.191206-1406" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 983, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 984, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": "3803" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 985, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 986, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 987, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 988, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId", "content": "Professional" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 989, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 990, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 991, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType", "content": "Client" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 992, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 993, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 994, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 995, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId", "content": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 996, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 997, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 998, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 999, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 1000, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,856", "eid": 1001, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:06,856", "eid": 1002, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 1003, "data": { "file": "winhttp.dll", "pathtofile": null, "moduleaddress": "0x72780000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 1004, "data": { "file": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll", "pathtofile": null, "moduleaddress": "0x6e670000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,856", "eid": 1005, "data": { "file": "winhttp.dll", "pathtofile": null, "moduleaddress": "0x72780000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,872", "eid": 1006, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77ac0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1007, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,872", "eid": 1008, "data": { "file": "C:\\Windows\\System32\\mswsock.dll", "pathtofile": null, "moduleaddress": "0x6e610000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,872", "eid": 1009, "data": { "file": "C:\\Windows\\System32\\mswsock.dll", "pathtofile": null, "moduleaddress": "0x6e610000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1010, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1011, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version", "content": "2.0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1012, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1013, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL", "content": "C:\\Windows\\System32\\rasadhlp.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1014, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1015, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1017, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1018, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1019, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1020, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1021, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1022, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1023, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1024, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1025, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1026, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1027, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1028, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1029, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1030, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1031, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1032, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1033, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1034, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1035, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1036, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1038, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1044, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1046, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1050, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1051, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1052, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1053, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1054, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1055, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1056, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1057, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1058, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1059, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1060, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1061, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1062, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1063, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1064, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1065, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1066, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1067, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1068, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1069, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1070, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1071, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1072, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1073, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1074, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1075, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1076, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1077, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1078, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1079, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1080, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1081, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1082, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1083, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1084, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1085, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1086, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1087, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1088, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1089, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1090, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1091, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1092, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1093, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1094, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1095, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1096, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1097, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1098, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": "DESKTOP-HGH2VBT" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1099, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1100, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1101, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:06,872", "eid": 1102, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "content": "DESKTOP-HGH2VBT" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:06,903", "eid": 1103, "data": { "file": "C:\\Windows\\System32\\FWPUCLNT.DLL", "pathtofile": null, "moduleaddress": "0x6d200000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,028", "eid": 1104, "data": { "file": "C:\\Windows\\SysWOW64\\schannel.dll", "pathtofile": null, "moduleaddress": "0x6d180000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,028", "eid": 1105, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,028", "eid": 1106, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,294", "eid": 1107, "data": { "file": "sspicli.dll", "pathtofile": null, "moduleaddress": "0x74d90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,294", "eid": 1108, "data": { "file": "mskeyprotect.dll", "pathtofile": null, "moduleaddress": "0x6d170000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,294", "eid": 1109, "data": { "file": "C:\\Windows\\System32\\ncryptsslp.dll", "pathtofile": null, "moduleaddress": "0x6d120000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,294", "eid": 1110, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x76ba0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1111, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name", "content": "@%SystemRoot%\\system32\\dnsapi.dll,-103" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1112, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1113, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "content": "Domain Name System (DNS) Server Trust" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1114, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name", "content": "@%SystemRoot%\\system32\\dnsapi.dll,-103" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1115, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1116, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "content": "Domain Name System (DNS) Server Trust" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1117, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name", "content": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1118, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1119, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "content": "Document Encryption" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1120, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name", "content": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1122, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "content": "Document Encryption" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1123, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1131, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1132, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1133, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1134, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1135, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1136, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1137, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1138, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1139, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1140, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1141, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1142, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob", "content": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00'\\x9c\\xd6R\\xc4\\xe2R\\xbf\\xbeR\\x17\\xacr\"\\x05\\xd7r\\x9b\\xa4\t\\x14\\x8c\\xfa\\x9em\\x9e[\\x1c\\xb9N\\xaf\\xf1\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00T\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00C\\x00e\\x00r\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00e\\x00 \\x00A\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00 \\x002\\x000\\x001\\x001\\x00\\x00\\x00i\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0e\\x00\\x00\\x000\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x03\\x02\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x8fC(\\x8a\\xd2r\\xf3\\x10;o\\xb1B\\x84\\x85\\xea0\\x14\\xc0\\xbc\\xfe\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00r-:\\x021\\x90C\\xb9\\x14\\x05N\\xe1\\xea\\xa7\\xc71\\xd1#\\x894\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\x04\\x90\\xd5\\xe5l4\\xa5\\xae\\x0b\\xe9\\x8b\\xe5\\x81\\x18] \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf1\\x05\\x00\\x000\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1144, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1145, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime", "content": "?\\xc2x|\\xb6\\xee\\xdc\\x01" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,294", "eid": 1147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "content": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag", "content": "1371:66A2A386" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval", "content": "1371" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1153, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1154, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1155, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os", "content": "windows" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1156, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver", "content": "10.0.19041.3803.amd64fre.vb_release.191206-1406" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1157, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId", "content": "7" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition", "content": "Professional" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType", "content": "Client" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1160, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku", "content": "48" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1161, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId", "content": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1162, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver", "content": "10.0.19041.572" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1163, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab", "content": "vb_release_svc_prod1" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,419", "eid": 1164, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter", "content": "IK\\xbdF\\xb4\\xef\\xdc\\x01" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,419", "eid": 1165, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,419", "eid": 1166, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,434", "eid": 1167, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,434", "eid": 1168, "data": { "file": "api-ms-win-core-processthreads-l1-1-2.dll", "pathtofile": null, "moduleaddress": "0x75d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,434", "eid": 1169, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll", "pathtofile": null, "moduleaddress": "0x69ad0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,434", "eid": 1170, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,450", "eid": 1171, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,465", "eid": 1172, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1173, "data": { "regkey": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation", "content": "12" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1174, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1175, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId", "content": "0e9cfb40-0d63-45be-b169-515d335337a8" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1176, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1177, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1178, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch", "content": "vb_release" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1179, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1180, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1181, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1182, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType", "content": "WinNT" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,481", "eid": 1183, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,481", "eid": 1184, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,481", "eid": 1185, "data": { "file": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,497", "eid": 1186, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,497", "eid": 1187, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,497", "eid": 1188, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks", "content": "0" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 22:53:07,497", "eid": 1189, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,497", "eid": 1190, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,497", "eid": 1191, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,497", "eid": 1192, "data": { "file": "winhttp.dll", "pathtofile": null, "moduleaddress": "0x72780000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,497", "eid": 1193, "data": { "file": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll", "pathtofile": null, "moduleaddress": "0x6e670000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 22:53:07,497", "eid": 1194, "data": { "file": "winhttp.dll", "pathtofile": null, "moduleaddress": "0x72780000" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,497", "eid": 1195, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,497", "eid": 1196, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,497", "eid": 1197, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,512", "eid": 1198, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 22:53:07,528", "eid": 1199, "data": { "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1200, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1201, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1202, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1203, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1204, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1205, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1206, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1207, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1208, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1209, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1210, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1211, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1212, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1213, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1214, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1215, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1216, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:07,559", "eid": 1217, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob", "content": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14\\xc3\\xbd5I\\xee\"Z\\xec\\xe174\\xad\\x8c\\xa0\\xb8\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xdf<$\\xf9\\xbf\\xd6fv\\x1b&\\x80s\\xfe\\x06\\xd1\\xcc\\x8dO\\x82\\xa4~\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x80\\xc8+h\\x86\\xd7\\x01\\x7f\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x000\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00}\\xc3\\x0b\\xc9tiU`\\xa2\\xf0\t\neEUl\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00N\"T \\x18\\x95\\xe6\\xe3n\\xe6\\x0f\\xfa\\xfa\\xb9\\x12\\xed\\x06\\x17\\x8f9b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\xcb<\\xcb\\xb7`1\\xe5\\xe0\\x13\\x8f\\x8d\\xd3\\x9a#\\xf9\\xdeG\\xff\\xc3^C\\xc1\\x14L\\xea'\\xd4jZ\\xb1\\xcb_\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x002\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00KN\\xb4\\xb0t)\\x8b\\x82\\x8b\\\\x000\\x95\\xa1\\x0bE#\\xfb\\x95\\x1c\\x0c\\x884\\x8b\t\\xc5>[\\xab\\xa4\\x08\\xa3\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe4\\xa6\\x8a\\xc8T\\xacRBF\n\\xfdrH\\x1b*D \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92\\x03\\x00\\x000\\x82\\x03\\x8e" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1218, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1219, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1220, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1221, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1222, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1223, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1224, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1225, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1226, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1227, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1228, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1229, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1230, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1231, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1232, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1233, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1234, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 22:53:08,044", "eid": 1235, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob", "content": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x80\\x01\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xb0\t\\xe9\\x9a\\\\xfc\\x92\\x8a\\x171\\x90\\x10m\\xbb2\\xa9\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00~\\x04\\xde\\x89j>fm\\x00\\xe6\\x87\\xd3?\\xfa\\xd9;\\xe8=4\\x9e\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd0\\xab9\\xed\\xd1\\xa4\\xd8\\x9aU\\x12\\x88-\\xeb\t\\xcb\\x13\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb3\\xdbH\\xa4\\xf9\\xa1\\xc5\\xd8\\xae6A\\xcc\\x11cib)\\xbcK\\xc6b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x001\\xadfH\\xf8\\x10A8\\xc78\\xf3\\x9e\\xa42\\x0139>:\\x18\\xcc\\x02)n\\xf9|*\\xc9\\xefg1\\xd0\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x003\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\x82\\xc8\\x01\\x999w\"\\xb5z\\xd4s\\xea&k\\x93\\xd4\\x7f\\xfcw\\xfe\\x07\\xf0\\x93\\x884_ \\xda\\xb6\\xad\\xdd\\x08vr\\xf9\\x88\\xb4\\xbb\\xfd\\x15LK\\x13